SSCP Security Policies & Risk Management 5

Question 1

During a Business Impact Analysis (BIA), the team identifies that a system must be restored within 4 hours after a disaster. This 4-hour window is called the:

Accepted Answer

Recovery Time Objective (RTO)

Answer

The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or process after a disruption.

Question 2

Which of the following BEST describes a compensating control?

Accepted Answer

An alternative control used when the primary control cannot be implemented

Answer

Compensating controls provide equivalent protection when the primary or required control is infeasible due to technical, operational, or business constraints.

Question 3

An information security manager assigns risk ownership to a business unit manager rather than the IT department. What principle does this reflect?

Accepted Answer

Risk ownership belongs to those accountable for the affected business process

Answer

Risk owners are typically the business process owners because they are accountable for the outcomes affected by the risk.

Question 4

A policy states: 'All sensitive data must be encrypted at rest using AES-256.' This is an example of which level of policy documentation?

Accepted Answer

Standard or baseline

Answer

Specific, mandatory technical requirements (like algorithm specifications) are documented in standards, which support higher-level policies.

Question 5

Which risk metric measures the percentage of an asset's value that would be lost in a single threat event?

Accepted Answer

Exposure Factor (EF)

Answer

Exposure Factor (EF) is the percentage of asset value lost in a single realized threat event, used to calculate SLE (SLE = Asset Value × EF).

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Policies & Risk Management 5