Risk Management CCISO Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During the risk identification process, which activity is most directly associated with identifying potential risks to an organization's assets?

   • ASelecting risk response strategies for each identified risk
   • BCalculating the annualized loss expectancy (ALE) for each identified risk
   • CConducting a business impact analysis (BIA) to determine the financial impact of potential disruptions
   • DPerforming a vulnerability scan and threat assessment to identify weaknesses and potential threats
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes the relationship between risk management and the broader governance, risk, and compliance (GRC) framework?

   • ARisk management is primarily concerned with financial reporting and auditing activities
   • BRisk management provides a structured approach to identifying and addressing uncertainties, which supports governance and compliance objectives
   • CRisk management is the process of ensuring that all employees follow the organization's code of conduct
   • DRisk management is a separate discipline that operates independently of governance and compliance
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's risk assessment identifies two risks: Risk A has a 20% likelihood of causing a $5 million loss, and Risk B has a 5% likelihood of causing a $50 million loss. The company's risk appetite is defined as not exceeding $2 million in expected annual loss for any single risk. Which risk(s) exceed the company's risk appetite?

   • ANeither risk, because the company can accept some level of risk.
   • BBoth risks, because both have the potential to cause losses greater than $2 million.
   • CRisk A only, because its expected loss is $1 million, which is below the $2 million threshold.
   • DRisk B only, because its expected loss is $2.5 million, which exceeds the $2 million threshold.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A government agency is required to implement a risk management framework that aligns with federal guidelines. The agency currently uses ISO 31000 as its internal framework, but the federal regulator requires compliance with a specific risk management standard that is more prescriptive. The CISO must reconcile the two frameworks. Which approach is most appropriate?

   • ARun two separate risk management processes, one for each framework.
   • BAbandon ISO 31000 and adopt the regulator's standard exclusively.
   • CMap the ISO 31000 processes to the regulator's requirements and document how they align.
   • DUse ISO 31000 for internal purposes and ignore the regulator's standard until an audit occurs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a widely recognized international standard for risk management?

   • ACOBIT 5
   • BNIST SP 800-53
   • CISO 27001
   • DISO 31000
   Reveal Solution Discussion Select an answer first