CREST Compliance, Risk & Governance 2

Question 1

What is the purpose of a Business Impact Analysis (BIA) in risk management?

Accepted Answer

To identify critical business functions and the impact of their disruption

Answer

To analyze the cost of security tool licenses

Answer

To assess employee satisfaction with security policies

Answer

To document system architecture diagrams

Question 2

What does RTO (Recovery Time Objective) define in business continuity planning?

Accepted Answer

The maximum acceptable time to restore a system or process after a disruption

Answer

The amount of data that can be lost in a disaster

Answer

The cost of recovering from an incident

Answer

The time required to detect a security breach

Question 3

Which regulation requires US federal agencies to implement information security programs and report on their effectiveness?

Accepted Answer

FISMA (Federal Information Security Modernization Act)

Answer

HIPAA

Answer

GLBA

Answer

FERPA

Question 4

What is a key difference between a policy and a procedure in an information security governance framework?

Accepted Answer

A policy states what must be done; a procedure describes how to do it

Answer

A policy is technical; a procedure is managerial

Answer

A policy is optional; a procedure is mandatory

Answer

They are the same document with different names

Question 5

What does a CREST-registered organization commit to in terms of professional standards?

Accepted Answer

Employing certified professionals who have passed rigorous technical examinations and adhere to a code of conduct

Answer

Using only CREST-approved software tools

Answer

Completing monthly vulnerability scans of client infrastructure

Answer

Submitting annual financial audits to CREST

Question 6

Which risk assessment methodology is commonly used in US government contexts and aligns with NIST SP 800-30?

Accepted Answer

NIST Risk Management Framework (RMF)

Answer

OCTAVE

Answer

CRAMM

Answer

FAIR