CISSP Security and Risk Management 3

Question 1

Which security planning document defines the acceptable level of loss that an organization is willing to tolerate?

Accepted Answer

Risk appetite statement

Answer

A risk appetite statement formally documents the amount and type of risk an organization is willing to accept in pursuit of its objectives.

Question 2

The concept that no single person should have complete control over a critical process is known as:

Accepted Answer

Separation of duties

Answer

Separation of duties divides critical tasks among multiple individuals to prevent fraud and error by ensuring no one person can complete a harmful act alone.

Question 3

Which US federal law specifically requires federal agencies to protect information systems and mandates FISMA compliance?

Accepted Answer

Federal Information Security Modernization Act (FISMA)

Answer

FISMA requires federal agencies to develop, document, and implement agency-wide programs to provide information security for their systems.

Question 4

A qualitative risk assessment differs from a quantitative one in that it:

Accepted Answer

Relies on expert judgment and descriptive categories like High/Medium/Low

Answer

Qualitative risk assessments use subjective ratings and expert judgment rather than precise monetary calculations, making them faster but less precise.

Question 5

Which term describes the remaining risk after safeguards and controls have been applied?

Accepted Answer

Residual risk

Answer

Residual risk is the leftover risk exposure after all planned countermeasures have been implemented and accepted by management.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security and Risk Management 3