Security and Risk Management GISP Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company's board of directors wants to ensure that security investments are aligned with business objectives and regulatory requirements. Which governance mechanism would be most effective?

   • AAdopt a security framework such as ISO/IEC 27001.
   • BEstablish a security steering committee with representatives from business units and IT.
   • CDelegate all security decisions to the CISO.
   • DConduct an annual security audit.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which role is typically responsible for the day-to-day implementation and enforcement of an organization's security policies?

   • ABoard of directors
   • BSecurity administrator
   • CData owner
   • DChief Information Security Officer (CISO)
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A security team is developing metrics to report to the board. The board wants to understand the organization's overall security posture and the effectiveness of the security program. Which combination of metrics would provide the most balanced view?

   • ANumber of security awareness training completions and phishing simulation click rates.
   • BPercentage of systems patched within 30 days and number of critical vulnerabilities open.
   • CA balanced scorecard including incident metrics, vulnerability metrics, and control effectiveness ratings.
   • DNumber of security incidents and average time to resolve them.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk response strategy is this?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk acceptance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A security analyst is performing a risk assessment for a new customer portal. The analyst identifies that the portal is exposed to the internet and could be targeted by brute-force attacks. After evaluating the likelihood and impact, the analyst determines the risk is high. Which step should the analyst take next in the risk management process?

   • ARe-evaluate the risk using a different methodology to confirm the result.
   • BImmediately notify the board of directors about the high risk.
   • CDocument the risk in the risk register and propose a risk response strategy.
   • DImplement a rate-limiting control on the login endpoint.
   Reveal Solution Discussion Select an answer first