A government agency has completed an inherent risk analysis for its new public-facing benefits portal. The analysis identified several risks, including a high-risk vulnerability in the web application framework. The agency's risk tolerance is defined as 'no high or critical risks are acceptable.' Which action is most appropriate for the risk evaluation step?

Prioritize the high-risk vulnerability for immediate treatment.

Accept the high-risk vulnerability because the portal is new and will be monitored.

Document the risk and defer treatment until the next budget cycle.

Re-assess the risk using a different methodology to lower the rating.

Which activity in the risk management process involves identifying entities or circumstances that could intentionally or accidentally cause harm to the system?

Identifying threats and threat sources

A logistics company is assessing the risk of its GPS tracking system. The system relies on a legacy operating system that is no longer supported by the vendor. Which vulnerability is most directly associated with this finding?

Weak encryption of GPS data in transit.

Lack of redundancy in the GPS satellite network.

Insufficient access controls for the GPS tracking system.

Unpatched software vulnerabilities that will not receive security updates.

A healthcare organization is assessing the risk of its patient portal, which allows patients to access their medical records. The portal uses a single sign-on (SSO) solution that is integrated with the organization's Active Directory. During vulnerability identification, the team discovers that the SSO solution has a known vulnerability that could allow an attacker to bypass authentication. The organization's risk tolerance is 'no high or critical risks.' Which action is most appropriate?

Accept the vulnerability because the SSO solution is only used for the patient portal.

Document the vulnerability and defer treatment until the next scheduled maintenance window.

Disable the SSO solution and require patients to use separate credentials.

Treat the vulnerability immediately by applying the vendor's patch.

In the risk management process, which step assesses the potential adverse consequences to system operations, assets, and stakeholders if a risk is realized?

Performing inherent risk analysis

Information Systems Security Engineering Professional

Domain 2Objective 3

Manage Risk to Operations ISSEP Practice Questions (Page 1)

Part of the Risk Management domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

20%of the exam

Questions 1–5

1application · medium
A government agency has completed an inherent risk analysis for its new public-facing benefits portal. The analysis identified several risks, including a high-risk vulnerability in the web application framework. The agency's risk tolerance is defined as 'no high or critical risks are acceptable.' Which action is most appropriate for the risk evaluation step?
Select an answer first
2foundation · easy
Which activity in the risk management process involves identifying entities or circumstances that could intentionally or accidentally cause harm to the system?
Select an answer first
3application · medium
A logistics company is assessing the risk of its GPS tracking system. The system relies on a legacy operating system that is no longer supported by the vendor. Which vulnerability is most directly associated with this finding?
Select an answer first
4expert · hard
A healthcare organization is assessing the risk of its patient portal, which allows patients to access their medical records. The portal uses a single sign-on (SSO) solution that is integrated with the organization's Active Directory. During vulnerability identification, the team discovers that the SSO solution has a known vulnerability that could allow an attacker to bypass authentication. The organization's risk tolerance is 'no high or critical risks.' Which action is most appropriate?
Select an answer first
5foundation · easy
In the risk management process, which step assesses the potential adverse consequences to system operations, assets, and stakeholders if a risk is realized?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Manage Risk to Operations ISSEP Practice Questions (Page 1)

Questions 1–5

Which activity in the risk management process involves identifying entities or circumstances that could intentionally or accidentally cause harm to the system?

A logistics company is assessing the risk of its GPS tracking system. The system relies on a legacy operating system that is no longer supported by the vendor. Which vulnerability is most directly associated with this finding?

In the risk management process, which step assesses the potential adverse consequences to system operations, assets, and stakeholders if a risk is realized?

Keep studying — Risk Management