Risk Management

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

When reporting risk to the Board of Directors, which metric is most effective for demonstrating the value of an investment in a new EDR solution?

Which risk response strategy is being employed when a company purchases cyber insurance?

A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

When executive leadership discusses 'Acceptable Risk', they are referring to:

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

What is the primary objective of a Business Impact Analysis (BIA)?

Which of the following is an example of a detective control in a risk management program?

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

What is the primary function of an 'Exception Process' in a risk management program?

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Which TWO of the following are primary components of a formal Risk Management policy?

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

Which TWO methods are commonly used to identify new risks in an enterprise environment?

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

Which TWO actions are part of the 'Risk Monitoring' process?

Which TWO of the following are valid responses to a high-risk finding?

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

Which THREE of the following are considered 'Risk Assessment' methodologies?

Which TWO of the following are common challenges in quantitative risk analysis?

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?