CORES Technology & Cyber Risk Management 5

Question 1

Which governance structure element is MOST important for ensuring effective cyber risk oversight at the board level?

Accepted Answer

Establishing a board-level committee with defined cyber risk responsibilities and regular reporting cadence

Answer

A dedicated board committee with clear mandates and regular cyber risk reporting ensures strategic-level oversight and accountability for technology risk.

Question 2

A firm's key risk indicator (KRI) for cyber risk shows the number of unpatched critical vulnerabilities trending upward for three consecutive months. What is the MOST appropriate escalation action?

Accepted Answer

Escalate to senior management and initiate an emergency patching program with defined remediation timelines

Answer

A sustained upward trend in a critical KRI signals deteriorating control effectiveness and requires immediate escalation and a time-bound remediation response.

Question 3

Under ISO/IEC 27005, the risk treatment option of 'risk avoidance' in a cyber context would BEST be illustrated by:

Accepted Answer

Discontinuing a high-risk digital service that cannot be adequately secured

Answer

Risk avoidance means eliminating the risk by ceasing the activity that generates it; discontinuing an insecurable service removes the exposure entirely.

Question 4

What distinguishes an Advanced Persistent Threat (APT) from a typical opportunistic cyberattack?

Accepted Answer

APTs involve prolonged, targeted intrusions by sophisticated actors seeking specific objectives over time

Answer

APTs are characterized by their long dwell time, targeted nature, and persistence — attackers maintain covert access to achieve specific espionage or sabotage objectives.

Question 5

Which of the following is the PRIMARY objective of a cyber risk quantification program in an enterprise operational risk framework?

Accepted Answer

To translate cyber risks into financial terms that enable risk-informed investment and prioritization decisions

Answer

Cyber risk quantification converts technical risks into financial metrics, enabling executives and boards to make cost-benefit decisions on security investments and risk tolerance.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Technology & Cyber Risk Management 5