CORES Technology & Cyber Risk Management 2

Question 1

A bank's core banking system experiences a zero-day vulnerability exploited before a patch is available. What is the MOST appropriate immediate response?

Accepted Answer

Apply compensating controls such as network segmentation and enhanced monitoring

Answer

Compensating controls like network segmentation and enhanced monitoring reduce exposure while a formal patch is developed, balancing security with operational continuity.

Question 2

Under NIST SP 800-53, which control family specifically addresses incident response planning for IT systems?

Accepted Answer

Incident Response (IR)

Answer

The Incident Response (IR) control family in NIST SP 800-53 covers planning, testing, handling, and monitoring of security incidents.

Question 3

Which metric in a cyber risk quantification model best captures the financial impact of a ransomware event affecting production systems?

Accepted Answer

Annual Loss Expectancy (ALE)

Answer

Annual Loss Expectancy (ALE) combines the probability of a threat event with its single occurrence loss, providing a financial measure of cyber risk.

Question 4

A firm's third-party cloud provider suffers a breach exposing customer PII. Under operational risk management principles, who bears primary accountability?

Accepted Answer

The firm, because outsourcing activity does not transfer regulatory accountability

Answer

Regulators and risk frameworks hold the firm accountable for risks arising from outsourced activities; the firm cannot transfer its compliance obligations.

Question 5

What is the primary purpose of a cyber tabletop exercise in an operational risk program?

Accepted Answer

To test response coordination and decision-making without real operational impact

Answer

Tabletop exercises simulate cyber scenarios in a discussion-based format to evaluate the effectiveness of incident response plans and team coordination.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Technology & Cyber Risk Management 2