CCISO Governance, Risk & Compliance 5

Question 1

Which of the following BEST describes the concept of 'control risk' in an audit context?

Accepted Answer

The risk that a misstatement will not be prevented or detected by internal controls

Answer

Control risk is the probability that an organization's internal controls will fail to prevent or detect a material misstatement or security issue.

Question 2

What is the MAIN purpose of a Business Impact Analysis (BIA) in governance and continuity planning?

Accepted Answer

To determine recovery time objectives and the criticality of business functions

Answer

A BIA identifies critical business functions, assesses the impact of their disruption, and establishes RTOs and RPOs to guide continuity planning.

Question 3

Which governance document formally authorizes a specific system to operate within an organization, acknowledging its risks?

Accepted Answer

Authority to Operate (ATO)

Answer

An Authority to Operate (ATO) is a formal decision by an authorizing official that accepts the residual risk of operating a system.

Question 4

A CISO discovers that a cloud provider is subcontracting data processing to a fourth-party vendor without notification. This PRIMARILY violates which principle?

Accepted Answer

Due diligence in vendor chain management

Answer

Undisclosed subcontracting represents a failure of supply chain due diligence, which requires visibility and control over all parties handling organizational data.

Question 5

Which of the following is an example of a leading indicator for measuring security program effectiveness?

Accepted Answer

Percentage of employees who completed security awareness training this quarter

Answer

Leading indicators measure proactive activities (like training completion) that predict future security posture, as opposed to lagging indicators that measure past failures.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Governance, Risk & Compliance 5