ISC Risk Management Practice Test 1 — 15 Questions

Question 1

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

Accepted Answer

The business impact of asset unavailability. The risk appetite, defined by leadership, dictates the tolerance for deviations from security standards.

Answer

The vendor's recommended patch cycle

Answer

The threat actor's motivation

Answer

The technical complexity of the vulnerability

Question 2

You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?

Accepted Answer

Inherent Risk multiplied by Control Gap. Residual risk is defined as the risk remaining after management implements controls (Inherent Risk minus Control Effectiveness or Inherent Risk multiplied by (1 - Control Effectiveness)). Option D is mathematically flawed and the explanation fails to justify it.

Answer

Asset Value multiplied by Threat Frequency

Answer

Compliance Score subtracted from 100

Answer

Total Budget divided by Number of Findings

Question 3

You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?

Accepted Answer

Real-time CSPM monitoring. Continuous assessment of a cloud service provider requires ongoing, real-time visibility into the CSP's security posture, which CSPM (Cloud Security Posture Management) monitoring provides by continuously scanning configurations, detecting drift, and flagging misconfigurations. Unlike point-in-time reviews or static documents, CSPM delivers the continuous assurance needed for third-party risk management in dynamic cloud environments. This makes it the most appropriate tool for ongoing CSP assessment.

Answer

Review of the CSP's website

Answer

One-time penetration test

Answer

Annual SOC 2 Type II review

Question 4

When reporting risk to the Board of Directors, which metric is most effective for demonstrating the value of an investment in a new EDR solution?

Accepted Answer

Reduction in annualized loss expectancy (ALE). Risk reduction is best demonstrated by showing the shift in risk posture (heat map movement) or cost-avoidance metrics.

Answer

Time taken to deploy the agent

Answer

Version number of the security software

Answer

Number of detected malware incidents

Question 5

A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?

Accepted Answer

Implement compensating controls. Implementing compensating controls (such as network segmentation, access controls, or monitoring) is a method of risk mitigation. However, when a system cannot be replaced and must continue operating with unencrypted PII, and controls are implemented to reduce the residual risk, this scenario often points to risk mitigation, but strictly speaking, if the risk cannot be fully mitigated to an acceptable level, organizations sometimes accept the risk with management approval, OR implement compensating controls to mitigate the impact. Let's correct the explanation to properly justify mitigating the risk via compensating controls.

Answer

Avoid the risk

Answer

Transfer the risk

Answer

Accept the risk

Question 6

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Accepted Answer

Phishing simulation failure rate. A Key Risk Indicator (KRI) is a metric used to provide an early signal of increasing risk exposure in an area of the business. A phishing simulation failure rate directly correlates to the risk of a successful social engineering attack, making it a valid KRI. The explanation should clarify that it measures the likelihood of a security incident occurring.

Answer

Total number of employees

Answer

Cost of the email license

Answer

Number of emails received

Question 7

A healthcare insurer's risk register lists a data center flood as a risk with an Annualized Loss Expectancy (ALE) of $200,000. The Chief Risk Officer decides to purchase an insurance policy with an annual premium of $50,000 and a $100,000 deductible. What is the residual risk, expressed as an expected annual loss, assuming the insurer retains the deductible portion of any loss?

Accepted Answer

$100,000. The correct answer is the retained loss equal to the deductible. In quantitative risk analysis, residual risk is the expected loss that remains after applying a control. Insurance transfers the catastrophic portion but leaves the deductible with the organization. With an ALE of $200,000 and a $100,000 deductible, the organization retains $100,000 in expected annual loss, making that the residual risk.

Answer

$200,000

Answer

$50,000

Answer

$150,000

Question 8

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Accepted Answer

Risk Appetite Statement. The Risk Appetite Statement is the foundational document authorized by the board/senior management.

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Incident Response Plan

Question 9

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 10

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

Accepted Answer

Threat Event Frequency and Vulnerability. In the FAIR framework, Loss Event Frequency (LEF) is calculated from Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). The formula is LEF = TEF × Vulnerability. Therefore, the required inputs are Threat Event Frequency and Vulnerability.

Answer

Primary Loss Magnitude and Secondary Loss Magnitude

Answer

Inherent Risk and Residual Risk

Answer

Control Strength and Asset Valuation

Question 11

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 12

Which risk response strategy is being employed when a company purchases cyber insurance?

Accepted Answer

Transference. Purchasing cyber insurance transfers the financial impact of a risk to a third party (the insurer) in exchange for a premium, which is the textbook definition of the Transference (or Transfer) risk response. The organization retains the risk event's operational consequences but shifts the monetary loss. Acceptance, avoidance, and mitigation describe different responses and do not match the insurance mechanism.

Answer

Acceptance

Answer

Avoidance

Answer

Mitigation

Question 13

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

Accepted Answer

Determine the effectiveness of controls. In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.

Answer

Authorize the system

Answer

Define the boundary

Answer

Select controls

Question 14

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

Accepted Answer

To inform decision-making by engaging stakeholders. ISO 31000 emphasizes stakeholder engagement throughout the entire risk management process to ensure transparency and accountability.

Answer

To notify the public of breaches

Answer

To assign blame for security failures

Answer

To archive risk records for auditing

Question 15

When executive leadership discusses 'Acceptable Risk', they are referring to:

Accepted Answer

Residual risk within the risk appetite. Acceptable risk is the remaining risk after controls are applied that remains within the organizational risk tolerance.

Answer

Inherent risk before controls

Answer

Zero risk tolerance

Answer

The total budget for security