GRC Risk Management & Mitigation Strategies 5

Question 1

Which document formally authorizes an information system to operate despite known risks?

Accepted Answer

Authorization to Operate (ATO)

Answer

An ATO is a formal decision by an authorizing official to accept the risk of operating a system based on the implemented security controls.

Question 2

A company discovers that a firewall misconfiguration has been present for six months. Which risk metric best measures how long the vulnerability was exposed?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

MTTD measures the average time between when a vulnerability or incident occurs and when it is discovered.

Question 3

In risk management, 'threat modeling' is best described as:

Accepted Answer

A structured process for identifying, enumerating, and prioritizing potential threats to a system

Answer

Threat modeling proactively identifies threats, vulnerabilities, and countermeasures during design or assessment to improve security posture.

Question 4

Which risk response strategy is most appropriate when a risk has very low likelihood and very low impact?

Accepted Answer

Accept

Answer

Low-likelihood, low-impact risks are typically accepted because the cost of treating them outweighs the expected loss.

Question 5

A GRC analyst maps controls to specific risks to demonstrate coverage. This activity is known as:

Accepted Answer

Control mapping

Answer

Control mapping links individual security or compliance controls to the specific risks they address, helping identify gaps and redundancies.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Risk Management & Mitigation Strategies 5