3.1 Develop and Manage a Risk Management Program ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes a primary objective of an organizational risk management program?

   • ATransferring all risks to insurance providers regardless of cost
   • BDocumenting risks without taking action to reduce them
   • CEliminating all identified risks to achieve a zero-risk environment
   • DProtecting assets while supporting business objectives and compliance requirements
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When recommending a risk treatment option, what should be included in the recommendation?

   • AThe exact cost of the treatment without any analysis
   • BThe rationale and analysis supporting the recommended option
   • CThe names of employees responsible for the risk
   • DA guarantee that the risk will be eliminated
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a risk treatment option?

   • AElimination
   • BDeferral
   • CIgnoring
   • DAvoidance
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A risk management program is most likely to be considered successful when it:

   • AEnsures that risks are managed in alignment with business objectives and compliance obligations
   • BTransfers all risks to third parties such as insurers
   • CFocuses exclusively on financial risks to maximize profitability
   • DReduces all risks to zero through the implementation of controls
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services firm is establishing its risk management program. The board has expressed a low tolerance for risks that could affect customer data confidentiality, but a higher tolerance for risks that could affect internal operational efficiency. The CISO needs to translate these preferences into actionable guidance for risk owners. What should the CISO do first?

   • AImplement a risk register and ask each risk owner to independently decide what risks they are willing to accept.
   • BAdopt a single organization-wide risk appetite statement that applies uniformly to all business units and risk categories.
   • CBegin with a quantitative risk analysis of all identified risks before engaging stakeholders.
   • DDefine quantitative risk appetite statements for each major risk category, such as a maximum acceptable data breach exposure and a maximum acceptable downtime for internal systems.
   Reveal Solution Discussion Select an answer first