Risk Management

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

When executive leadership discusses 'Acceptable Risk', they are referring to:

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

When reporting risk to the Board of Directors, which metric is most effective for demonstrating the value of an investment in a new EDR solution?

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Which risk response strategy is being employed when a company purchases cyber insurance?

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

Which of the following is an example of a detective control in a risk management program?

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

What is the primary function of an 'Exception Process' in a risk management program?

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Which TWO of the following are primary components of a formal Risk Management policy?

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Which TWO of the following are common challenges in quantitative risk analysis?

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Which TWO actions are part of the 'Risk Monitoring' process?

You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

What is the primary objective of a Business Impact Analysis (BIA)?

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Which THREE of the following are considered 'Risk Assessment' methodologies?

Which TWO of the following are valid responses to a high-risk finding?