Free CGRC Risk Assessment and Management Questions and Answers

Question 1

An updated risk assessment in response to the security control assessment along with inputs from the risk executive helps to determine and prioritize:

Accepted Answer

Initial remediation actions

Answer

Plan of action and milestones

Answer

Failed controls

Answer

Control reassessments

Question 2

What is the purpose of security impact analysis?

Accepted Answer

To determine the extent to which proposed or actual changes to the system or its environment of operation can affect or have affected the system’s security posture

Answer

To determine the level of impact of the violation of the confidentiality of PII

Answer

To determine if the information system processes PII

Answer

None of the above

Question 3

In NIST SP 800-39, risk framing requires that organizations identify:

Accepted Answer

Risk assumption, risk constraints, risk tolerance, and priorities and trade-offs

Answer

Risk assumption, risk constraints, and risk tolerance

Answer

Risk planning, risk methodology, risk tolerance, and risk management

Answer

Risk planning, risk methodology, and risk tolerance

Question 4

Which key risk term is defined as any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image or reputation), organizational assets, individuals, other organizations or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service?

Accepted Answer

Threat

Answer

Vulnerability

Answer

Impact

Answer

Risk determination

Question 5

As identified in NIST SP 800-30, a risk analysis approach can be threat-oriented, vulnerability-oriented and:

Accepted Answer

Asset/impact-oriented

Answer

Impact-oriented

Answer

Mitigation-oriented

Answer

Likelihood-oriented

Question 6

A condition that exists within an organization, a mission or business process, enterprise architecture, information system or environment of operation is known as:

Accepted Answer

A predisposing condition

Answer

A risk

Answer

An impact

Answer

A consequence

Question 7

The RMF starting point for architectural description includes the subcomponent of system boundaries, which represents what intended system?

Accepted Answer

The systems that are immediately adjacent to the intended system

Answer

The system is overseen by the information system owner

Answer

All other systems within the organization

Answer

The system is owned by the authorizing official

Question 8

Why is security control volatility an important consideration in the development of a security control monitoring strategy?

Accepted Answer

It establishes priority for security control monitoring.

Answer

It identifies needed security control monitoring exceptions.

Answer

It indicates a need for compensating controls.

Answer

It provides justification for revisions to the configuration management and control plan.

Question 9

In which phase of the NIST SP 800-30 process does one produce the Risk Assessment Report (RAR)?

Accepted Answer

Results Documentation

Answer

Future Control Recommendations

Answer

Control Analysis

Answer

Impact Analysis

Question 10

Which phase of the NIST SP 800-30 process would most likely use the CVE database?

Accepted Answer

Vulnerability Identification

Answer

Future Control Recommendations

Answer

Impact Analysis

Answer

Control Analysis