Risk Management CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A technology company has implemented a risk treatment plan that includes quarterly vulnerability scans and annual penetration tests. After two years, the CISO notices that the number of high-severity vulnerabilities found in scans has not decreased, despite the scans being performed regularly. The CISO suspects that the risk treatment is not effective. Which action should the CISO take to evaluate the effectiveness of the risk treatment?

   • AReplace the vulnerability scanner with a different vendor's product.
   • BIncrease the frequency of vulnerability scans to monthly.
   • CReview the remediation process and track the time-to-remediate for high-severity vulnerabilities.
   • DStop the scans because they are not reducing the number of vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A small e-commerce company has identified that its website is vulnerable to a distributed denial-of-service (DDoS) attack. The company's risk appetite is low for availability, but the cost of implementing a full DDoS mitigation service is high. The CISO is considering options. Which risk response is most aligned with the company's risk appetite and budget?

   • AAvoid the risk by taking the website offline.
   • BAccept the risk because the cost of mitigation is too high.
   • CPurchase a basic DDoS protection service from the hosting provider as a cost-effective mitigation.
   • DTransfer the risk by purchasing cyber insurance that covers DDoS-related losses.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A manufacturing company is expanding its use of industrial control systems (ICS) by connecting them to the corporate network for remote monitoring. The CISO is leading a risk identification effort. Which approach would best ensure that risks are identified comprehensively?

   • AReview only the ICS vendor's security documentation and known vulnerabilities.
   • BInterview the ICS engineers and review network diagrams to identify assets, threats, and vulnerabilities.
   • CFocus on the most likely threat, which is malware, and ignore other threat sources.
   • DUse a generic risk checklist from a cybersecurity standard without customization.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A CISO needs to communicate a newly identified critical risk to the CEO. The CEO is not familiar with technical security terminology. What is the most effective way to communicate this risk?

   • AProvide the full technical details of the vulnerability, including CVE identifiers and exploit code.
   • BSend a copy of the raw risk assessment worksheet and ask the CEO to review it.
   • CWait until the next quarterly board meeting to report the risk.
   • DDescribe the risk in terms of potential business impact, such as revenue loss or regulatory fines, and propose next steps.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A large organization has a risk management framework, but employees in different departments do not consistently follow it. The CISO wants to strengthen the risk governance structure. Which action would be most effective?

   • AAppoint a single risk owner for the entire organization.
   • BSend a company-wide email reminding employees of the risk management framework.
   • CCreate a risk management policy that mandates compliance and define consequences for non-compliance.
   • DOutsource risk management to an external consultant.
   Reveal Solution Discussion Select an answer first