CND Risk Management & Compliance 5

Question 1

Which risk metric represents the expected loss from a single occurrence of a specific threat event?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

SLE = Asset Value × Exposure Factor, representing the dollar loss from one occurrence of a threat event against a specific asset.

Question 2

An organization implements multi-factor authentication to reduce the risk of credential theft. This is an example of which type of risk control?

Accepted Answer

Preventive control

Answer

Preventive controls are designed to stop security incidents before they occur; MFA prevents unauthorized access by requiring additional verification.

Question 3

Under GDPR, what is the maximum timeframe within which a data breach affecting EU citizens' rights must be reported to the supervisory authority?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires that data breaches likely to result in risk to individuals must be reported to the supervisory authority within 72 hours of discovery.

Question 4

In the context of risk management, a 'threat vector' refers to:

Accepted Answer

The path or method used by a threat agent to exploit a vulnerability

Answer

A threat vector is the specific route, method, or pathway through which a threat actor can exploit a vulnerability to cause harm.

Question 5

Which NIST SP 800-53 control family specifically addresses planning and policy for information security?

Accepted Answer

Planning (PL)

Answer

The Planning (PL) control family in NIST SP 800-53 covers security planning activities including system security plans and rules of behavior.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Risk Management & Compliance 5