easyMultiple ChoiceObjective-mapped
CISSP Practice Question: During a risk communication session, the security…
During a risk communication session, the security team needs to present risk analysis results to executive management. Which approach is most effective for this audience?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A high-level summary highlighting top risks and recommended actions
Executive management requires concise, strategic summaries that highlight key risks and actionable recommendations, focusing on business impact rather than technical details. Option B is incorrect because raw data lacks interpretation, making it difficult for executives to quickly understand implications. Option C is incorrect as a comprehensive report with all register entries is too lengthy for this audience. Option D is incorrect because detailed technical explanations are better suited for technical teams, not executives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A high-level summary highlighting top risks and recommended actions
Why this is correct
A high-level summary is crucial for executive risk communication as it provides strategic context, prioritizes critical issues, and offers actionable mitigation strategies. This enables informed decision-making regarding resource allocation and risk acceptance without overwhelming leadership with unnecessary operational detail. Such a concise overview aligns perfectly with effective risk governance principles, ensuring strategic alignment.
- ✗
Raw data from the risk assessment without interpretation
Why it's wrong here
Presenting uninterpreted raw data, such as extensive vulnerability scan results or uncontextualized threat intelligence feeds, lacks the necessary business impact analysis and prioritization for executive-level understanding. Executives require synthesized information that translates technical findings into potential financial, operational, or reputational consequences, rather than being expected to perform the detailed analysis themselves. This raw format is not actionable for strategic decision-making.
- ✗
A comprehensive report with all risk register entries
Why it's wrong here
A comprehensive report containing every identified risk register entry, with its detailed description, likelihood, impact, and control status, is an operational tool designed for risk managers, not for strategic executive communication. Presenting such a granular document would overwhelm the audience, obscure the most critical high-priority risks, and hinder effective strategic decision-making by forcing leadership to sift through irrelevant detail.
- ✗
Detailed technical explanations of each vulnerability
Why it's wrong here
Providing detailed technical explanations of individual vulnerabilities, including specific CVEs, exploit vectors, or patch levels, is appropriate for technical teams responsible for remediation and security operations. However, executives require an understanding of the aggregated *business impact* and *organizational risk* posed by these vulnerabilities, not the intricate technical mechanics of each flaw. This level of detail distracts from strategic risk management.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.