CTO IT Governance & Risk Management 3

Question 1

Under ISO/IEC 27001, what is the purpose of a Statement of Applicability (SoA)?

Accepted Answer

To list all controls selected or excluded and provide justification for each

Answer

The SoA documents which Annex A controls are applicable and implemented, which are excluded, and the justifications for all inclusion/exclusion decisions.

Question 2

A CTO must prioritize IT investments under budget constraints. Which governance tool best facilitates transparent prioritization based on business value and risk?

Accepted Answer

IT portfolio management framework

Answer

IT portfolio management provides a structured approach to evaluating, prioritizing, and balancing IT investments based on strategic value, cost, and risk.

Question 3

What distinguishes a Key Risk Indicator (KRI) from a Key Performance Indicator (KPI)?

Accepted Answer

KRIs provide early warning signals of increasing risk exposure while KPIs measure achievement against targets

Answer

KRIs are forward-looking metrics that signal potential risk before it materializes, whereas KPIs measure how well current objectives are being achieved.

Question 4

In NIST SP 800-37 (Risk Management Framework), which step involves categorizing information systems based on the potential impact of a security breach?

Accepted Answer

Categorize

Answer

The Categorize step uses FIPS 199 criteria to classify systems by the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Question 5

Which governance concept requires that no single individual controls all phases of a critical transaction or process?

Accepted Answer

Separation of duties

Answer

Separation of duties divides critical tasks among multiple individuals to reduce fraud risk and errors by ensuring no one person can complete a sensitive transaction alone.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO IT Governance & Risk Management 3