CASP+ Risk Management and Compliance

Question 1

An organization must choose between accepting, transferring, mitigating, or avoiding a risk.
Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?

Accepted Answer

Accept the risk and document the decision

Answer

Mitigate by implementing compensating controls

Answer

Transfer via cyber liability insurance

Answer

Avoid the risk by discontinuing the activity

Question 2

Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

Annualized Rate of Occurrence (ARO)

Answer

Control gap score

Answer

Residual risk percentage

Question 3

A CASP+ professional conducts a BIA. Which output is MOST critical for defining recovery objectives?

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process

Answer

A list of all IT assets

Answer

A full network topology diagram

Answer

The organization's annual IT budget

Question 4

Which compliance framework is MOST applicable to a US healthcare organization processing electronic protected health information (ePHI)?

Accepted Answer

HIPAA Security Rule

Answer

PCI DSS

Answer

SOC 2 Type II

Answer

GDPR

Question 5

An organization wants to assess the maturity of its information security program. Which framework provides a structured maturity model for this purpose?

Accepted Answer

CMMC (Cybersecurity Maturity Model Certification)

Answer

CVE/NVD database

Answer

OWASP Top 10

Answer

MITRE ATT&CK framework

Question 6

Which document formally authorizes an information system to operate and accepts residual risk on behalf of the organization?

Accepted Answer

Authority to Operate (ATO)

Answer

System Security Plan (SSP)

Answer

Plan of Action and Milestones (POA&M)

Answer

Risk Assessment Report (RAR)