Which activity is a key part of the risk monitoring and review process?

Conducting a one-time risk assessment at the start of a project

Defining the organization's risk appetite

Selecting risk response strategies for new risks

Reviewing key risk indicators (KRIs) to detect changes in risk levels

A manufacturing company implemented a new access-control system six months ago to reduce the risk of insider data theft. The CISO wants to verify that the control is actually reducing risk as intended. Which action provides the most direct evidence of the control's effectiveness?

Review access logs and compare the number of unauthorized access attempts before and after implementation.

Confirm that the system's vendor has released no critical security patches in the last six months.

Verify that the access-control system is listed in the organization's risk register.

Conduct a new risk assessment to identify any emerging risks that were not present six months ago.

An organization's compliance team identifies a new regulatory requirement that affects how customer data must be stored. The CISO must integrate this requirement into the risk management process. What is the first step?

Update the compliance policy to state that the organization will comply with all regulations.

Immediately implement a technical solution to meet the requirement without further analysis.

Request an extension from the regulator to delay compliance.

Identify the risk of non-compliance and assess its likelihood and impact on the organization.

What is the primary purpose of establishing a risk governance structure?

To eliminate the need for risk assessments by relying on senior management judgment

To create a risk register for compliance purposes only

To ensure that all risks are transferred to external parties

To assign clear roles, responsibilities, and accountability for risk management across the organization

What is the primary goal of risk communication and reporting?

To ensure that all employees are aware of every risk in the organization

To replace the need for formal risk assessments

To provide stakeholders with the information they need to make informed risk decisions

To document all risks in a risk register for audit purposes

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 4

Risk Management CCISO Practice Questions (Page 11)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 51–55

51foundation · easy
Which activity is a key part of the risk monitoring and review process?
Select an answer first
52application · medium
A manufacturing company implemented a new access-control system six months ago to reduce the risk of insider data theft. The CISO wants to verify that the control is actually reducing risk as intended. Which action provides the most direct evidence of the control's effectiveness?
Select an answer first
53application · medium
An organization's compliance team identifies a new regulatory requirement that affects how customer data must be stored. The CISO must integrate this requirement into the risk management process. What is the first step?
Select an answer first
54foundation · easy
What is the primary purpose of establishing a risk governance structure?
Select an answer first
55foundation · easy
What is the primary goal of risk communication and reporting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.