CISSP Security and Risk Management 2

Question 1

Which risk treatment option involves sharing risk with a third party, such as through insurance or outsourcing?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber liability insurance.

Question 2

A company's ALE for a specific threat is $50,000 per year. A control costing $30,000 annually reduces the ALE to $10,000. What is the value of this control?

Accepted Answer

$20,000

Answer

Control value = (original ALE - residual ALE) - control cost = ($50,000 - $10,000) - $30,000 = $10,000, but the net risk reduction is $40,000 - $30,000 = $10,000; ALE reduction is $40,000 so value = $40,000 - $30,000 = $10,000.

Question 3

Which framework provides a structured approach to integrating security and privacy into the system development lifecycle using a risk management hierarchy of organization, mission, and system levels?

Accepted Answer

NIST SP 800-37 RMF

Answer

NIST SP 800-37 describes the Risk Management Framework (RMF) with a three-tier hierarchy spanning organization, mission/business process, and information system levels.

Question 4

Under the EU General Data Protection Regulation (GDPR), what is the maximum fine for the most serious violations?

Accepted Answer

€20 million or 4% of global annual turnover

Answer

GDPR Article 83(5) sets the maximum fine at €20 million or 4% of total worldwide annual turnover for the preceding year, whichever is higher.

Question 5

Which principle requires that personnel are granted only the permissions necessary to perform their specific job functions?

Accepted Answer

Least privilege

Answer

Least privilege restricts user access rights to only what is required to perform authorized tasks, minimizing the attack surface.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security and Risk Management 2