Why is it important to document the risk posture, including findings, decisions, and rationale?

To automatically implement risk treatment controls

To eliminate the need for ongoing risk monitoring

To replace the need for risk evaluation

To support communication and accountability

In a risk management framework, which element is typically established during the 'establish risk context' activity?

List of identified vulnerabilities

A multinational corporation is establishing a risk management framework for its global supply chain management system. The system processes data across multiple countries with differing privacy laws. The risk team is defining the risk context. Which factor is most important to include in the context definition?

The inherent risk levels for each regional operation

The specific threat sources and vulnerabilities relevant to each region

The risk evaluation criteria, including legal and regulatory requirements from each jurisdiction

The list of security controls already implemented in each region

A government agency has implemented a risk treatment plan for its public-facing website. The plan includes a web application firewall (WAF) to mitigate the risk of SQL injection attacks. Six months later, a new SQL injection technique is discovered that bypasses the WAF. The agency must update its risk posture documentation. What is the most important information to include in the update?

The revised risk level, but not the reason for the change

The new technique, the fact that the WAF is bypassed, and the revised risk level

The new technique only, as the risk level remains the same

The fact that the WAF is bypassed, but not the new technique, as it is technical detail

Which activity involves identifying potential threat sources, such as natural disasters, malicious actors, and system failures, as well as weaknesses that could be exploited?

Identifying threats and vulnerabilities

Performing inherent risk analysis

Information Systems Security Engineering Professional

Domain 2Objective 2

Manage Risk to System ISSEP Practice Questions (Page 5)

Part of the Risk Management domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

7concepts

20%of the exam

Questions 21–25

21foundation · easy
Why is it important to document the risk posture, including findings, decisions, and rationale?
Select an answer first
22foundation · easy
In a risk management framework, which element is typically established during the 'establish risk context' activity?
Select an answer first
23application · medium
A multinational corporation is establishing a risk management framework for its global supply chain management system. The system processes data across multiple countries with differing privacy laws. The risk team is defining the risk context. Which factor is most important to include in the context definition?
Select an answer first
24expert · hard
A government agency has implemented a risk treatment plan for its public-facing website. The plan includes a web application firewall (WAF) to mitigate the risk of SQL injection attacks. Six months later, a new SQL injection technique is discovered that bypasses the WAF. The agency must update its risk posture documentation. What is the most important information to include in the update?
Select an answer first
25foundation · easy
Which activity involves identifying potential threat sources, such as natural disasters, malicious actors, and system failures, as well as weaknesses that could be exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Manage Risk to System ISSEP Practice Questions (Page 5)

Questions 21–25

Why is it important to document the risk posture, including findings, decisions, and rationale?

In a risk management framework, which element is typically established during the 'establish risk context' activity?

Which activity involves identifying potential threat sources, such as natural disasters, malicious actors, and system failures, as well as weaknesses that could be exploited?

Keep studying — Risk Management