A company has implemented a risk treatment plan that includes a new firewall. The risk manager needs to ensure that the firewall is effective and that the risk remains within appetite. Which combination of activities provides the most comprehensive monitoring and review?

Rely on the firewall vendor's support and update notifications.

Review firewall logs monthly and conduct an annual penetration test.

Conduct a one-time security assessment after implementation.

Monitor the firewall's uptime and performance metrics only.

A company has implemented a new security control to mitigate a high-risk vulnerability. The risk manager needs to ensure the control remains effective over time. Which action best supports ongoing risk monitoring and review?

Update the risk register only when a new vulnerability is discovered.

Rely on the control vendor's assurance that the control is effective.

Conduct a one-time penetration test after implementation to verify the control works.

Schedule periodic vulnerability scans and review control effectiveness metrics quarterly.

A healthcare organization is expanding its use of cloud-based patient portals. The security team is conducting a risk identification exercise. Which combination of techniques would most effectively identify risks specific to this new service?

Conducting a business impact analysis on existing on-premises systems

Reviewing only historical incident reports from other departments

Performing a quantitative analysis of all enterprise risks

Threat modeling and vulnerability scanning of the portal application

EC-CouncilAssociate C|CISO

Domain 1Objective 4

Risk Management ACCISO Practice Questions (Page 9)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 41–45

41expert · hard
A company has implemented a risk treatment plan that includes a new firewall. The risk manager needs to ensure that the firewall is effective and that the risk remains within appetite. Which combination of activities provides the most comprehensive monitoring and review?
Select an answer first
42foundation · easy
An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk response strategy is this?
Select an answer first
43application · medium
A company has implemented a new security control to mitigate a high-risk vulnerability. The risk manager needs to ensure the control remains effective over time. Which action best supports ongoing risk monitoring and review?
Select an answer first
44foundation · easy
Which technique is commonly used to identify risks by brainstorming potential threats and vulnerabilities with a group of stakeholders?
Select an answer first
45application · medium
A healthcare organization is expanding its use of cloud-based patient portals. The security team is conducting a risk identification exercise. Which combination of techniques would most effectively identify risks specific to this new service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Risk Management ACCISO Practice Questions (Page 9)

Questions 41–45

A company has implemented a risk treatment plan that includes a new firewall. The risk manager needs to ensure that the firewall is effective and that the risk remains within appetite. Which combination of activities provides the most comprehensive monitoring and review?

An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk response strategy is this?

A company has implemented a new security control to mitigate a high-risk vulnerability. The risk manager needs to ensure the control remains effective over time. Which action best supports ongoing risk monitoring and review?

Which technique is commonly used to identify risks by brainstorming potential threats and vulnerabilities with a group of stakeholders?

A healthcare organization is expanding its use of cloud-based patient portals. The security team is conducting a risk identification exercise. Which combination of techniques would most effectively identify risks specific to this new service?

Keep studying — Governance, Risk, and Compliance