CCP Cybersecurity Principles & Risk Management 3

Question 1

Which metric in quantitative risk analysis represents the expected monetary loss from a single occurrence of a threat event?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

Single Loss Expectancy (SLE) is calculated as Asset Value multiplied by Exposure Factor, representing the cost of one occurrence of a specific threat.

Question 2

What is the role of a risk owner in a cybersecurity risk management program?

Accepted Answer

Accept accountability for monitoring and managing an assigned risk

Answer

A risk owner is an individual accountable for ensuring that an identified risk is monitored, treated appropriately, and reported as needed.

Question 3

Which concept describes the maximum level of risk an organization is prepared to accept in pursuit of its objectives?

Accepted Answer

Risk appetite

Answer

Risk appetite is the broad level of risk an organization is willing to accept before action is required, set by executive leadership and the board.

Question 4

After applying security controls, what term describes the risk that remains?

Accepted Answer

Residual risk

Answer

Residual risk is the level of risk remaining after security controls and mitigations have been applied to the inherent risk.

Question 5

Which framework is MOST commonly used by US federal agencies for risk management and security authorization?

Accepted Answer

NIST RMF (SP 800-37)

Answer

The NIST Risk Management Framework (RMF), described in SP 800-37, provides a structured process for integrating security into federal information systems and is mandated for US federal agencies.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Cybersecurity Principles & Risk Management 3