SSCP Security Policies & Risk Management 4

Question 1

Which risk analysis approach produces results expressed in monetary terms such as dollar loss per year?

Accepted Answer

Quantitative risk analysis

Answer

Quantitative risk analysis uses mathematical formulas and monetary values (e.g., ALE = SLE × ARO) to express risk in financial terms.

Question 2

An organization's acceptable use policy (AUP) is updated. What must happen before the policy takes effect for existing employees?

Accepted Answer

Employees must be notified and must acknowledge the updated policy

Answer

Employees must be informed of policy changes and provide acknowledgment to ensure the policy is both known and enforceable.

Question 3

In the context of risk management, what does 'risk appetite' mean?

Accepted Answer

The total amount of risk an organization is willing to accept in pursuit of its objectives

Answer

Risk appetite is the board-level statement of how much risk the organization is willing to tolerate while pursuing its strategic goals.

Question 4

A hospital must comply with HIPAA while also meeting state privacy laws that are stricter. Which standard should their security policy follow?

Accepted Answer

The stricter state law, since it provides greater protection

Answer

HIPAA establishes a minimum federal floor; states may enact stricter privacy laws, and organizations must comply with the most stringent applicable requirement.

Question 5

What is the purpose of a control gap analysis in risk management?

Accepted Answer

To identify where current controls fail to meet required security objectives

Answer

A control gap analysis compares current control implementation against requirements or standards to identify deficiencies that need remediation.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Policies & Risk Management 4