What is the purpose of performing inherent risk analysis?

To assess risk without considering existing mitigations

To identify vulnerabilities in the system

To assess risk after all mitigations are applied

To determine the cost of risk treatment

A multinational corporation is establishing the risk context for a new customer relationship management (CRM) system that will store personal data of customers in the European Union and the United States. Which constraint is most important to include in the risk context?

The system should minimize the number of administrators.

The system must be accessible from any device.

The system should use a single database to simplify data management.

The system must comply with both GDPR and CCPA data protection regulations.

Which activity in the risk management process involves continuously checking for changes in residual, new, or modified risks and updating the risk assessment accordingly?

Monitoring risk posture changes

Performing inherent risk analysis

Which of the following is an example of a vulnerability?

A natural disaster such as a flood

A hacker attempting to gain unauthorized access

A global financial services firm is establishing the risk context for a new trading platform that will be deployed in multiple regions. The platform will handle sensitive financial data and must comply with varying regional regulations. The firm's risk tolerance is conservative, but the business requires rapid deployment to remain competitive. Which approach best balances these constraints when establishing the risk context?

Define a single global risk tolerance and apply it uniformly across all regions.

Use the most conservative risk criteria from any region and apply it globally.

Establish region-specific risk criteria that align with local regulations and business needs.

Defer risk context establishment until after the platform is deployed.

Information Systems Security Engineering Professional

Domain 2Objective 3

Manage Risk to Operations ISSEP Practice Questions (Page 6)

Part of the Risk Management domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

20%of the exam

Questions 26–30

26foundation · easy
What is the purpose of performing inherent risk analysis?
Select an answer first
27application · medium
A multinational corporation is establishing the risk context for a new customer relationship management (CRM) system that will store personal data of customers in the European Union and the United States. Which constraint is most important to include in the risk context?
Select an answer first
28foundation · easy
Which activity in the risk management process involves continuously checking for changes in residual, new, or modified risks and updating the risk assessment accordingly?
Select an answer first
29foundation · easy
Which of the following is an example of a vulnerability?
Select an answer first
30expert · hard
A global financial services firm is establishing the risk context for a new trading platform that will be deployed in multiple regions. The platform will handle sensitive financial data and must comply with varying regional regulations. The firm's risk tolerance is conservative, but the business requires rapid deployment to remain competitive. Which approach best balances these constraints when establishing the risk context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.