Risk Management CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company is subject to a new data protection regulation that requires annual risk assessments and reporting to the regulator. The CISO must integrate this requirement into the existing risk management process. Which action should the CISO take first?

   • ACreate a separate risk assessment process specifically for the regulation.
   • BHire an external consultant to perform the regulatory risk assessment.
   • CWait for the regulator to provide detailed guidance before taking any action.
   • DReview the regulation's requirements and map them to the existing risk management activities.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A multinational bank must choose between two risk assessment approaches: a quantitative analysis using historical loss data from its own operations, and a qualitative analysis using expert judgment. The bank operates in multiple jurisdictions with different regulatory expectations. The CISO notes that historical data is incomplete for newer business lines. Which approach should the CISO recommend?

   • AUse only qualitative analysis because it is faster and easier to communicate to the board.
   • BUse only quantitative analysis because it provides objective, numerical results that regulators expect.
   • CDefer the risk assessment until complete historical data is available for all business lines.
   • DUse a hybrid approach: quantitative analysis where reliable data exists, supplemented by qualitative analysis for newer business lines.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A retail company has experienced several minor security incidents that were not reported by employees because they feared blame. The CISO wants to promote a risk-aware culture where employees feel comfortable reporting issues. Which initiative would be most effective?

   • AOutsource incident reporting to an external hotline managed by a third party.
   • BEstablish a confidential, non-punitive incident reporting channel and recognize employees who report issues.
   • CIncrease the severity of penalties for employees who cause security incidents.
   • DRequire all employees to complete a one-time security awareness training module.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which term refers to the level of risk an organization is willing to accept in pursuit of its objectives?

   • ARisk appetite
   • BRisk capacity
   • CRisk register
   • DRisk exposure
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A regional bank is updating its operational risk register. The CISO wants to compare the relative severity of risks that have very different units—one is a potential fine from a regulator, another is customer churn, and a third is reputational damage. The bank has no reliable historical loss data for these events. Which approach should the CISO use to prioritize these risks?

   • APerform a quantitative analysis using Monte Carlo simulation to estimate annualized loss expectancy for each risk.
   • BApply a single-factor scoring model based only on the potential financial impact of each risk.
   • CRank risks by the ease of implementing controls, placing the easiest risks first in the register.
   • DConduct a qualitative risk assessment using likelihood and impact scales defined by the bank's risk appetite.
   Reveal Solution Discussion Select an answer first