What is the main purpose of risk communication in an organization?

To satisfy regulatory requirements only

To keep risk information confidential from all employees

To persuade stakeholders that all risks are under control

To share risk information with stakeholders to support informed decision-making

A company's risk management program is viewed as a compliance burden by employees, and risk assessments are seen as a checkbox exercise. The CISO wants to shift the culture to view risk management as a value-adding activity. Which initiative would be most effective?

Focus only on regulatory risks to ensure compliance

Demonstrate how risk management helps achieve business objectives by linking risks to strategic goals

Centralize risk management in a single department to improve efficiency

Increase the frequency of risk assessments to keep employees engaged

A financial services firm faces a regulatory requirement to protect customer data. The cost of implementing strong encryption and access controls is $1 million, while the potential fine for non-compliance is $10 million and the probability of a breach is 5%. The firm's risk appetite is low. What is the most appropriate risk response?

Accept the risk because the annualized loss expectancy is only $500,000.

Avoid the risk by discontinuing the service that processes customer data.

Transfer the risk by purchasing cyber insurance.

Mitigate the risk by implementing the encryption and access controls.

What is the primary purpose of a risk review meeting?

To evaluate the current status of risks and the effectiveness of risk treatments

To approve all new projects without risk assessment

To finalize the annual budget for risk management

To assign blame for risk management failures

A company has a risk with a high likelihood and high impact. The cost to mitigate the risk is very high, and the company does not have the budget this year. The risk is not related to any regulatory requirement. What is the most appropriate risk response?

Accept the risk and document the decision

Avoid the risk by discontinuing the related activity

Transfer the risk by purchasing insurance

Mitigate the risk partially with available funds

EC-CouncilAssociate C|CISO

Domain 1Objective 4

Risk Management ACCISO Practice Questions (Page 8)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 36–40

36foundation · easy
What is the main purpose of risk communication in an organization?
Select an answer first
37application · medium
A company's risk management program is viewed as a compliance burden by employees, and risk assessments are seen as a checkbox exercise. The CISO wants to shift the culture to view risk management as a value-adding activity. Which initiative would be most effective?
Select an answer first
38application · medium
A financial services firm faces a regulatory requirement to protect customer data. The cost of implementing strong encryption and access controls is $1 million, while the potential fine for non-compliance is $10 million and the probability of a breach is 5%. The firm's risk appetite is low. What is the most appropriate risk response?
Select an answer first
39foundation · easy
What is the primary purpose of a risk review meeting?
Select an answer first
40application · medium
A company has a risk with a high likelihood and high impact. The cost to mitigate the risk is very high, and the company does not have the budget this year. The risk is not related to any regulatory requirement. What is the most appropriate risk response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.