SSCP Security Policies & Risk Management 3

Question 1

A company outsources its payroll processing to a third-party vendor. The company retains full legal liability for data breaches. Which risk response strategy does this represent?

Accepted Answer

Risk transfer (partial)

Answer

Outsourcing operational risk to a vendor is risk transfer, but legal/regulatory liability often remains with the originating organization, making it only partial transfer.

Question 2

Which element is MOST critical when developing a security policy to ensure it is enforceable?

Accepted Answer

Senior management sponsorship and authorization

Answer

Policies require senior management authorization to carry organizational authority and be legally enforceable within the enterprise.

Question 3

What is the difference between a threat and a vulnerability in risk management?

Accepted Answer

A threat is a potential harm event; a vulnerability is a weakness that could be exploited

Answer

A threat is any circumstance that could cause harm, while a vulnerability is a flaw or weakness that a threat could exploit.

Question 4

An organization reviews its risk register every quarter. A previously accepted risk now has a higher likelihood due to a new exploit. What action should be taken first?

Accepted Answer

Re-evaluate the risk using updated threat intelligence

Answer

Changed threat conditions require re-evaluation of the risk's likelihood and impact before determining the appropriate response.

Question 5

Which framework specifically provides a five-step Risk Management Framework (RMF) process used by US federal agencies?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 defines the Risk Management Framework used by US federal agencies for categorizing, selecting, implementing, and authorizing information systems.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Policies & Risk Management 3