CGRC Risk Assessment and Management 3

Question 1

Which quantitative risk metric represents the expected monetary loss from a specific threat occurring once?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

SLE = Asset Value × Exposure Factor, representing the dollar loss expected from a single threat event.

Question 2

An organization uses insurance to shift financial exposure from a cyberattack to a third party. This is an example of:

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial consequence of a risk to another party, most commonly through insurance or contractual indemnification.

Question 3

In ISO 31000, which component provides the mandate and commitment for risk management?

Accepted Answer

Principles and framework

Answer

ISO 31000 structures risk management into Principles, Framework, and Process — the framework provides the mandate and commitment from leadership.

Question 4

A CGRC professional performing a risk assessment notices that two separate low-level risks, when combined, create a high-impact exposure. This is best described as:

Accepted Answer

Aggregate risk

Answer

Aggregate risk refers to the combined effect of multiple individual risks that together create a larger overall exposure than each risk alone would suggest.

Question 5

Which control type is BEST suited to reduce the likelihood of a threat exploiting a vulnerability?

Accepted Answer

Preventive control

Answer

Preventive controls reduce the likelihood that a threat will successfully exploit a vulnerability by blocking or discouraging the threat.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Assessment and Management 3