GRC Risk Management & Mitigation Strategies 4

Question 1

Which key performance indicator (KPI) in risk management measures how quickly an organization can restore operations after a disruption?

Accepted Answer

Recovery Time Objective (RTO)

Answer

RTO defines the maximum acceptable length of time to restore a business function after an incident.

Question 2

A third-party vendor stores sensitive customer data on behalf of your organization. Which risk category does this primarily represent?

Accepted Answer

Third-party/supply chain risk

Answer

Risks arising from reliance on external vendors or partners are classified as third-party or supply chain risks.

Question 3

In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Accepted Answer

Prepare → Categorize → Select

Answer

NIST RMF begins with Prepare, then Categorize (the system), then Select (security controls), followed by Implement, Assess, Authorize, and Monitor.

Question 4

Which risk mitigation technique involves duplicating critical systems to ensure availability during a failure?

Accepted Answer

Redundancy

Answer

Redundancy reduces the risk of system failure by maintaining backup components or systems that can take over if the primary fails.

Question 5

An organization uses scenario analysis to evaluate risks. What is the primary benefit of this approach?

Accepted Answer

It explores plausible future situations to understand potential impacts

Answer

Scenario analysis helps organizations anticipate various possible futures and evaluate how they would respond, improving preparedness.

(GRC) Governance, Risk, and Compliance Certification Practice Test