KSA Risk Management & Assessment 5

Question 1

Which U.S. framework from NIST organizes federal risk management into steps such as categorize, select, implement, assess, authorize, and monitor?

Accepted Answer

Risk Management Framework (RMF, SP 800-37)

Answer

NIST SP 800-37 defines the Risk Management Framework used across federal information systems.

Question 2

Which of the following best describes 'risk appetite'?

Accepted Answer

The amount of risk an organization is willing to pursue to achieve its objectives

Answer

Risk appetite is the broad level of risk an organization is prepared to accept in pursuit of its goals.

Question 3

Why should risk communication be tailored to different audiences?

Accepted Answer

Executives need decision-focused summaries while operational staff need actionable details

Answer

Different stakeholders need different levels of detail to make decisions or take action.

Question 4

Key risk indicators (KRIs) are primarily used to:

Accepted Answer

Provide early warning that risk exposure is rising toward tolerance limits

Answer

KRIs are metrics that signal changes in risk exposure, allowing proactive action before limits are breached.

Question 5

The 'three lines' model of risk governance places which function as the second line?

Accepted Answer

Risk management and compliance oversight functions

Answer

The second line includes risk and compliance functions that oversee and support first-line management.

KSA - Knowledge, Skills, and Abilities Practice Test