CCISO Information Security & Risk Management 2

Question 1

A CISO is implementing a risk-based security program. Which framework specifically integrates risk management into a continuous monitoring strategy for federal information systems?

Accepted Answer

NIST RMF

Answer

ISO 27001

Answer

COBIT 5

Answer

FAIR

Question 2

When conducting a risk assessment, the term 'threat agent' most accurately refers to:

Accepted Answer

An entity that initiates a threat event

Answer

A vulnerability exploited by attackers

Answer

The likelihood of a security incident occurring

Answer

The impact of an exploited vulnerability

Question 3

An organization's risk register shows a residual risk that exceeds the acceptable risk threshold. What is the MOST appropriate CISO action?

Accepted Answer

Escalate to executive leadership for a risk acceptance decision

Answer

Accept the risk and document the exception

Answer

Transfer the risk to a third party immediately

Answer

Implement additional controls to reduce the residual risk

Question 4

Which risk treatment option is applied when an organization decides to stop performing an activity that generates unacceptable risk?

Accepted Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk acceptance

Question 5

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Accepted Answer

Relies on subjective ratings such as high, medium, and low

Answer

Uses statistical models and financial values to express risk

Answer

Calculates Annual Loss Expectancy (ALE) for each risk

Answer

Requires certified actuaries to perform the assessment

Question 6

In the context of information security governance, which of the following BEST describes the relationship between policies, standards, and procedures?

Accepted Answer

Policies set direction; standards define requirements; procedures provide step-by-step instructions

Answer

Policies are technical; standards are managerial; procedures are strategic

Answer

Procedures override policies when conflicts arise in operations

Answer

Standards are optional guidance while policies are mandatory requirements

Question 7

An organization uses ALE (Annual Loss Expectancy) to prioritize security investments. ALE is calculated as:

Accepted Answer

Single Loss Expectancy × Annualized Rate of Occurrence

Answer

Asset Value × Threat Frequency

Answer

Asset Value − Safeguard Value

Answer

Exposure Factor × Annualized Rate of Occurrence