CMA Risk Management & Security Architecture 1 — Questions and Answers
Question 1: In security architecture, which framework published by NIST provides a risk-based approach to managing cybersecurity risk through five core functions: Identify, Protect, Detect, Respond, and Recover?
- NIST SP 800-53
- NIST Cybersecurity Framework (CSF) (Correct answer)
- ISO/IEC 27001
- COBIT 2019
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five concurrent and continuous functions to help organizations manage and reduce risk.
Question 2: Which risk treatment option involves shifting the financial impact of a risk to a third party, such as through cyber insurance?
- Risk Avoidance
- Risk Mitigation
- Risk Transfer (Correct answer)
- Risk Acceptance
Correct answer: Risk Transfer
Risk Transfer moves the financial consequence of a risk to another party—such as an insurer or outsourcing vendor—without eliminating the underlying threat.
Question 3: A CMA architect is designing a system with the requirement that no single failure should cause complete service unavailability. Which security and resilience principle addresses this?
- Least Privilege
- Defense in Depth
- Single Point of Failure Elimination (Correct answer)
- Separation of Duties
Correct answer: Single Point of Failure Elimination
Eliminating Single Points of Failure ensures that no individual component can bring down an entire system, supporting both availability and resilience goals.
Question 4: Which formula correctly represents the basic calculation of risk in a risk management context?
- Risk = Threat × Vulnerability
- Risk = Impact + Likelihood
- Risk = Threat × Vulnerability × Impact (Correct answer)
- Risk = Asset Value / Control Effectiveness
Correct answer: Risk = Threat × Vulnerability × Impact
Risk is commonly calculated as the product of Threat likelihood, Vulnerability exposure, and the potential Impact of exploitation.
Question 5: In the SABSA security architecture framework, which layer defines the business context and security policies at the executive stakeholder level?
- Contextual Layer (Correct answer)
- Conceptual Layer
- Logical Layer
- Physical Layer
Correct answer: Contextual Layer
The Contextual Layer in SABSA captures the business context—why security is needed—from the perspective of executive stakeholders and business drivers.
Question 6: Which US federal regulation requires organizations handling protected health information (PHI) to implement technical, physical, and administrative security safeguards?
- SOX
- FISMA
- HIPAA Security Rule (Correct answer)
- GLBA
Correct answer: HIPAA Security Rule
The HIPAA Security Rule mandates that covered entities and business associates implement safeguards to protect the confidentiality, integrity, and availability of electronic PHI.
CMA Risk Management & Security Architecture 1
In security architecture, which framework published by NIST provides a risk-based approach to managing cybersecurity risk through five core functions: Identify, Protect, Detect, Respond, and Recover?