CCOA Cybersecurity Principles And Risk Practice Test 4 — 15 Questions

Question 1

A retail bank's security team is classifying a new customer-facing mobile application. The application stores no cardholder data but processes internal marketing statistics. The team must decide whether to apply the same security controls as the core banking platform or a lighter control set. Which activity should occur FIRST to make this decision defensible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an information asset owner to classify the application and its data by sensitivity and criticality.. Classification by the accountable asset owner is the foundational governance step that determines how much protection an asset requires. Sensitivity, criticality, and regulatory scope drive the control baseline, so the owner's decision must precede scanning, control deployment, or change approval. Once classification is documented, lighter controls can be justified and defended during audits.

Answer

Deploy the same controls used for the core banking platform to eliminate residual risk.

Answer

Perform a vulnerability scan against the mobile application to determine its exposure level.

Answer

Submit a change request to the change advisory board describing the lighter control set.

Question 2

A financial services firm wants to reduce the likelihood that a former employee can use still-valid credentials to access internal systems after termination. Which administrative control should the security team implement FIRST?

Accepted Answer

Establish a formal offboarding procedure that disables accounts immediately upon termination.. The most direct way to prevent a former employee from using valid credentials is to ensure those credentials are disabled as part of a formal offboarding process. Administrative controls such as documented procedures govern how and when accounts are revoked. Technical measures like PAM, MFA, and segmentation are useful but do not replace timely account deactivation.

Answer

Implement network segmentation to isolate internal systems from remote access.

Answer

Deploy a privileged access management (PAM) solution to vault administrator credentials.

Answer

Enable multi-factor authentication (MFA) for all internal system logins.

Question 3

A CCOA analyst is building a threat model for a new API gateway that exposes internal microservices to partner organizations. The analyst wants to prioritize threats using a methodology that combines adversary capability, intent, and opportunity against the organization's specific attack surface. Which approach best fits this requirement?

Accepted Answer

PASTA (Process for Attack Simulation and Threat Analysis) seven-stage methodology. PASTA was designed precisely to blend business impact with attacker behavior. Its stages move from business objectives through technical scope, application decomposition, threat analysis, vulnerability analysis, attack modeling, and risk impact analysis. Because it explicitly weighs adversary capability, intent, and opportunity against the exposed attack surface of the API gateway, it delivers prioritized, business-aligned threats rather than a flat enumeration.

Answer

MITRE ATT&CK Navigator mapping of relevant techniques to the gateway

Answer

STRIDE per element applied to each microservice data flow diagram

Answer

OCTAVE Allegro with information asset profiling workshops

Question 4

During a risk assessment, an analyst determines that a legacy payroll application has a vulnerability that could allow remote code execution. The vendor no longer issues patches, and the application is required for monthly payroll runs. The CISO accepts the residual risk and documents the decision. Which risk treatment option has the organization chosen?

Accepted Answer

Risk acceptance. When an organization acknowledges a risk and formally decides to retain it after weighing treatment options, the chosen response is risk acceptance. Avoidance would require eliminating the payroll application, transfer would shift impact to a third party, and mitigation would add controls. The documented CISO decision confirms acceptance of residual risk.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 5

A multinational retailer must demonstrate to auditors that its security program aligns with a recognized framework for managing cybersecurity risk. The CISO wants a framework that provides a common language for communicating risk to executives and is widely accepted across industries. Which framework best meets this need?

Accepted Answer

NIST Cybersecurity Framework (CSF). The NIST CSF was created to give organizations a common language for understanding and communicating cybersecurity risk. Its five core functions (Identify, Protect, Detect, Respond, Recover) map easily to executive reporting and can be used alongside standards like ISO 27001 or PCI DSS. This makes it the best fit for aligning the program and communicating with leadership.

Answer

PCI DSS

Answer

COBIT 2019

Answer

ISO/IEC 27001

Question 6

A hospital's risk register lists ransomware against its electronic health record system with a likelihood of 'High' and an impact of 'Critical' on a five-point qualitative scale. The CISO must select a treatment option that reduces the residual risk to an acceptable level while preserving clinical availability. Which treatment approach BEST fits this scenario?

