CCISO Information Security & Risk Management 2

Question 1

A CISO is implementing a risk-based security program. Which framework specifically integrates risk management into a continuous monitoring strategy for federal information systems?

Accepted Answer

NIST RMF

Answer

NIST Risk Management Framework (RMF) provides a disciplined, structured, and flexible process that integrates security and risk management into the system development life cycle for federal systems.

Question 2

When conducting a risk assessment, the term 'threat agent' most accurately refers to:

Accepted Answer

An entity that initiates a threat event

Answer

A threat agent is the actor or entity (person, organization, or natural event) that can exploit a vulnerability to cause harm to an asset.

Question 3

An organization's risk register shows a residual risk that exceeds the acceptable risk threshold. What is the MOST appropriate CISO action?

Accepted Answer

Escalate to executive leadership for a risk acceptance decision

Answer

When residual risk exceeds the acceptable threshold, the CISO must escalate to executive leadership who have the authority to formally accept or direct additional risk treatment.

Question 4

Which risk treatment option is applied when an organization decides to stop performing an activity that generates unacceptable risk?

Accepted Answer

Risk avoidance

Answer

Risk avoidance eliminates the risk by discontinuing the activity or process that creates the unacceptable exposure.

Question 5

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Accepted Answer

Relies on subjective ratings such as high, medium, and low

Answer

Qualitative risk assessments use descriptive scales (high/medium/low) rather than numerical financial values, making them faster but more subjective than quantitative methods.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Information Security & Risk Management 2