CORES Technology & Cyber Risk Management 3

Question 1

An operational risk manager is evaluating cyber risks using the FAIR (Factor Analysis of Information Risk) model. What are the two top-level factors FAIR decomposes risk into?

Accepted Answer

Loss Event Frequency and Loss Magnitude

Answer

FAIR decomposes risk into Loss Event Frequency (how often a loss event occurs) and Loss Magnitude (how much loss results), enabling probabilistic financial quantification.

Question 2

Which regulatory framework requires US financial institutions to notify their primary federal regulator within 36 hours of a significant computer security incident?

Accepted Answer

OCC Computer-Security Incident Notification Rule

Answer

The OCC/Federal Reserve/FDIC Computer-Security Incident Notification Rule requires banking organizations to notify their primary federal regulator within 36 hours of a significant incident.

Question 3

What is the key distinction between a vulnerability assessment and a penetration test in technology risk management?

Accepted Answer

Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact

Answer

Vulnerability assessments scan and catalog weaknesses, while penetration tests go further by attempting to exploit those weaknesses to measure real-world risk impact.

Question 4

A CORES candidate is reviewing a firm's cyber risk appetite statement. Which element is MOST critical to include?

Accepted Answer

Defined thresholds for tolerable cyber loss exposure aligned to business strategy

Answer

A cyber risk appetite statement must articulate the level of risk the organization is willing to accept, expressed in measurable thresholds tied to strategic objectives.

Question 5

Which attack technique involves embedding malicious code in a legitimate website visited by targeted employees to deliver malware without direct interaction?

Accepted Answer

Watering hole attack

Answer

A watering hole attack compromises websites frequently visited by the target group, passively delivering malware when victims browse to the trusted but infected site.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Technology & Cyber Risk Management 3