CSPM CSPM Risk Management & Compliance 1

Question 1

In the CSPM framework, which risk management step involves identifying potential threats and their likelihood of occurrence?

Accepted Answer

Risk identification

Answer

Risk identification is the foundational step where potential threats, vulnerabilities, and their likelihood are catalogued before any response strategy is chosen.

Question 2

A security project manager is calculating the Annual Loss Expectancy (ALE) for a threat. Which formula is correct?

Accepted Answer

ALE = SLE × ARO

Answer

ALE equals Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO), expressing the expected yearly financial loss from a specific threat.

Question 3

Which US federal regulation requires organizations handling electronic protected health information (ePHI) to conduct regular risk analyses?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule mandates covered entities and business associates to perform regular risk analyses to identify threats to ePHI confidentiality, integrity, and availability.

Question 4

What type of risk response strategy involves purchasing cyber insurance to offset potential financial losses?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial burden of a risk to a third party, such as an insurer, rather than eliminating or reducing the underlying threat.

Question 5

In a CSPM context, a residual risk is best described as:

Accepted Answer

The risk remaining after security controls have been implemented

Answer

Residual risk is the level of risk that persists after all planned security controls and mitigations have been put into place.

(CSPM) Certified Security Project Manager Practice Test

(CSPM) Certified Security Project Manager Practice Test

CSPM CSPM Risk Management & Compliance 1