CREST Compliance, Risk & Governance

Question 1

What is the primary purpose of an Information Security Management System (ISMS) as defined by ISO/IEC 27001?

Accepted Answer

To establish, implement, maintain, and continually improve information security controls

Answer

To automate vulnerability scanning across all systems

Answer

To manage employee security awareness training

Answer

To define software development lifecycle processes

Question 2

What does a risk assessment in information security aim to identify?

Accepted Answer

Threats, vulnerabilities, likelihood, and potential impact to organizational assets

Answer

Penetration test findings and their CVSS scores

Answer

The number of security incidents per quarter

Answer

Compliance gaps against a regulatory framework

Question 3

Which of the following is a risk treatment option in information security risk management?

Accepted Answer

Risk transfer (e.g., cyber insurance)

Answer

Risk discovery

Answer

Risk enumeration

Answer

Risk correlation

Question 4

What does the NIST Cybersecurity Framework (CSF) organize its functions around?

Accepted Answer

Identify, Protect, Detect, Respond, Recover

Answer

Plan, Do, Check, Act

Answer

Prevent, Detect, Correct

Answer

Classify, Assess, Mitigate, Monitor

Question 5

What is the difference between a vulnerability and a risk in information security?

Accepted Answer

A vulnerability is a weakness; a risk is the potential for harm when a threat exploits that weakness

Answer

A vulnerability is the likelihood of an attack; a risk is the discovered flaw

Answer

A vulnerability is a business impact; a risk is a technical weakness

Answer

They are synonymous terms used interchangeably

Question 6

Which US compliance standard specifically governs the security of cardholder data for payment card processing?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Answer

FISMA