Risk Management CCT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A risk analyst is comparing two risks. Risk X has a high likelihood and low impact. Risk Y has a low likelihood and high impact. The organization has a low risk appetite and wants to prioritize risks that could cause catastrophic damage. Which risk should be prioritized?

   • ARisk Y, because the potential impact is high, which aligns with the organization's low risk appetite.
   • BBoth risks equally, because they have the same risk score.
   • CRisk X, because the high likelihood means it will likely occur.
   • DNeither risk, because both are acceptable.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A risk manager is preparing a risk report for the board of directors. The report should highlight the most critical risks and the status of mitigation efforts. Which of the following is the most effective way to present this information?

   • AA financial statement of the risk management department's budget.
   • BA list of all risks sorted alphabetically.
   • CA detailed technical report listing every vulnerability and exploit.
   • DA heat map showing likelihood and impact, with a summary of mitigation status for each risk.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which risk management framework is commonly used by U.S. federal agencies to manage information security risk?

   • AITIL
   • BCOBIT
   • CISO 31000
   • DNIST Risk Management Framework (RMF)
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has identified a risk of a data breach due to a third-party vendor's insecure data handling practices. The vendor is critical to operations and cannot be easily replaced. The company is considering the following responses: (1) require the vendor to implement additional security controls, (2) purchase cyber insurance to cover potential losses, (3) terminate the contract and find a new vendor, (4) accept the risk because the vendor is essential. Which combination of responses represents the most appropriate risk treatment strategy?

   • AAccept the risk because the vendor is essential.
   • BPurchase cyber insurance only, because it transfers the financial risk.
   • CRequire the vendor to implement additional security controls and purchase cyber insurance.
   • DTerminate the contract and find a new vendor.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key characteristic of qualitative risk assessment?

   • AIt relies on subjective ratings such as high, medium, or low
   • BIt produces a single numeric risk score
   • CIt requires historical data to predict future losses
   • DIt uses numerical values to calculate risk in monetary terms
   Reveal Solution Discussion Select an answer first