Accepted Answer

Mitigate the risk with layered controls such as immutable offline backups, network segmentation, and tested recovery procedures.. Because ransomware against clinical systems threatens both data and availability, the appropriate treatment is mitigation through layered preventive and recovery controls. Immutable offline backups remove the attacker's leverage, segmentation constrains spread, and tested recovery preserves patient care. Acceptance, pure transfer, and avoidance all fail to reduce the operational impact the hospital cannot tolerate.

Answer

Avoid the risk by disconnecting the electronic health record system from all external networks permanently.

Answer

Accept the risk because the electronic health record vendor contractually guarantees system uptime.

Answer

Transfer the risk entirely by purchasing a cyber insurance policy covering ransomware incidents.

Question 7

A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)

Accepted Answer

Impact or severity to business operations if the risk materializes. Qualitative risk matrices rank risks by combining likelihood and impact using descriptive scales. These two factors allow prioritization without monetary calculations. ALE, NPV, and ROSI are quantitative or financial metrics that require monetary inputs, so they fall outside the scope of a qualitative assessment focused on relative ranking.

Answer

Net present value (NPV) of the CRM investment

Answer

Return on security investment (ROSI) percentage

Answer

Annualized loss expectancy (ALE) in monetary terms

Question 8

A multinational retailer must comply with a regulation requiring that personal data of European customers not be transferred to countries lacking an adequate level of data protection. The security team is asked to identify the primary principle that governs this restriction. Which principle applies?

Accepted Answer

Data sovereignty and cross-border transfer restrictions. The regulation restricts transferring personal data to jurisdictions without adequate protection, which is the principle of data sovereignty combined with cross-border transfer rules. Data minimization, purpose limitation, and storage limitation are separate privacy principles addressing collection scope, use purpose, and retention duration rather than geographic transfer.

Answer

Data minimization

Answer

Storage limitation

Answer

Purpose limitation

Question 9

A software company operates a continuous integration pipeline where developers can push code directly to production branches. A recent post-incident review found that a single compromised developer credential allowed malicious code to reach customers. Which change to the pipeline's control environment MOST directly reduces this specific risk?

Accepted Answer

Require peer review and automated security testing before any code can merge into production branches.. The incident stemmed from unreviewed code reaching production through valid credentials, so the most direct fix is a mandatory verification gate before merge. Peer review plus automated security testing prevents a compromised credential from deploying malicious changes. Scanning cadence, rotation, and logging improve visibility or hygiene but do not block the deployment path that caused customer impact.

Answer

Increase the frequency of static application security testing scans across all repositories.

Answer

Rotate all developer credentials every ninety days and enforce a stronger password complexity policy.

Answer

Enable verbose logging on the production branch so all pushes are recorded for later forensic review.

Question 10

A multinational retailer is expanding into a new country and must comply with that country's data protection law, which requires personal data of citizens to remain within national borders. The security team is asked to recommend an architecture that satisfies this requirement while still allowing the global analytics team to process aggregated, non-personal data. Which approach BEST meets these constraints?

Accepted Answer

Deploy a local data center or in-country cloud region for personal data and replicate only anonymized or aggregated datasets to the global analytics platform.. Data localization laws require personal data to remain within national borders. The only approach that satisfies this while enabling global analytics is to keep personal data in-country and share only anonymized or aggregated datasets externally. Contractual clauses, encryption with local keys, and CDN caching do not change where the data resides and therefore fail the requirement.

Answer

Use a content delivery network (CDN) to cache personal data at edge locations closest to citizens.

Answer

Store all personal data in the retailer's existing global cloud region and rely on standard contractual clauses for transfers.

Answer

Encrypt personal data with customer-managed keys and store it in the global cloud region, providing keys only to local staff.

