Risk Management

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)

A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

When executive leadership discusses 'Acceptable Risk', they are referring to:

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The risk team has identified that the platform's encryption at rest uses a deprecated algorithm. The vendor cannot upgrade the algorithm for another six months due to contractual constraints. Which of the following is the BEST risk response?

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Which risk response strategy is being employed when a company purchases cyber insurance?

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

A multinational corporation is implementing an Enterprise Risk Management (ERM) program. The Chief Risk Officer wants to ensure that risk management is integrated into strategic planning. Which of the following activities best demonstrates this integration?

Which of the following is an example of a detective control in a risk management program?

A healthcare organization is integrating risk management into its enterprise architecture practice. The Chief Risk Officer (CRO) wants to ensure that new technology initiatives are evaluated for risk before funding is approved. Which activity best demonstrates that risk management is embedded in the architecture governance process?

A security manager is developing a risk treatment plan for a critical vulnerability in a web application. The vulnerability allows remote code execution and has a high likelihood of exploitation. The organization has a low risk appetite. Which TWO of the following are the MOST appropriate risk treatment options to consider? (Choose two.)

A software development company is integrating risk management into its DevOps pipeline. The security team wants to implement a control that automatically scans code for vulnerabilities before deployment. Which of the following best describes this type of control in the context of risk management?

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

A global financial services firm is expanding its enterprise risk management (ERM) program to include third-party risk. The CISO wants to ensure that the risk appetite for third-party relationships is consistently applied across all business units. Which of the following is the MOST effective way to achieve this?

A multinational corporation is integrating its risk management program with its supply chain management. The CISO wants to ensure that risk assessments are performed consistently for all suppliers. Which of the following is the MOST important factor to consider when defining the risk assessment criteria?

A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

A security manager is presenting a risk register to the executive committee. One risk item shows a high likelihood and high impact, but the risk owner has proposed a treatment plan that requires significant funding. The executive committee asks for justification. Which of the following is the BEST approach to justify the investment?

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

What is the primary function of an 'Exception Process' in a risk management program?

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Which TWO of the following are primary components of a formal Risk Management policy?

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Which TWO of the following are common challenges in quantitative risk analysis?

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

A global retailer is expanding its risk management program to include third-party vendors. The Chief Information Security Officer (CISO) is concerned about supply chain risks. Which TWO of the following are the most effective controls to mitigate third-party risk? (Choose two.)

Which TWO actions are part of the 'Risk Monitoring' process?

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

What is the primary objective of a Business Impact Analysis (BIA)?

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

A financial services firm uses a risk matrix with likelihood and impact scales. During a risk assessment, the team identifies a new vulnerability in a core banking application. The likelihood is rated as 'Possible' (3 on a 1-5 scale) and the impact as 'Major' (4 on a 1-5 scale). The organization's risk appetite statement says that risks with a score of 12 or higher require immediate treatment. What is the risk score and what action should be taken?

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Which THREE of the following are considered 'Risk Assessment' methodologies?

Which TWO of the following are valid responses to a high-risk finding?