CSC Governance, Risk Management & Policy Development 3

Question 1

An organization is evaluating risks using a qualitative approach. Which method are they MOST likely using?

Accepted Answer

Rating risks as High, Medium, or Low based on judgment

Answer

Qualitative risk analysis uses descriptive ratings like High, Medium, or Low rather than precise numerical calculations.

Question 2

Which governance framework provides guidance specifically designed for IT governance and aligns IT goals with business objectives?

Accepted Answer

COBIT

Answer

COBIT (Control Objectives for Information and Related Technologies) is an IT governance framework that aligns IT with business goals.

Question 3

A newly hired CISO wants to develop a cybersecurity strategy aligned with business goals. What should be the FIRST step?

Accepted Answer

Conduct a business impact analysis tied to security risks

Answer

Understanding business impacts of security risks ensures that the cybersecurity strategy directly supports organizational objectives.

Question 4

What does the term 'residual risk' refer to?

Accepted Answer

The risk that remains after controls have been implemented

Answer

Residual risk is the level of risk that persists after security controls and mitigations have been applied.

Question 5

Which role is TYPICALLY responsible for approving an organization's information security policies?

Accepted Answer

Senior management or executive leadership

Answer

Information security policies require approval from senior management or executives to carry organizational authority and accountability.

(CSC) Cybersecurity Compliance Certification Practice Test