Apply Security Risk Management Principles ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A large financial institution is adopting an enterprise risk management (ERM) framework aligned with ISO 31000. The CISO wants to ensure that security risk decisions are consistently prioritized alongside operational, credit, and market risks across business units. Which approach best achieves this alignment?

   • AHave the ERM team independently assess all security risks without input from security engineers to ensure objectivity.
   • BDirect each business unit to maintain its own risk register and report security risks only when a breach occurs.
   • CEstablish a unified risk taxonomy and scoring scale used by both security and enterprise risk teams, with security risks feeding into the same portfolio-level reporting cadence.
   • DRequire the security team to adopt the same risk scoring matrix as the ERM team but keep reporting separate to avoid diluting technical detail.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A security manager wants to ensure that security risk management decisions are aligned with the organization's broader business objectives. Which approach best supports this alignment?

   • AFocusing exclusively on technical vulnerabilities without considering business impact
   • BIntegrating security risk assessments into the enterprise risk management framework and reporting results in business terms
   • CTreating security risk as a separate, isolated process that is reported only to the IT department
   • DDeferring all security risk decisions to external auditors
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A software company is developing a new cloud-based application. The development team wants to use a third-party library that has a known critical vulnerability, but it significantly speeds up development. The security team has identified the risk. The project manager is under pressure to meet a deadline. What is the most balanced approach to managing this risk?

   • AConduct a detailed risk assessment to understand the exploitability and impact in the specific context, and if acceptable, implement compensating controls and plan to replace the library in a future sprint.
   • BUse the library but do not tell the security team about the vulnerability to avoid conflict.
   • CImmediately reject the library and require the team to develop the functionality from scratch.
   • DAccept the risk without further analysis because the deadline is more important than the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A manufacturing company is implementing a new industrial control system (ICS) for its production line. The ERM framework focuses on operational continuity and safety. The security team identifies a risk that a cyberattack could disrupt production. What is the most effective way to communicate this risk to the ERM committee?

   • AAsk the ERM committee to trust the security team's judgment without providing further details.
   • BRecommend that the ERM committee accept the risk because ICS systems are rarely targeted by attackers.
   • CPresent the risk in technical terms, such as the specific malware families and network protocols involved.
   • DTranslate the cyber risk into potential production downtime, lost revenue, and safety incidents, using the same metrics as the ERM framework.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university is implementing a new student information system. The ERM framework categorizes risks into strategic, operational, financial, and compliance. The security team identifies a risk that a data breach could expose student records, leading to regulatory fines. How should this risk be categorized in the ERM framework?

   • AFinancial risk, because the fines represent a financial loss.
   • BOperational risk, because the breach is caused by a failure in IT operations.
   • CStrategic risk, because a data breach could damage the university's reputation.
   • DCompliance risk, because it involves potential violation of data protection regulations.
   Reveal Solution Discussion Select an answer first