CSC Governance, Risk Management & Policy Development 2

Question 1

A company's board of directors wants to ensure cybersecurity risk is addressed at the highest level. Which governance structure best achieves this?

Accepted Answer

Establishing a board-level cybersecurity committee with executive oversight

Answer

A board-level cybersecurity committee ensures that security risk receives executive-level attention and accountability.

Question 2

Which risk treatment option involves transferring the financial impact of a risk to another party?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial consequences of a risk to a third party, such as through insurance or contractual agreements.

Question 3

An organization's information security policy states that all employees must complete annual security awareness training. This policy is BEST classified as which type?

Accepted Answer

Advisory policy

Answer

Advisory policies recommend best practices and may include mandatory requirements like training, guiding employee behavior.

Question 4

What is the PRIMARY purpose of a Risk Register in an organization?

Accepted Answer

To document identified risks, their likelihood, impact, and treatment plans

Answer

A Risk Register is a central document that captures identified risks along with their attributes and management strategies.

Question 5

Under NIST's Risk Management Framework (RMF), which step involves selecting and implementing security controls?

Accepted Answer

Select and Implement

Answer

The Select and Implement step in NIST RMF involves choosing appropriate security controls and putting them into operation.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Governance, Risk Management & Policy Development 2