CSL Cybersecurity Governance & Risk Management 3

Question 1

Which metric best measures the effectiveness of a cybersecurity governance program over time?

Accepted Answer

Key Risk Indicators (KRIs) tracked against defined thresholds

Answer

Key Risk Indicators provide measurable data points that signal whether risk levels are within acceptable governance thresholds.

Question 2

An organization's risk register shows a high-likelihood, low-impact risk. What is the most appropriate initial response?

Accepted Answer

Implement cost-effective controls to reduce likelihood

Answer

High-likelihood, low-impact risks are prime candidates for cost-effective mitigating controls to reduce their frequency.

Question 3

What is the key distinction between a security policy and a security standard?

Accepted Answer

Policies state high-level intent while standards define specific measurable requirements

Answer

Policies articulate the organization's intent and direction while standards provide the specific, measurable requirements needed to meet that intent.

Question 4

Which concept describes the maximum tolerable downtime before a business process must be restored?

Accepted Answer

Recovery Time Objective (RTO)

Answer

Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or process after a disruption.

Question 5

A CISO presents cybersecurity risk in financial terms to the board. Which methodology is most appropriate for this quantitative approach?

Accepted Answer

Factor Analysis of Information Risk (FAIR)

Answer

FAIR is a quantitative risk analysis framework that expresses cyber risk in financial terms, making it ideal for board-level communication.

(CSL) Cybersecurity Leadership Certification Practice Test