Risk Management CCISO Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A CISO must report to the board on a risk that has a low likelihood but a very high potential impact. The board is risk-averse and tends to overreact to high-impact risks. The CISO wants to provide a balanced view. What is the best approach?

   • APresent the risk with both likelihood and impact clearly quantified, and compare it to other risks in the portfolio.
   • BDownplay the risk by focusing only on the low likelihood.
   • CEmphasize the high impact to ensure the board takes the risk seriously.
   • DPresent the risk without quantitative data to avoid confusing the board.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial services company is required by regulation to perform an annual risk assessment and report the results to the regulator. The internal audit team also conducts its own risk-based audit plan. The CISO wants to avoid duplication and ensure that both activities are aligned. Which approach should the CISO take?

   • AShare the risk assessment results with internal audit and use them to inform the audit plan.
   • BAsk internal audit to perform the regulatory risk assessment on behalf of the CISO.
   • CKeep the risk assessment and audit plan separate to maintain independence.
   • DUse the same risk assessment for both regulatory reporting and the audit plan without any changes.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A multinational retailer is evaluating the risk of a ransomware attack on its point-of-sale (POS) systems. The CISO's team has estimated that a successful attack would cause $5 million in direct losses and $15 million in reputational damage. Historical data and threat intelligence suggest a 10% probability of occurrence in the next 12 months. The company's risk appetite statement says it will accept risks with an annualized loss expectancy (ALE) below $1 million. Which risk response should the CISO recommend?

   • AMitigate the risk by implementing endpoint detection and response (EDR) and offline backups.
   • BAccept the risk because the probability is low.
   • CTransfer the risk by purchasing a cyber insurance policy that covers the full $20 million loss.
   • DAvoid the risk by discontinuing the use of POS systems.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A bank's CISO has completed a risk assessment that identifies a high-severity risk in the mobile banking application. The board of directors is not technically sophisticated and needs to understand the risk in business terms. Which approach should the CISO use to communicate this risk?

   • APresent a summary that explains the potential financial loss, regulatory impact, and recommended actions in plain language.
   • BDiscuss the risk only with the IT team and exclude the board until the risk is resolved.
   • CProvide the board with the full technical risk assessment report, including CVSS scores and exploit details.
   • DSend the board a link to the vulnerability database entry for the identified vulnerability.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of a risk report commonly produced for senior management?

   • AA list of all risk treatment actions with implementation dates
   • BA detailed vulnerability scan report listing every technical finding
   • CA risk register containing all identified risks with detailed technical descriptions
   • DAn executive dashboard showing key risk indicators and risk levels by category
   Reveal Solution Discussion Select an answer first