CND Risk Management & Compliance Practice Questions — Questions and Answers

Question 1: Which risk treatment option involves transferring the financial impact of a risk to a third party?

Risk avoidance
Risk acceptance
Risk transference (Correct answer)
Risk mitigation

Correct answer: Risk transference

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber insurance.

Question 2: In NIST SP 800-30, what is the correct order of the risk assessment process?

Identify threats, identify vulnerabilities, determine likelihood, determine impact (Correct answer)
Determine impact, identify threats, assess controls, determine likelihood
Assess controls, identify threats, determine impact, identify vulnerabilities
Identify vulnerabilities, determine impact, identify threats, assess controls

Correct answer: Identify threats, identify vulnerabilities, determine likelihood, determine impact

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Question 3: Which compliance framework specifically addresses the security of payment card data?

HIPAA
SOX
PCI DSS (Correct answer)
GLBA

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for organizations that handle credit and debit card transactions.

Question 4: A quantitative risk analysis assigns monetary values to risk. What does the term 'Annual Loss Expectancy (ALE)' represent?

The maximum possible loss from a single incident
The product of SLE and ARO (Correct answer)
The cost of implementing security controls
The percentage chance a threat will occur in a year

Correct answer: The product of SLE and ARO

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), giving the expected yearly financial loss.

Question 5: Which document formally authorizes an information system to operate and accepts the residual risk?

System Security Plan (SSP)
Authority to Operate (ATO) (Correct answer)
Risk Register
Business Impact Analysis (BIA)

Correct answer: Authority to Operate (ATO)

An Authority to Operate (ATO) is issued by an authorizing official, formally accepting residual risk and permitting system operation.

Question 6: Under HIPAA, which rule specifically requires covered entities to implement administrative, physical, and technical safeguards for electronic PHI?

Privacy Rule
Breach Notification Rule
Security Rule (Correct answer)
Enforcement Rule

Correct answer: Security Rule

The HIPAA Security Rule requires covered entities to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Question 7: Which risk analysis method uses expert opinion and descriptive ratings such as 'High,' 'Medium,' and 'Low' rather than numerical values?

Quantitative analysis
Delphi method
Qualitative analysis (Correct answer)
Monte Carlo simulation

Correct answer: Qualitative analysis

Qualitative risk analysis uses subjective ratings and expert judgment instead of precise monetary or numerical calculations.

Question 8: Which NIST publication provides guidance specifically on the Risk Management Framework (RMF)?

NIST SP 800-53
NIST SP 800-37 (Correct answer)
NIST SP 800-61
NIST SP 800-171

Correct answer: NIST SP 800-37

NIST SP 800-37 describes the Risk Management Framework (RMF) for federal information systems, outlining six steps from categorization to continuous monitoring.

Question 9: An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Risk transference
Risk avoidance
Risk acceptance (Correct answer)
Risk mitigation

Correct answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 10: Which SOX section holds executives personally accountable for the accuracy of financial reports and the effectiveness of internal controls?

Section 302 (Correct answer)
Section 404
Section 409
Section 802

Correct answer: Section 302

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

Question 11: In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

The maximum tolerable data loss measured in time
The cost to restore operations after a disaster
The maximum acceptable downtime before business impact becomes critical (Correct answer)
The point in time to which data must be recovered

Correct answer: The maximum acceptable downtime before business impact becomes critical

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Question 12: Which framework uses a five-function structure — Identify, Protect, Detect, Respond, Recover — for managing cybersecurity risk?

ISO/IEC 27001
NIST Cybersecurity Framework (CSF) (Correct answer)
COBIT 5
CIS Controls

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 13: A threat agent exploits a software vulnerability to gain unauthorized access. In risk terminology, what is the 'threat agent'?

The weakness in the software
The entity that takes advantage of the vulnerability (Correct answer)
The impact of the successful attack
The control designed to prevent exploitation

Correct answer: The entity that takes advantage of the vulnerability

A threat agent (or threat actor) is the person, group, or entity that initiates and carries out an attack by exploiting a vulnerability.

Question 14: Which GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Data minimization
Storage limitation
Purpose limitation (Correct answer)
Integrity and confidentiality

Correct answer: Purpose limitation

The GDPR principle of purpose limitation restricts organizations from using personal data for purposes beyond what was originally specified at collection.

Question 15: Which step of the NIST RMF involves categorizing information systems based on the potential impact of a security breach?

Select
Implement
Categorize (Correct answer)
Authorize

Correct answer: Categorize

The Categorize step uses FIPS 199 and NIST SP 800-60 to classify systems based on the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Question 16: An organization wants to comply with ISO/IEC 27001. Which document serves as the foundation by defining the scope, objectives, and boundaries of the Information Security Management System (ISMS)?

Statement of Applicability (SoA) (Correct answer)
Risk Treatment Plan
Asset Inventory
Information Security Policy

Correct answer: Statement of Applicability (SoA)

The Statement of Applicability (SoA) documents which ISO/IEC 27001 Annex A controls are applicable and justified for the organization's ISMS scope.

Question 17: During a risk assessment, an analyst finds that a web server is exposed to SQL injection. The vulnerability is the weakness, and the threat is malicious input. What is the 'risk' in this scenario?

The firewall protecting the server
The probability that the SQL injection succeeds combined with the resulting impact (Correct answer)
The web server hardware itself
The database administrator's lack of awareness

Correct answer: The probability that the SQL injection succeeds combined with the resulting impact

Risk is the combination of the likelihood that a threat exploits a vulnerability and the potential impact of that exploitation.

Question 18: Which compliance regulation applies to US financial institutions and requires them to protect the security and confidentiality of customer financial information?

FERPA
GLBA (Correct answer)
COPPA
FISMA

Correct answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires US financial institutions to implement safeguards to protect nonpublic personal financial information.

Question 19: In risk management, the 'residual risk' is best described as:

Risk that has been completely eliminated by security controls
Risk that remains after security controls have been applied (Correct answer)
The initial risk before any assessment is conducted
Risk transferred to a third-party insurer

Correct answer: Risk that remains after security controls have been applied

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.

Question 20: Which federal law mandates that US government agencies implement information security programs and report to OMB annually?

HIPAA
SOX
FISMA (Correct answer)
FERPA

Correct answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement agency-wide information security programs.

Question 21: A penetration testing company is hired to assess a client's network. Before testing begins, a document is signed that defines the scope, rules of engagement, and legal authorization. This document is called a:

Non-Disclosure Agreement (NDA)
Rules of Engagement (RoE) / Statement of Work (Correct answer)
Risk Register
Memorandum of Understanding (MOU)

Correct answer: Rules of Engagement (RoE) / Statement of Work

The Rules of Engagement (RoE) or Statement of Work defines the authorized scope, methods, and boundaries for penetration testing, providing legal protection.

CND Risk Management & Compliance Practice Questions

Which risk treatment option involves transferring the financial impact of a risk to a third party?

🃏 CND Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CND Study Guide →

What Practice Test Geeks adds beyond an AI chat for CND

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length CND mock exam — 100 questions in 240 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed CND question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable CND cheat sheet you can print or save as a PDF.
CND flashcards built from the same question bank.

Start the Timed CND Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Eligibility, fees, renewal, score validity, retake fee, exam format, passing score, time limit, exam information · verified Nov 2026
eccouncil.org — Test delivery · verified Oct 2026