Risk Management CCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A financial institution has implemented a risk treatment plan that includes annual penetration tests and continuous security monitoring. After a major security incident, the CISO wants to review the effectiveness of the risk treatment. Which review activity would provide the most useful information?

   • AReview the penetration test reports from the past year to see if the tested vulnerabilities were exploited.
   • BConduct a post-incident review to identify which controls failed and why.
   • CCompare the number of security incidents before and after the treatment plan was implemented.
   • DAsk the security team to confirm that the monitoring tools were working correctly.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A healthcare organization processes patient data and is required by regulation to encrypt data at rest. The current on-premises storage system does not support encryption, and replacing it would cost $2 million. The organization's risk appetite allows accepting low-likelihood, low-impact risks, but the regulatory requirement is mandatory. Which risk response is most appropriate for this risk?

   • AAccept the risk because the likelihood of a data breach is low and the organization's risk appetite permits acceptance.
   • BAvoid the risk by discontinuing the processing of all patient data until the storage system is replaced.
   • CMitigate by implementing a compensating control, such as a database-level encryption layer, to meet the regulatory intent.
   • DTransfer the risk by purchasing a cyber insurance policy that covers regulatory fines for data breaches.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A global logistics company is assessing the risk of a prolonged outage of its package tracking system. The system is critical for customer satisfaction and regulatory compliance. The CISO's team has two risk analysis options: a qualitative analysis that rates likelihood as 'high' and impact as 'catastrophic', and a quantitative analysis that estimates a 15% annual probability and $8 million annualized loss. The company's risk tolerance is defined as a maximum acceptable annual loss of $5 million. The CISO must decide which analysis to use for the final risk report to the board. Which decision is most appropriate?

   • AUse the quantitative analysis because it provides a clear comparison to the risk tolerance threshold.
   • BUse the qualitative analysis because it is easier for the board to understand.
   • CUse both analyses and present the qualitative rating as the primary result.
   • DUse neither analysis and rely on the board's judgment based on past incidents.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   How does integrating risk management with compliance requirements benefit an organization?

   • AIt eliminates the need for separate compliance audits
   • BIt ensures that compliance obligations are considered when identifying and assessing risks
   • CIt transfers all compliance risks to the legal department
   • DIt guarantees that the organization will pass all regulatory audits
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which practice best promotes a risk-aware culture within an organization?

   • ALimiting risk information to only the executive team
   • BPunishing employees who make mistakes that lead to risk events
   • CFocusing solely on compliance with external regulations
   • DEncouraging employees to report risks and near-misses without fear of blame
   Reveal Solution Discussion Select an answer first