CSPM Risk Management & Compliance Flashcards

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Answer: Relies on descriptive ratings such as High, Medium, and Low

Qualitative risk assessments categorize risk using subjective descriptors rather than precise monetary figures, making them faster but less precise than quantitative methods.

Under SOX Section 404, which of the following is a key security project management responsibility?

Answer: Documenting and testing internal controls over financial reporting

SOX Section 404 requires management and external auditors to assess and report on the effectiveness of internal controls over financial reporting, including IT general controls.

What is the primary purpose of a Statement of Applicability (SoA) in an ISO 27001 compliance project?

Answer: To document which Annex A controls are applicable and whether they are implemented

The SoA is an ISO 27001 requirement that maps each Annex A control to the organization, stating applicability, implementation status, and justification for exclusions.

Which risk metric represents the maximum tolerable downtime for a system before business operations are critically impaired?

Answer: Recovery Time Objective (RTO)

The Recovery Time Objective (RTO) defines the maximum acceptable length of time a system can be offline following a disruption before causing unacceptable business impact.

A CSPM professional is reviewing a third-party vendor's security posture. This activity is best categorized as:

Answer: Supply chain risk management

Evaluating vendor security controls is a core supply chain risk management activity, ensuring third-party relationships do not introduce unacceptable risk to the organization.

In the US, which sector-specific regulation requires annual independent security assessments for payment card processing environments?

Answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) requires organizations processing cardholder data to undergo annual assessments by a Qualified Security Assessor (QSA) or complete a self-assessment questionnaire.