CCP CCP Risk Management & Assessment 2

Question 1

What is the primary purpose of a Business Impact Analysis (BIA)?

Accepted Answer

To determine critical business functions and their recovery priorities

Answer

To identify all network vulnerabilities

Answer

To calculate the total cost of security controls

Answer

To assess employee cybersecurity awareness levels

Question 2

Which metric defines the maximum acceptable downtime for a system following a disaster?

Accepted Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Repair (MTTR)

Answer

Maximum Tolerable Downtime (MTD)

Question 3

In the NIST Risk Management Framework (RMF), which step involves choosing appropriate security controls?

Accepted Answer

Select

Answer

Categorize

Answer

Implement

Answer

Assess

Question 4

Which type of risk assessment assigns numerical probabilities and financial values to risk outcomes?

Accepted Answer

Quantitative

Answer

Qualitative

Answer

Hybrid

Answer

Subjective

Question 5

How is Annual Loss Expectancy (ALE) calculated?

Accepted Answer

SLE multiplied by ARO

Answer

SLE divided by ARO

Answer

ARO divided by asset value

Answer

Asset value minus controls cost

Question 6

When the cost of mitigating a risk exceeds the value of the asset at risk, which risk response is most appropriate?

Accepted Answer

Risk acceptance

Answer

Risk transference

Answer

Risk avoidance

Answer

Risk mitigation