CDP Risk Management & Compliance 2 — Questions and Answers
Question 1: In DevSecOps, what does a 'risk appetite statement' formally define?
- The maximum number of vulnerabilities allowed per release
- The level and type of risk an organization is willing to accept in pursuit of objectives (Correct answer)
- The budget allocated for security tooling each quarter
- The list of approved third-party vendors for security services
Correct answer: The level and type of risk an organization is willing to accept in pursuit of objectives
A risk appetite statement defines the amount and type of risk an organization is prepared to accept while pursuing its strategic objectives.
Question 2: Which NIST framework function focuses on developing organizational understanding to manage cybersecurity risk?
- Respond
- Protect
- Identify (Correct answer)
- Recover
Correct answer: Identify
The 'Identify' function of the NIST Cybersecurity Framework focuses on developing an understanding of the organizational context needed to manage cybersecurity risk.
Question 3: A DevSecOps team discovers that a third-party library used in production has a known CVE but no patch is available. What risk treatment option involves continuing operations while documenting the known risk?
- Risk avoidance
- Risk transfer
- Risk acceptance (Correct answer)
- Risk mitigation
Correct answer: Risk acceptance
Risk acceptance means acknowledging a known risk and choosing to operate with it, typically documented with compensating controls and leadership sign-off.
Question 4: Under SOC 2 Type II, what distinguishes it from SOC 2 Type I?
- Type II covers a broader set of trust service criteria
- Type II assesses the operational effectiveness of controls over a period of time (Correct answer)
- Type II is only applicable to cloud service providers
- Type II requires a government auditor rather than a CPA firm
Correct answer: Type II assesses the operational effectiveness of controls over a period of time
SOC 2 Type II evaluates whether controls were operating effectively over a defined period (typically 6–12 months), whereas Type I only assesses design at a point in time.
Question 5: Which risk quantification method expresses risk as a financial expected value using probability distributions?
- DREAD scoring
- CVSS base scoring
- Monte Carlo simulation (FAIR model) (Correct answer)
- Heat map risk matrix
Correct answer: Monte Carlo simulation (FAIR model)
The FAIR (Factor Analysis of Information Risk) model combined with Monte Carlo simulation quantifies risk in financial terms using probability ranges for frequency and magnitude.
Question 6: An organization must ensure that personal data of EU residents is only processed for the purpose it was originally collected. Which GDPR principle does this reflect?
- Data minimization
- Purpose limitation (Correct answer)
- Storage limitation
- Integrity and confidentiality
Correct answer: Purpose limitation
The GDPR 'purpose limitation' principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
Question 7: In a risk register, what does 'residual risk' represent?
- Risk eliminated after applying security controls
- Risk that remains after controls have been applied (Correct answer)
- Risk inherited from a supply chain vendor
- Risk scored before any analysis is performed
Correct answer: Risk that remains after controls have been applied
Residual risk is the level of risk that persists after all planned risk treatments and security controls have been implemented.
CDP Risk Management & Compliance 2
In DevSecOps, what does a 'risk appetite statement' formally define?