Risk Frameworks and Standards CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization using NIST RMF has categorized its information system and selected the appropriate security controls. What is the next step in the RMF process?

   • AAuthorize the system
   • BAssess the security controls
   • CImplement the security controls
   • DMonitor the security controls
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When selecting a risk framework, which factor is most important to consider to ensure the framework aligns with the organization's objectives?

   • AThe framework's popularity in the industry
   • BThe framework's alignment with the organization's industry, regulatory requirements, and risk appetite
   • CThe framework's complexity and number of steps
   • DThe framework's focus on financial risk only
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is required by its industry regulator to implement a risk management framework that includes internal control over financial reporting. The company also wants to improve its IT governance. Which combination of frameworks should the company adopt?

   • ACOSO ERM for internal control and COBIT for IT governance
   • BISO 31000 for internal control and NIST RMF for IT governance
   • CISO/IEC 27005 for internal control and COSO ERM for IT governance
   • DNIST RMF for internal control and ISO 31000 for IT governance
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large manufacturing company has separate risk functions: the enterprise risk team uses COSO ERM for strategic risks, and the IT security team uses NIST RMF for system-level security. The board is concerned about duplication of effort and inconsistent risk reporting. What is the most effective integration approach?

   • AKeep the frameworks separate and have the board review two independent risk reports.
   • BReplace COSO ERM with NIST RMF to eliminate the need for two frameworks.
   • CAdopt ISO 31000 as a third framework to harmonize the other two.
   • DMap NIST RMF control assessments to COSO ERM risk categories and use a common risk register with shared risk owners.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which risk management framework is known for its principles-based approach and provides generic guidelines that can be applied to any type of organization, regardless of size or sector?

   • AITIL
   • BCOSO ERM
   • CNIST RMF
   • DISO 31000
   Reveal Solution Discussion Select an answer first