CORES Technology & Cyber Risk Management 4

Question 1

Under the NIST Cybersecurity Framework (CSF), which function focuses on developing organizational understanding to manage cybersecurity risk?

Accepted Answer

Identify

Answer

The Identify function encompasses asset management, business environment, governance, risk assessment, and risk management strategy to establish foundational cyber risk understanding.

Question 2

A firm's CISO reports that 40% of employees clicked a simulated phishing link. From an operational risk perspective, what control improvement is MOST directly indicated?

Accepted Answer

Enhance security awareness training with more frequent and targeted phishing simulations

Answer

A high phishing click rate indicates a human control gap; targeted security awareness training and repeated phishing simulations directly address this behavioral risk.

Question 3

Which of the following BEST describes 'cyber resilience' as distinct from 'cybersecurity'?

Accepted Answer

Cyber resilience encompasses the ability to anticipate, withstand, recover from, and adapt to cyber incidents

Answer

Cyber resilience extends beyond prevention to include operational continuity and adaptive capacity during and after cyber events, whereas cybersecurity primarily addresses protection.

Question 4

When classifying a data breach under operational risk loss event categories (Basel II/III), which category would typically apply?

Accepted Answer

External Fraud

Answer

Under Basel II/III taxonomy, cyber attacks by external actors resulting in unauthorized data access are classified under External Fraud.

Question 5

What is the purpose of a Software Bill of Materials (SBOM) in technology risk management?

Accepted Answer

To provide a detailed inventory of software components, enabling rapid identification of vulnerable dependencies

Answer

An SBOM catalogs all components and dependencies in software, allowing organizations to quickly identify which systems are affected when a vulnerability is discovered in a component.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Technology & Cyber Risk Management 4