CND Risk Management & Compliance 2

Question 1

Which risk treatment option involves transferring the financial impact of a risk to a third party?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber insurance.

Question 2

In NIST SP 800-30, what is the correct order of the risk assessment process?

Accepted Answer

Identify threats, identify vulnerabilities, determine likelihood, determine impact

Answer

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Question 3

Which compliance framework specifically addresses the security of payment card data?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for organizations that handle credit and debit card transactions.

Question 4

A quantitative risk analysis assigns monetary values to risk. What does the term 'Annual Loss Expectancy (ALE)' represent?

Accepted Answer

The product of SLE and ARO

Answer

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), giving the expected yearly financial loss.

Question 5

Which document formally authorizes an information system to operate and accepts the residual risk?

Accepted Answer

Authority to Operate (ATO)

Answer

An Authority to Operate (ATO) is issued by an authorizing official, formally accepting residual risk and permitting system operation.

(CND) Certified Network Defender Practice Test