Risk Management ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of a compliance risk assessment?

   • ATo create a list of all regulations that apply to the organization
   • BTo assign responsibility for compliance to a single department
   • CTo determine the exact amount of fines that will be imposed for non-compliance
   • DTo identify and evaluate the risks of non-compliance with applicable laws and regulations
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In quantitative risk analysis, what does the Annualized Loss Expectancy (ALE) represent?

   • AThe probability that a threat will occur in a year
   • BThe maximum loss that could occur from a single incident
   • CThe expected monetary loss per year from a specific risk
   • DThe total cost of all security controls in a given year
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has implemented a risk treatment to reduce the risk of insider threats by implementing user activity monitoring. The CISO wants to establish key risk indicators (KRIs) to monitor this risk. Which KRI would be most relevant?

   • ANumber of IT support tickets opened per month
   • BNumber of alerts generated by the user activity monitoring system per week
   • CPercentage of employees who have completed security awareness training
   • DNumber of user access reviews completed per quarter
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the context of enterprise risk management, what is the most accurate definition of risk?

   • AThe potential financial loss resulting from a security incident
   • BThe total number of vulnerabilities present in an organization's systems and processes
   • CThe probability that a specific threat will exploit a particular vulnerability
   • DThe effect of uncertainty on objectives, often expressed in terms of likelihood and impact
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which risk response strategy involves reducing the likelihood or impact of a risk by implementing controls?

   • ARisk mitigation
   • BRisk avoidance
   • CRisk acceptance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first