ISC Risk Management Practice Test 3 — 15 Questions

Question 1

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

Accepted Answer

Cost-benefit analysis of the proposed treatment. Executives need to understand the cost, the risk reduction, and the business impact to approve funding.

Answer

A list of all software versions running in the data center

Answer

Technical logs of the last 100 failed login attempts

Question 2

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Accepted Answer

Threat intelligence feeds. Risk identification is often driven by systematic reviews (audits/assessments) and data-driven analysis (threat intelligence).

Answer

The annual holiday party schedule

Answer

Automated server patching

Answer

Purchasing more hardware

Question 3

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

Accepted Answer

Legal and contractual liability clauses. Supply chain risk management requires a holistic review of security, legal, and operational/financial health.

Answer

The vendor's office coffee selection

Answer

The color of the vendor's logo

Question 4

Which TWO actions are part of the 'Risk Monitoring' process?

Accepted Answer

Tracking Key Risk Indicators (KRIs). Risk Monitoring is the ongoing process of tracking identified risks, watching for new risks, and evaluating how well risk responses are working, so option A (tracking Key Risk Indicators, or KRIs) is correct because KRIs are the defined metrics used to provide early warning that risk exposure is changing and to trigger escalation when thresholds are breached. Option C (reviewing effectiveness of existing controls) is also correct because Risk Monitoring includes assessing whether the controls and risk responses already in place continue to reduce risk to an acceptable level, which may lead to re-planning or corrective action. The remaining options do not belong: hiring administrative assistants (B) and developing new software from scratch (D) are operational or project-execution activities unrelated to monitoring risk, and changing the company name (E) is a branding decision with no bearing on tracking risks or evaluating controls.

Answer

Hiring new administrative assistants

Answer

Developing new software from scratch

Answer

Changing the company name

Question 5

Which TWO of the following are valid responses to a high-risk finding?

Accepted Answer

Purchase insurance (Transference). Risk treatment options are generally to mitigate, transfer, avoid, or accept.

Answer

Ask the auditor to leave

Answer

Delete all enterprise data

Answer

Ignore the finding until the next budget cycle

Question 6

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Accepted Answer

Integration with existing business processes. ERM is successful when it aligns with the culture, business goals, and organizational structure.

Answer

Replacing all existing staff with security experts

Answer

Purchasing the most expensive security tool available

Question 7

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Accepted Answer

Device patch management capabilities. IoT devices often have poor security (patching challenges), high network exposure, and physical access vulnerabilities.

Answer

The manufacturer's stock price history

Answer

The aesthetic design of the device

Question 8

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

Accepted Answer

Representation from multiple business units. A successful committee needs diverse perspectives, executive support, and a defined mandate.

Answer

Limiting membership to only IT security staff

Answer

Conducting meetings at midnight for secrecy

Question 9

Which THREE of the following are considered 'Risk Assessment' methodologies?

Accepted Answer

NIST SP 800-30. Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.

Answer

HTML 5.0

Answer

TCP/IP protocol

Question 10

Which TWO of the following are common challenges in quantitative risk analysis?

Accepted Answer

High complexity and resource intensity of modeling. Quantitative risk analysis suffers from lack of reliable data and the complexity of modeling.

Answer

It is not allowed by regulatory standards

Answer

The models are too simple to understand

Answer

Quantitative data is always free

Question 11

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Accepted Answer

The replacement cost of the asset. Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.

Answer

The number of hours the system has been running

Answer

The font size used in internal memos

Answer

The age of the server hardware

Question 12

A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?

Accepted Answer

Implement a FAIR (Factor Analysis of Information Risk) methodology to model loss event frequency and loss magnitude.. Quantitative risk analysis methods like FAIR are specifically designed to express risk in monetary terms by modeling loss event frequency and loss magnitude. This allows the CISO to compare cyber risk with other business risks and make informed investment decisions. Qualitative approaches and frameworks like NIST CSF or BIA do not provide the monetary quantification needed for this objective.

Answer

Conduct a business impact analysis (BIA) to determine recovery time objectives for critical systems.

Answer

Adopt a qualitative risk assessment using a 5x5 likelihood and impact matrix to prioritize risks.

Answer

Use the NIST Cybersecurity Framework to categorize risks and map them to controls.

Question 13

A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)

Accepted Answer

Establish a risk governance structure with clear roles and responsibilities for risk management across the organization.. Integrating risk appetite and tolerance into ERM requires clear, board-approved statements that align with strategy, and a governance structure that assigns accountability for applying them. These two actions provide the direction and oversight needed for consistent risk-taking. Training, centralized registers, and scorecards are supportive but do not by themselves ensure integration.

Answer

Integrate risk indicators into business unit performance scorecards to monitor adherence to risk appetite.

Answer

Conduct regular risk awareness training for all employees to ensure they understand the risk management process.

Answer

Implement a centralized risk register that captures all risks from every business unit in a single repository.

Question 14

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?

Accepted Answer

Identifying and evaluating threats and vulnerabilities that could lead to unauthorized disclosure of PHI.. For a telehealth platform storing PHI, the risk assessment must prioritize identifying threats and vulnerabilities that could lead to unauthorized access or disclosure, as required by regulations like HIPAA. Financial, usability, and scalability considerations are secondary and do not directly address the protection of PHI. Thus, the primary focus should be on safeguarding the confidentiality, integrity, and availability of PHI.

Answer

Assessing the scalability of the platform to handle peak patient loads during flu season.

Answer

Evaluating the user interface design to ensure it is intuitive for patients and providers.

Answer

Determining the total cost of ownership for the telehealth platform over the next five years.

Question 15

A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?

Accepted Answer

Recommend funding the program because the residual ALE of $900,000 is below the $1.5 million risk appetite threshold and the control cost is less than the risk reduction.. The treatment is justified because the $1.1M control reduces ALE by $3.3M annually, and the resulting residual ALE of $900,000 falls within the $1.5M appetite. Effective risk management compares the cost of the control to the risk reduction achieved, not to the residual ALE alone, and ensures the residual position aligns with documented tolerance. This option satisfies both economic and governance criteria.

Answer

Recommend funding only if the program can eliminate all residual risk, because any residual ALE above zero violates the risk appetite statement.

Answer

Reject funding because the $1.1 million annual cost exceeds the $900,000 residual ALE, making the program economically unjustified.

Answer

Defer the decision indefinitely because quantitative analysis cannot be used to justify security spending when a risk appetite statement exists.