ISC Risk Management Practice Test 2 — 15 Questions

Question 1

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 2

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Accepted Answer

Develop a unified risk assessment framework for the combined entity. Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.

Answer

Ignore the methodologies and rely on external audits

Answer

Force the smaller entity to adopt the larger one's tool

Answer

Keep both and report separately

Question 3

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 4

Which of the following is an example of a detective control in a risk management program?

Accepted Answer

Security Information and Event Management (SIEM) alerts. Detective controls, like logs or monitoring, identify that a risk event has occurred.

Answer

Encryption

Answer

Firewall rules

Answer

Disaster recovery plan

Question 5

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security

Question 6

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Accepted Answer

Single Loss Expectancy. The Single Loss Expectancy (SLE) is the monetary value of a single loss event.

Answer

Security Loss Estimate

Answer

System Level Exposure

Answer

Serious Loss Evaluation

Question 7

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Accepted Answer

Implement a multi-cloud strategy. Multi-cloud or hybrid-cloud strategies are the primary methods to reduce concentration risk (dependence on a single provider).

Answer

Move all data to a private data center

Answer

Enable two-factor authentication

Answer

Increase the number of security analysts

Question 8

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

Accepted Answer

The Business Process Owner. The Business Process Owner is the ultimate owner of the risk and must accept the residual risk.

Answer

The IT helpdesk manager

Answer

The external auditor

Answer

The HR department

Question 9

What is the primary function of an 'Exception Process' in a risk management program?

Accepted Answer

To manage temporary deviations from security standards. An exception process allows for documented, time-bound deviations from security standards when compliance cannot be met immediately.

Answer

To bypass the change management process

Answer

To punish non-compliant employees

Answer

To permanently ignore security policies

Question 10

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 11

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Accepted Answer

The relative prioritization of risks across the enterprise. A heat map visualizes the distribution of risks based on likelihood and impact, helping board members prioritize investment.

Answer

The history of past audit findings

Answer

The exact cost of every security control

Answer

Technical vulnerability lists

Question 12

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 13

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

Accepted Answer

Risk assessment considers business context and impact. A vulnerability assessment finds technical flaws; a risk assessment determines the business impact and likelihood of those flaws being exploited.

Answer

There is no difference

Answer

Risk assessment is only for physical assets

Answer

Vulnerability assessment is only for executive level

Question 14

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of the vendor's security controls over time.

Answer

The vendor's sales brochure

Answer

The vendor's stock ticker symbol

Answer

The vendor's customer list

Question 15

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

Accepted Answer

Cost-benefit analysis of the proposed treatment. Executives need to understand the cost, the risk reduction, and the business impact to approve funding.

Answer

A list of all software versions running in the data center

Answer

Technical logs of the last 100 failed login attempts