CCISO Information Security & Risk Management 3

Question 1

A CISO must present the security program's value to the board. Which metric BEST demonstrates the effectiveness of security controls from a business risk perspective?

Accepted Answer

Reduction in risk exposure measured in dollar value

Answer

Number of firewall rules updated per quarter

Answer

Total number of security incidents detected

Answer

Percentage of employees who completed security awareness training

Question 2

Under ISO/IEC 27005, the risk evaluation step is performed to:

Accepted Answer

Compare risk analysis results against risk criteria to prioritize treatment

Answer

Identify all assets within scope of the ISMS

Answer

Implement controls selected from ISO/IEC 27002

Answer

Document residual risk after controls are applied

Question 3

Which of the following BEST represents a Key Risk Indicator (KRI) for an information security program?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 90 days

Answer

Number of patches applied in the last 30 days

Answer

Total IT budget allocated to security tools

Answer

Number of security team members certified

Question 4

An organization wants to ensure its information security risk management aligns with enterprise risk management (ERM). The PRIMARY benefit of this alignment is:

Accepted Answer

Ensuring security risks are considered alongside strategic and operational risks

Answer

Reducing the number of security controls needed

Answer

Allowing the CISO to report directly to the board without intermediaries

Answer

Automating risk assessment processes across the enterprise

Question 5

Which statement BEST describes the purpose of a Statement of Applicability (SoA) in an ISO 27001 implementation?

Accepted Answer

It documents which Annex A controls are applicable and why others are excluded

Answer

It lists all identified threats and vulnerabilities for the organization

Answer

It defines the scope of the Information Security Management System

Answer

It outlines the risk acceptance criteria approved by management

Question 6

A CISO discovers that a third-party vendor with access to sensitive customer data has not undergone a security assessment. Which risk management step should have prevented this gap?

Accepted Answer

Risk identification

Answer

Risk monitoring

Answer

Risk communication

Answer

Risk treatment

Question 7

In a risk scenario analysis, the 'exposure factor' (EF) represents:

Accepted Answer

The percentage of asset value lost if a specific threat materializes

Answer

The frequency with which a threat is expected to occur annually

Answer

The cost of implementing a safeguard to protect an asset

Answer

The probability that a vulnerability will be exploited