A government contractor must demonstrate compliance with federal requirements for managing information security risk. The security manager needs a structured process that includes system categorization, control selection, and continuous monitoring. Which framework should the organization adopt?

NIST Risk Management Framework (RMF)

A large enterprise is selecting a risk management framework. The organization needs to quantify risk in financial terms to justify security investments to the CFO, but it also needs a framework that provides a structured process for control selection and continuous monitoring. The security team is considering FAIR and NIST RMF. What is the best approach?

Use only FAIR because it provides quantitative results

Use only NIST RMF because it is more comprehensive

Use FAIR for quantitative analysis and NIST RMF for the overall risk management process

Use COBIT instead of both frameworks

Systems Security Certified Practitioner

Domain 3Objective 1

3.1 - Understand Risk Management SSCP Practice Questions (Page 2)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

15%of the exam

Questions 6–10

6foundation · easy
Which activity involves systematically identifying potential threats, vulnerabilities, and attack vectors that could affect a system or application?
Select an answer first
7foundation · easy
Which risk management framework is published by the National Institute of Standards and Technology (NIST) and provides a structured process for integrating security and risk management into the system development lifecycle?
Select an answer first
8application · medium
A multinational corporation needs a risk management framework that can be certified by an external auditor and is recognized internationally. The organization wants a framework that focuses specifically on information security risk management. Which framework should be selected?
Select an answer first
9application · medium
A government contractor must demonstrate compliance with federal requirements for managing information security risk. The security manager needs a structured process that includes system categorization, control selection, and continuous monitoring. Which framework should the organization adopt?
Select an answer first
10expert · hard
A large enterprise is selecting a risk management framework. The organization needs to quantify risk in financial terms to justify security investments to the CFO, but it also needs a framework that provides a structured process for control selection and continuous monitoring. The security team is considering FAIR and NIST RMF. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.1 - Understand Risk Management SSCP Practice Questions (Page 2)

Questions 6–10

Which activity involves systematically identifying potential threats, vulnerabilities, and attack vectors that could affect a system or application?

Which risk management framework is published by the National Institute of Standards and Technology (NIST) and provides a structured process for integrating security and risk management into the system development lifecycle?

A multinational corporation needs a risk management framework that can be certified by an external auditor and is recognized internationally. The organization wants a framework that focuses specifically on information security risk management. Which framework should be selected?

A government contractor must demonstrate compliance with federal requirements for managing information security risk. The security manager needs a structured process that includes system categorization, control selection, and continuous monitoring. Which framework should the organization adopt?

Keep studying — Risk Identification, Monitoring and Analysis