SSCP Certification SSCP Risk Management Process 5

Question 1

A healthcare organization must comply with HIPAA while managing cybersecurity risks. Which concept describes the influence that regulatory requirements have on acceptable risk levels?

Accepted Answer

Risk tolerance constrained by compliance obligations

Answer

Regulatory requirements like HIPAA define minimum control floors that constrain an organization's risk tolerance, regardless of its internal risk appetite.

Question 2

During a business impact analysis (BIA), which two metrics are established to define recovery objectives for critical systems?

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

Answer

RTO defines how quickly a system must be restored, and RPO defines how much data loss is acceptable — both are core outputs of a BIA.

Question 3

A penetration tester reports that a web application is vulnerable to SQL injection. In the risk management process, this finding is classified as a:

Accepted Answer

Vulnerability

Answer

A SQL injection weakness in the application is a vulnerability — a flaw or weakness that can be exploited by a threat agent to cause harm.

Question 4

An organization outsources its payroll processing to a third-party provider. From a risk management perspective, which obligation does the organization retain?

Accepted Answer

Ultimate accountability for protecting the data processed by the third party

Answer

Organizations cannot outsource accountability — even when processing is delegated to a vendor, the organization remains ultimately responsible for protecting its data.

Question 5

Which term describes the maximum amount of risk loss an organization can sustain without threatening its ability to continue operations?

Accepted Answer

Risk capacity

Answer

Risk capacity is the objective maximum risk an organization can absorb before its survival or core operations are threatened, distinct from the subjective risk appetite.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Risk Management Process 5