ISC Risk Management — 20 Questions

Question 1

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Accepted Answer

Risk Appetite Statement. The Risk Appetite Statement is the foundational document authorized by the board/senior management.

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Incident Response Plan

Question 2

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

Accepted Answer

The business impact of asset unavailability. The risk appetite, defined by leadership, dictates the tolerance for deviations from security standards.

Answer

The vendor's recommended patch cycle

Answer

The threat actor's motivation

Answer

The technical complexity of the vulnerability

Question 3

You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?

Accepted Answer

Inherent Risk multiplied by Control Gap. Residual risk is calculated as Inherent Risk minus the effectiveness of current controls (Control Effectiveness).

Answer

Asset Value multiplied by Threat Frequency

Answer

Compliance Score subtracted from 100

Answer

Total Budget divided by Number of Findings

Question 4

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 5

You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?

Accepted Answer

Real-time CSPM monitoring. Cloud security posture management (CSPM) provides continuous monitoring against compliance and risk frameworks.

Answer

Review of the CSP's website

Answer

One-time penetration test

Answer

Annual SOC 2 Type II review

Question 6

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

Accepted Answer

Threat Event Frequency and Vulnerability. FAIR defines Loss Event Frequency as a function of Threat Event Frequency and Vulnerability. Threat Capability and Threat Event Frequency are primary drivers.

Answer

Primary Loss Magnitude and Secondary Loss Magnitude

Answer

Inherent Risk and Residual Risk

Answer

Control Strength and Asset Valuation

Question 7

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 8

When reporting risk to the Board of Directors, which metric is most effective for demonstrating the value of an investment in a new EDR solution?

Accepted Answer

Reduction in annualized loss expectancy (ALE). Risk reduction is best demonstrated by showing the shift in risk posture (heat map movement) or cost-avoidance metrics.

Answer

Time taken to deploy the agent

Answer

Version number of the security software

Answer

Number of detected malware incidents

Question 9

Which risk response strategy is being employed when a company purchases cyber insurance?

Accepted Answer

Transference. Transferring the financial impact of a risk to a third party is risk transference (sharing).

Answer

Acceptance

Answer

Avoidance

Answer

Mitigation

Question 10

A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?

Accepted Answer

Implement compensating controls. Mitigating the risk (compensating controls) is the standard professional approach when avoidance is not feasible.

Answer

Avoid the risk

Answer

Transfer the risk

Answer

Accept the risk

Question 11

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Accepted Answer

Phishing simulation failure rate. A KRI provides an early signal of increasing risk exposure. Phishing click-through rates measure effectiveness and exposure.

Answer

Total number of employees

Answer

Cost of the email license

Answer

Number of emails received

Question 12

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

Accepted Answer

Determine the effectiveness of controls. In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.

Answer

Authorize the system

Answer

Define the boundary

Answer

Select controls

Question 13

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

Accepted Answer

To inform decision-making by engaging stakeholders. ISO 31000 emphasizes stakeholder engagement throughout the entire risk management process to ensure transparency and accountability.

Answer

To notify the public of breaches

Answer

To assign blame for security failures

Answer

To archive risk records for auditing

Question 14

When executive leadership discusses 'Acceptable Risk', they are referring to:

Accepted Answer

Residual risk within the risk appetite. Acceptable risk is the remaining risk after controls are applied that remains within the organizational risk tolerance.

Answer

Inherent risk before controls

Answer

Zero risk tolerance

Answer

The total budget for security

Question 15

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

Accepted Answer

Inherent risk rating. Risk Rating (often Impact x Likelihood) is necessary to rank risks for treatment.

Answer

Name of the auditor

Answer

Asset owner's email address

Answer

Last modified date

Question 16

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 17

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Accepted Answer

Develop a unified risk assessment framework for the combined entity. Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.

Answer

Ignore the methodologies and rely on external audits

Answer

Force the smaller entity to adopt the larger one's tool

Answer

Keep both and report separately

Question 18

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 19

Which of the following is an example of a detective control in a risk management program?

Accepted Answer

Security Information and Event Management (SIEM) alerts. Detective controls, like logs or monitoring, identify that a risk event has occurred.

Answer

Encryption

Answer

Firewall rules

Answer

Disaster recovery plan

Question 20

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security