Question 11

A security operations analyst is reviewing a risk register entry for a web application vulnerability. The entry shows a high likelihood and high impact, but the business owner has decided to accept the risk because the application is scheduled for decommissioning in two months. Which risk treatment strategy is being applied?

Accepted Answer

Risk acceptance. The business owner has acknowledged the risk and chosen to retain it because the application will be decommissioned soon. This is risk acceptance, where no additional controls are applied and the organization tolerates the exposure. Avoidance would remove the system, transference would shift liability, and mitigation would add controls, none of which match the scenario.

Answer

Risk mitigation

Answer

Risk transference

Answer

Risk avoidance

Question 12

A financial services firm is updating its risk management program and wants to strengthen how it treats risks that fall outside its risk appetite. The board has asked which activities are core components of a formal risk treatment process. (Choose two.)

Accepted Answer

Selecting treatment options such as mitigation, transfer, avoidance, or acceptance for each identified risk.. Risk treatment centers on deciding how each identified risk will be handled and ensuring someone owns that decision through implementation and monitoring. Selecting among mitigation, transfer, avoidance, and acceptance, paired with an accountable risk owner, constitutes the treatment process. Appetite definition, asset inventory, and penetration testing are important but belong to governance, identification, and assurance rather than treatment.

Answer

Establishing the organization's risk appetite and tolerance thresholds before any assessment begins.

Answer

Compiling the full inventory of information assets and their dependencies across the enterprise.

Answer

Performing penetration testing against all internet-facing systems on a quarterly schedule.

Question 13

A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)

Accepted Answer

It is expressed in qualitative and quantitative terms tied to measurable thresholds. Effective risk appetite statements are measurable and executive-owned. Measurable thresholds let decision-makers judge whether a specific exposure sits inside or outside tolerance, while executive and board ownership ensures appetite reflects strategy and regulatory duty. For a hospital, that combination properly weights patient safety and HIPAA obligations against availability and cost trade-offs.

Answer

It is kept confidential and shared only with the security operations team

Answer

It eliminates all residual risk across clinical and administrative systems

Answer

It is revised annually regardless of changes in business strategy

Question 14

An organization's risk register shows a customer database risk with an annualized loss expectancy of $240,000. A proposed data loss prevention and encryption program costs $90,000 per year and is expected to reduce annualized loss expectancy to $60,000. The CFO asks whether the investment is justified on a purely quantitative basis. What should the analyst report?

Accepted Answer

The program is justified because it reduces annualized loss expectancy by $180,000, which exceeds the $90,000 annual cost.. Quantitative justification compares the annual cost of a control against the annualized loss expectancy it removes. Here the program cuts expected loss from $240,000 to $60,000, a $180,000 reduction that comfortably exceeds the $90,000 cost, leaving a positive net benefit. Residual-loss comparisons and invented thresholds misapply the cost-benefit method.

Answer

The program cannot be evaluated quantitatively because encryption benefits are inherently qualitative.

Answer

The program is not justified because the $90,000 cost exceeds the $60,000 residual annualized loss expectancy.

Answer

The program is justified because any control that lowers annualized loss expectancy below $100,000 is automatically cost-effective.

Question 15

A CCOA analyst is evaluating a third-party SaaS vendor that will process regulated financial data. The vendor's SOC 2 Type II report covers security and availability but excludes confidentiality. The contract includes a right-to-audit clause and a 24-hour breach notification requirement. Which remaining action is MOST important to close the assurance gap?

Accepted Answer

Obtain a SOC 2 Type II report covering the confidentiality trust services criterion. The vendor already provides Type II attestation for security and availability, so the missing element is period-based, independently tested assurance over confidentiality. A SOC 2 Type II report scoped to the confidentiality criterion supplies that evidence and aligns with due diligence expectations for regulated financial data. Contract clauses and management-system certificates do not demonstrate tested operating effectiveness.

Answer

Accept the vendor's ISO/IEC 27001 certificate as equivalent coverage

Answer

Rely on the contractual right-to-audit clause as sufficient assurance

Answer

Request the vendor complete a SOC 2 Type I report for the confidentiality criterion