Risk Management CCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement correctly distinguishes qualitative risk analysis from quantitative risk analysis?

   • AQualitative analysis uses numerical values, while quantitative analysis uses descriptive scales
   • BQualitative analysis uses descriptive scales, while quantitative analysis uses numerical values
   • CQualitative analysis is always more accurate than quantitative analysis
   • DQuantitative analysis is only used for financial risks, while qualitative is used for all other risks
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's risk committee meets quarterly, but risk decisions are often made informally by department heads without consulting the committee. The CISO wants to strengthen risk governance. Which action would most effectively improve the governance structure?

   • AEstablish a formal risk escalation process that requires department heads to consult the risk committee for decisions above a defined threshold.
   • BReduce the frequency of risk committee meetings to annually to save time.
   • CAllow department heads to continue making informal decisions but document them after the fact.
   • DSend a memo reminding department heads to consider risk in their decisions.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is continuous risk monitoring important in the risk management process?

   • AIt eliminates the need for periodic risk assessments
   • BIt guarantees that all risks will be eliminated over time
   • CIt ensures that risks are permanently removed from the risk register
   • DIt allows the organization to detect changes in the risk environment and verify that risk treatments remain effective
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization has implemented a new security control to reduce the risk of ransomware. Six months later, the CISO wants to report on the control's effectiveness to the executive team. Which metric would be most meaningful for this report?

   • AThe percentage reduction in ransomware-related incidents compared to the previous six months.
   • BThe number of security awareness training sessions completed by employees.
   • CThe total cost of the security control implementation.
   • DThe number of new vulnerabilities discovered in the organization's systems.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A mid-sized financial services firm is adopting ISO 31000 as its enterprise risk management framework. The board has asked the CISO to ensure that risk management is embedded in the organization's culture and that risk information flows to the right decision-makers. Which implementation step should the CISO prioritize first?

   • ADefine risk management roles, responsibilities, and reporting lines across the organization.
   • BDevelop a risk register that lists all identified risks and their current controls.
   • CConduct a detailed quantitative risk analysis on all identified risks.
   • DImplement a risk management software platform to automate risk assessments.
   Reveal Solution Discussion Select an answer first