CSPM CSPM Risk Management & Compliance 2

Question 1

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Accepted Answer

Relies on descriptive ratings such as High, Medium, and Low

Answer

Qualitative risk assessments categorize risk using subjective descriptors rather than precise monetary figures, making them faster but less precise than quantitative methods.

Question 2

Under SOX Section 404, which of the following is a key security project management responsibility?

Accepted Answer

Documenting and testing internal controls over financial reporting

Answer

SOX Section 404 requires management and external auditors to assess and report on the effectiveness of internal controls over financial reporting, including IT general controls.

Question 3

What is the primary purpose of a Statement of Applicability (SoA) in an ISO 27001 compliance project?

Accepted Answer

To document which Annex A controls are applicable and whether they are implemented

Answer

The SoA is an ISO 27001 requirement that maps each Annex A control to the organization, stating applicability, implementation status, and justification for exclusions.

Question 4

Which risk metric represents the maximum tolerable downtime for a system before business operations are critically impaired?

Accepted Answer

Recovery Time Objective (RTO)

Answer

The Recovery Time Objective (RTO) defines the maximum acceptable length of time a system can be offline following a disruption before causing unacceptable business impact.

Question 5

A CSPM professional is reviewing a third-party vendor's security posture. This activity is best categorized as:

Accepted Answer

Supply chain risk management

Answer

Evaluating vendor security controls is a core supply chain risk management activity, ensuring third-party relationships do not introduce unacceptable risk to the organization.

(CSPM) Certified Security Project Manager Practice Test

(CSPM) Certified Security Project Manager Practice Test

CSPM CSPM Risk Management & Compliance 2