ISC Risk Management Practice Test 2 — 15 Questions

Question 1

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

Accepted Answer

Inherent risk rating. The inherent risk rating is essential for effective risk prioritization because it represents the level of risk before any controls are applied, allowing the organization to compare risks on a consistent scale and decide which ones require treatment first. Without an inherent risk rating, the risk register cannot meaningfully rank risks by severity or likelihood.

Answer

Name of the auditor

Answer

Asset owner's email address

Answer

Last modified date

Question 2

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 3

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Accepted Answer

Develop a unified risk assessment framework for the combined entity. Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.

Answer

Ignore the methodologies and rely on external audits

Answer

Force the smaller entity to adopt the larger one's tool

Answer

Keep both and report separately

Question 4

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 5

Which of the following is an example of a detective control in a risk management program?

Accepted Answer

Security Information and Event Management (SIEM) alerts. Detective controls, like logs or monitoring, identify that a risk event has occurred.

Answer

Encryption

Answer

Firewall rules

Answer

Disaster recovery plan

Question 6

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security

Question 7

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Accepted Answer

Single Loss Expectancy. The Single Loss Expectancy (SLE) is the monetary value of a single loss event.

Answer

Security Loss Estimate

Answer

System Level Exposure

Answer

Serious Loss Evaluation

Question 8

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Accepted Answer

Implement a multi-cloud strategy. Multi-cloud or hybrid-cloud strategies are the primary methods to reduce concentration risk (dependence on a single provider).

Answer

Move all data to a private data center

Answer

Enable two-factor authentication

Answer

Increase the number of security analysts

Question 9

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

Accepted Answer

The Business Process Owner. The Business Process Owner (C) is the stakeholder who owns the business process and its risk, has authority to accept residual risk, and can confirm that the mitigation aligns with business objectives. Risk sign-off must come from the risk owner — the person accountable for the process — not from technical or support functions.

Answer

The IT helpdesk manager

Answer

The external auditor

Answer

The HR department

Question 10

What is the primary function of an 'Exception Process' in a risk management program?

Accepted Answer

To manage temporary deviations from security standards. An exception process allows for documented, time-bound deviations from security standards when compliance cannot be met immediately.

Answer

To bypass the change management process

Answer

To punish non-compliant employees

Answer

To permanently ignore security policies

Question 11

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 12

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Accepted Answer

The relative prioritization of risks across the enterprise. A Risk Heat Map plots risks on a grid of likelihood versus impact (or similar axes) with color coding, giving the board a visual, prioritized view of which risks matter most across the enterprise. It communicates relative prioritization, not raw technical detail or financial precision. This makes it an executive-level communication tool rather than an operational one.

Answer

The history of past audit findings

Answer

The exact cost of every security control

Answer

Technical vulnerability lists

Question 13

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 14

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

Accepted Answer

Risk assessment considers business context and impact. A vulnerability assessment finds technical flaws; a risk assessment determines the business impact and likelihood of those flaws being exploited.

Answer

There is no difference

Answer

Risk assessment is only for physical assets

Answer

Vulnerability assessment is only for executive level

Question 15

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of the vendor's security controls over time.

Answer

The vendor's sales brochure

Answer

The vendor's stock ticker symbol

Answer

The vendor's customer list