A security analyst is using the OCTAVE method to assess risks in a large enterprise. The analyst has identified critical assets and their associated threats. What is the next step in the OCTAVE process?

Select and implement security controls

Monitor the effectiveness of controls

Evaluate risks and prioritize them

A government agency is required to follow NIST RMF for its information systems. The agency is also subject to FISMA compliance. During the 'Authorize' step of the RMF, what is the primary responsibility of the authorizing official?

Develop the system security plan

Accept the residual risk and authorize system operation

A financial services firm has a critical trading application with an RTO of 15 minutes and an RPO of 5 minutes. The application runs on-premises. The firm is considering two disaster recovery options: (1) a hot standby site with synchronous replication, and (2) a cloud-based disaster recovery service with asynchronous replication. The cloud service is significantly cheaper but has a recovery time of 30 minutes. The firm's risk appetite is low, and the board has mandated that no single point of failure should cause a regulatory breach. What is the most appropriate decision?

Choose the hot standby site because it meets both RTO and RPO

Choose the cloud service because it is cheaper and meets the RPO

Implement both solutions to ensure redundancy

Accept the risk and use the cloud service with a longer RTO

A regional bank is assessing the risk of a new mobile banking feature. The security team estimates that a successful account takeover could cause a financial loss of $2,000,000, and the likelihood of occurrence in the next year is 5%. The bank's risk appetite allows accepting risks with an annualized loss expectancy (ALE) below $50,000. What should the bank do with this risk?

Accept the risk because the ALE is below the threshold

Mitigate the risk by implementing multi-factor authentication and transaction monitoring

Transfer the risk by purchasing cybersecurity insurance

Avoid the risk by discontinuing the mobile banking feature

EC-CouncilCertified Ethical Hacker

Domain 1Objective 7

Information Assurance and Risk Management CEH Practice Questions (Page 1)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 1–5

1application · medium
A security analyst is using the OCTAVE method to assess risks in a large enterprise. The analyst has identified critical assets and their associated threats. What is the next step in the OCTAVE process?
Select an answer first
2expert · hard
A government agency is required to follow NIST RMF for its information systems. The agency is also subject to FISMA compliance. During the 'Authorize' step of the RMF, what is the primary responsibility of the authorizing official?
Select an answer first
3expert · hard
A financial services firm has a critical trading application with an RTO of 15 minutes and an RPO of 5 minutes. The application runs on-premises. The firm is considering two disaster recovery options: (1) a hot standby site with synchronous replication, and (2) a cloud-based disaster recovery service with asynchronous replication. The cloud service is significantly cheaper but has a recovery time of 30 minutes. The firm's risk appetite is low, and the board has mandated that no single point of failure should cause a regulatory breach. What is the most appropriate decision?
Select an answer first
4application · medium
A company is developing a new security policy for remote work. The policy must align with ISO 27001 and ensure that employees use VPN for all remote access. Which document should be created first to define the high-level security objectives and management commitment?
Select an answer first
5application · medium
A regional bank is assessing the risk of a new mobile banking feature. The security team estimates that a successful account takeover could cause a financial loss of $2,000,000, and the likelihood of occurrence in the next year is 5%. The bank's risk appetite allows accepting risks with an annualized loss expectancy (ALE) below $50,000. What should the bank do with this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Information Assurance and Risk Management CEH Practice Questions (Page 1)

Questions 1–5

A security analyst is using the OCTAVE method to assess risks in a large enterprise. The analyst has identified critical assets and their associated threats. What is the next step in the OCTAVE process?

A government agency is required to follow NIST RMF for its information systems. The agency is also subject to FISMA compliance. During the 'Authorize' step of the RMF, what is the primary responsibility of the authorizing official?

A company is developing a new security policy for remote work. The policy must align with ISO 27001 and ensure that employees use VPN for all remote access. Which document should be created first to define the high-level security objectives and management commitment?

Keep studying — Information Security and Ethical Hacking Overview