SSP Risk Evaluation & Management 4

Question 1

Under the NIST Risk Management Framework (RMF), what is the purpose of the 'Authorize' step?

Accepted Answer

A senior official formally accepts the risk of operating an information system based on the implemented controls

Answer

In NIST RMF, the Authorize step requires an Authorizing Official to review residual risk and formally accept it before system operation.

Question 2

A security practitioner is applying ISO 31000 principles. Which statement BEST reflects the standard's view on risk management integration?

Accepted Answer

Risk management should be embedded in all organizational processes and decision-making, not siloed in a security department

Answer

ISO 31000 emphasizes that risk management must be integrated into the organization's governance, strategy, planning, and operations—not treated as a separate function.

Question 3

An organization conducts a Failure Mode and Effects Analysis (FMEA) on a physical access control system. What is the PRIMARY output of this analysis?

Accepted Answer

A prioritized list of failure modes ranked by their severity, occurrence frequency, and detectability

Answer

FMEA produces a risk priority number (RPN) for each failure mode by combining severity, occurrence, and detection ratings to drive mitigation priorities.

Question 4

A practitioner is evaluating supply chain risk. A critical vendor processes sensitive personnel data. The vendor's SOC 2 Type II report is 18 months old. What risk does this present?

Accepted Answer

The report may not reflect the vendor's current control environment, leaving undetected gaps

Answer

An 18-month-old SOC 2 report may not capture control changes, incidents, or new risks, creating uncertainty about current control effectiveness.

Question 5

When applying the 'bowtie' risk analysis model, what do the LEFT side and RIGHT side of the bowtie represent respectively?

Accepted Answer

Threat sources and causes (left) versus consequences and impacts (right), with the 'knot' being the risk event

Answer

The bowtie model maps causes and threats on the left, the unwanted event at the center knot, and consequences with recovery controls on the right.

(SSP) Safety and Security Practitioner Certification Practice Test

(SSP) Safety and Security Practitioner Certification Practice Test

SSP Risk Evaluation & Management 4