A technology company is prioritizing risks for its annual risk treatment plan. The company has a risk tolerance that allows for accepting risks with a low likelihood and low impact, but requires mitigation for any risk with a high impact. The following risks have been identified: (1) a data breach from a phishing attack (likelihood: high, impact: high), (2) a minor service outage (likelihood: medium, impact: low), and (3) a regulatory fine due to non-compliance (likelihood: low, impact: high). Which risk should be treated first?

All three risks equally, because they all require attention.

The regulatory fine, because it has a high impact.

The data breach, because it has the highest risk score.

The service outage, because it is the easiest to fix.

An e-commerce company is assessing the risk of a distributed denial-of-service (DDoS) attack on its website. The company estimates that a successful attack could cause $500,000 in lost sales and damage to its reputation. The likelihood of an attack is assessed as high, given the company's prominence. What is the risk score for this risk?

Cannot be determined without a quantitative risk analysis.

Low, because the impact is only $500,000.

High, because both the likelihood and impact are high.

Medium, because the likelihood is high but the impact is limited to financial loss.

Which activity is part of risk identification?

Calculating the annualized loss expectancy

Listing potential threats and vulnerabilities

A hospital is implementing a risk management process. After identifying and assessing risks, the risk management team decides to implement a new access control system to reduce the likelihood of unauthorized access to patient records. Which step of the risk management process is the team performing?

Risk treatment, because they are implementing a control to reduce the risk.

Risk assessment, because they are assessing the impact of the access control system.

Risk identification, because they are identifying a new risk.

Risk communication, because they are communicating the risk to stakeholders.

Which sequence best represents the overall risk management process?

Assess risks, identify risks, accept risks, document risks

Identify risks, assess risks, treat risks, monitor and review

Monitor risks, treat risks, assess risks, identify risks

Treat risks, monitor risks, identify risks, assess risks

Certified in Cybersecurity

Domain 1Objective 2

1.2 - Understand the Risk Management Process CC Practice Questions (Page 3)

Part of the Security Principles domain, which accounts for 26% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–21 in this domain), expect 3–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

26%of the exam

Questions 11–15

11expert · hard
A technology company is prioritizing risks for its annual risk treatment plan. The company has a risk tolerance that allows for accepting risks with a low likelihood and low impact, but requires mitigation for any risk with a high impact. The following risks have been identified: (1) a data breach from a phishing attack (likelihood: high, impact: high), (2) a minor service outage (likelihood: medium, impact: low), and (3) a regulatory fine due to non-compliance (likelihood: low, impact: high). Which risk should be treated first?
Select an answer first
12application · medium
An e-commerce company is assessing the risk of a distributed denial-of-service (DDoS) attack on its website. The company estimates that a successful attack could cause $500,000 in lost sales and damage to its reputation. The likelihood of an attack is assessed as high, given the company's prominence. What is the risk score for this risk?
Select an answer first
13foundation · easy
Which activity is part of risk identification?
Select an answer first
14application · medium
A hospital is implementing a risk management process. After identifying and assessing risks, the risk management team decides to implement a new access control system to reduce the likelihood of unauthorized access to patient records. Which step of the risk management process is the team performing?
Select an answer first
15foundation · easy
Which sequence best represents the overall risk management process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.

1.2 - Understand the Risk Management Process CC Practice Questions (Page 3)

Questions 11–15

Which activity is part of risk identification?

Which sequence best represents the overall risk management process?

Keep studying — Security Principles