CGRC Risk Assessment and Management 5

Question 1

Which NIST publication provides the primary guidance for risk management in federal information systems?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 is the primary guide for conducting risk assessments for federal information systems and organizations.

Question 2

During continuous monitoring, an organization detects a new zero-day vulnerability affecting a critical system. The FIRST step should be to:

Accepted Answer

Assess the risk to determine likelihood and potential impact

Answer

The first step is always to assess the risk — understanding likelihood and potential impact — before deciding on an appropriate response action.

Question 3

Which of the following is a KEY output of the risk identification phase?

Accepted Answer

A risk register containing identified risks and their attributes

Answer

The risk register is the primary output of risk identification, capturing each identified risk along with its description, owner, and relevant attributes.

Question 4

A Key Risk Indicator (KRI) differs from a Key Performance Indicator (KPI) in that a KRI:

Accepted Answer

Provides early warning signals of increasing risk exposure

Answer

KRIs are forward-looking metrics designed to signal emerging or increasing risk before it materializes, whereas KPIs measure historical performance outcomes.

Question 5

An organization operating in multiple jurisdictions must consider different regulatory requirements in its risk assessments. This cross-border complexity is an example of:

Accepted Answer

Compliance risk

Answer

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational harm from failure to comply with applicable laws and regulations.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Assessment and Management 5