Free CGRC Risk Assessment and Management Questions and Answers

Question 1

An updated risk assessment in response to the security control assessment along with inputs from the risk executive helps to determine and prioritize:

Accepted Answer

Initial remediation actions

Answer

Explanation:
An updated risk assessment, particularly in response to security control assessments, often leads to identifying initial remediation actions to address any identified vulnerabilities or weaknesses in the organization's security posture. These actions aim to mitigate risks and improve overall security resilience.

Question 2

What is the purpose of security impact analysis?

Accepted Answer

To determine the extent to which proposed or actual changes to the system or its environment of operation can affect or have affected the system’s security posture

Answer

Explanation:
Security impact analysis aims to assess the potential or actual impact of changes on the security posture of a system or its operational environment. It helps in understanding the risks associated with modifications and enables organizations to make informed decisions to safeguard their security posture.

Question 3

In NIST SP 800-39, risk framing requires that organizations identify:

Accepted Answer

Risk assumption, risk constraints, risk tolerance, and priorities and trade-offs

Answer

Explanation:
According to NIST SP 800-39, risk framing involves identifying risk assumptions, risk constraints, risk tolerance, and priorities and trade-offs. This process helps organizations establish the context for risk management activities and make informed decisions about managing risks effectively.

Question 4

Which key risk term is defined as any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image or reputation), organizational assets, individuals, other organizations or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service?

Accepted Answer

Threat

Answer

Explanation:
In the context of risk assessment and management, a threat is defined as any circumstance or event with the potential to adversely impact organizational operations, assets, individuals, or other entities through unauthorized access, destruction, disclosure, modification of information, or denial of service. Thorough understanding and identification of threats are crucial for effective risk management practices.

Question 5

As identified in NIST SP 800-30, a risk analysis approach can be threat-oriented, vulnerability-oriented and:

Accepted Answer

Asset/impact-oriented

Answer

Explanation:
According to NIST SP 800-30, a risk analysis approach can be threat-oriented, vulnerability-oriented, and asset/impact-oriented. This approach focuses on identifying and assessing risks based on the potential impact on organizational assets and operations, as well as the likelihood of those impacts occurring. It helps organizations prioritize risk mitigation efforts based on the criticality of assets and potential impacts.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

Free CGRC Risk Assessment and Management Questions and Answers