CND Risk Management & Compliance 3

Question 1

Which NIST publication provides guidance specifically on the Risk Management Framework (RMF)?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 describes the Risk Management Framework (RMF) for federal information systems, outlining six steps from categorization to continuous monitoring.

Question 2

An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Accepted Answer

Risk acceptance

Answer

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 3

Which SOX section holds executives personally accountable for the accuracy of financial reports and the effectiveness of internal controls?

Accepted Answer

Section 302

Answer

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

Question 4

In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

Accepted Answer

The maximum acceptable downtime before business impact becomes critical

Answer

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Question 5

Which framework uses a five-function structure — Identify, Protect, Detect, Respond, Recover — for managing cybersecurity risk?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Risk Management & Compliance 3