Risk Management CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary benefit of applying a recognized risk management framework like ISO 31000?

   • AIt automatically selects the best risk response for each risk
   • BIt guarantees that all risks will be eliminated
   • CIt eliminates the need for risk communication with stakeholders
   • DIt provides a structured and consistent approach to managing risk across the organization
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A CISO implemented a new security control and wants to monitor its effectiveness. The control is expected to reduce the likelihood of a specific threat by 50%. After six months, the CISO observes that the number of incidents has not decreased, but the number of attempted attacks has increased by 30%. What is the most likely explanation?

   • AThe control is not being used by employees, so it has no effect.
   • BThe control is ineffective because the incident count did not decrease.
   • CThe control is working as intended, but the increase in attack attempts masks the reduction in success rate.
   • DThe control has increased the attack surface, attracting more attackers.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government contractor must implement a risk management framework that aligns with federal requirements for information systems. The contractor also wants to integrate security controls into its system development lifecycle. Which framework is most appropriate?

   • ACOBIT 2019, which focuses on IT governance and management objectives.
   • BITIL 4, which focuses on IT service management practices.
   • CISO 31000, which is a general enterprise risk management standard.
   • DNIST SP 800-37, which provides a structured risk management framework for federal information systems and organizations.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services firm has a robust risk management framework, but employees frequently bypass security controls to meet sales targets. The CISO wants to promote a risk-aware culture. Which initiative is most likely to change employee behavior?

   • AIncrease the frequency of security awareness training from annually to quarterly.
   • BConduct a one-time risk culture survey to measure employee attitudes toward security.
   • CIntegrate risk-aware behavior into performance reviews and recognize employees who follow risk procedures.
   • DPublish a new policy stating that security controls must not be bypassed under any circumstances.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An internal audit finding reveals that a critical application has not been patched for known vulnerabilities, violating the organization's patch management policy. The CISO must integrate risk management with audit and compliance. What is the most appropriate first step?

   • AAssess the risk associated with the unpatched vulnerabilities and determine the appropriate response based on likelihood and impact.
   • BImmediately apply all available patches to the application without further analysis.
   • CEscalate the finding to the board and request additional budget for a new patch management tool.
   • DUpdate the audit report to state that the finding is low risk and requires no action.
   Reveal Solution Discussion Select an answer first