CDP Risk Management & Compliance 2

Question 1

In DevSecOps, what does a 'risk appetite statement' formally define?

Accepted Answer

The level and type of risk an organization is willing to accept in pursuit of objectives

Answer

A risk appetite statement defines the amount and type of risk an organization is prepared to accept while pursuing its strategic objectives.

Question 2

Which NIST framework function focuses on developing organizational understanding to manage cybersecurity risk?

Accepted Answer

Identify

Answer

The 'Identify' function of the NIST Cybersecurity Framework focuses on developing an understanding of the organizational context needed to manage cybersecurity risk.

Question 3

A DevSecOps team discovers that a third-party library used in production has a known CVE but no patch is available. What risk treatment option involves continuing operations while documenting the known risk?

Accepted Answer

Risk acceptance

Answer

Risk acceptance means acknowledging a known risk and choosing to operate with it, typically documented with compensating controls and leadership sign-off.

Question 4

Under SOC 2 Type II, what distinguishes it from SOC 2 Type I?

Accepted Answer

Type II assesses the operational effectiveness of controls over a period of time

Answer

SOC 2 Type II evaluates whether controls were operating effectively over a defined period (typically 6–12 months), whereas Type I only assesses design at a point in time.

Question 5

Which risk quantification method expresses risk as a financial expected value using probability distributions?

Accepted Answer

Monte Carlo simulation (FAIR model)

Answer

The FAIR (Factor Analysis of Information Risk) model combined with Monte Carlo simulation quantifies risk in financial terms using probability ranges for frequency and magnitude.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Risk Management & Compliance 2