Question 1

Which of the following risks relates to negative public opinion?

Accepted Answer

A)   Operational risk
B)   Strategic risk
C)   Financial risk
D)   Reputational riskE) All of the above
F) C) and D)

Question 2

Which of the following is the leading membership organization for Boards and Directors in the U.S.?

Accepted Answer

A)   ISO
B)   NIST
C)   CERT
D)   NACDE) A) and B)
F) A) and C)

Question 3

Which of the following best describes residual risk?

Accepted Answer

A)   The likelihood of occurrence of a threat
B)   The level of risk before security measures are applied
C)   The level of risk after security measures are applied
D)   The impact of risk if a threat is realizedE) A) and B)
F) A) and C)

Question 4

Which of the following is a systematic, evidence-based evaluation of how well an organization conforms to such established criteria as Board-approved policies, regulatory requirements, and internationally recognized standards, such as the ISO 27000 series?

Accepted Answer

A)   Audit report
B)   Cybersecurity audit
C)   CMM
D)   CISAE) C) and D)
F) B) and D) B

Question 5

Which of the following risk assessment methodologies was originally developed by CERT?

Accepted Answer

A)   FAIR
B)   OCTAVE
C)   RMF
D)   CMME) All of the above
F) C) and D) B

Question 6

In the NIST Cybersecurity Framework, which governance subcategory references legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations?

Accepted Answer

A)   ID.GV-1
B)   ID.GV-2
C)   ID.GV-3
D)   ID.GV-4E) B) and C)
F) None of the above

Question 7

Which of the following is a characteristic of the silo-based approach to cybersecurity?

Accepted Answer

A)   Compliance is discretionary.
B)   Security is the responsibility of the IT department.
C)   Little or no organizational accountability exists.
D)   All of the aboveE) B) and C)
F) A) and D) D

Question 8

Which of the following is the objective of risk assessment?

Accepted Answer

A)   Identify the inherent risk
B)   Determine the impact of a threat
C)   Calculate the likelihood of a threat occurrence
D)   All of the aboveE) A) and C)
F) A) and B)

Question 9

Which of the following provides a model for understanding, analyzing, and quantifying information risk in quantitative financial and business terms?

Accepted Answer

A)   RMF
B)   NIST
C)   FAIR
D)   OCTAVEE) B) and C)
F) A) and B)

Question 10

Which of the following statements best describes strategic risk?

Accepted Answer

A)   Risk that relates to monetary loss
B)   Risk that relates to adverse business decisions
C)   Risk that relates to loss resulting from inadequate or failed processes or systems
D)   Risk that relates to violations of laws, rules, regulations, or policyE) B) and D)
F) None of the above

Question 11

Which of the following refers to directives that codify organizational requirements?

Accepted Answer

A)   Guidelines
B)   Standards
C)   Policies
D)   BaselinesE) B) and D)
F) A) and D)

Question 12

OCTAVE is short for which of the following?

Accepted Answer

A)   Operationally Critical Threat, Assessment, and Vulnerability Evaluation
B)   Operationally Critical Threat, Asset, and Vulnerability Evaluation
C)   Optimized Critical Threat, Assessment, and Vulnerability Evaluation
D)   Optimized Critical Threat, Asset, and Vulnerability EvaluationE) A) and B)
F) None of the above

Question 13

The two approaches to cybersecurity are silo-based and __________.

Accepted Answer

A)   integrated
B)   operational
C)   environmental
D)   strategicE) None of the above
F) A) and B)

Question 14

Which of the following statements best describes risk transfer?

Accepted Answer

A)   It shifts a portion of the risk responsibility or liability to other organizations.
B)   It shifts the entire risk responsibility to other organizations.
C)   It takes steps to eliminate or modify the risk.
D)   None of the aboveE) A) and B)
F) None of the above

Question 15

At which of the following states of the CMM scale are there no documented policies and processes?

Accepted Answer

A)   Ad hoc
B)   Defined process
C)   Optimized
D)   NonexistentE) A) and B)
F) None of the above

Question 16

Which of the following refers to how much of the undesirable outcome a risk taker is willing to accept in exchange for the potential benefit?

Accepted Answer

A)   Risk tolerance
B)   Risk mitigation
C)   Risk management
D)   Risk acceptanceE) All of the above
F) A) and C)

Question 17

Which of the following is the final step in the NIST Risk Assessment methodology?

Accepted Answer

A)   Communicate the results.
B)   Prepare for the assessment.
C)   Conduct the assessment.
D)   Maintain the assessment.E) A) and B)
F) A) and D)

Question 18

Which of the following is the magnitude of harm?

Accepted Answer

A)   Risk
B)   Threat
C)   Impact
D)   VulnerabilityE) A) and B)
F) A) and C)

Question 19

Which of the following refers to the level of risk before security measures are applied?

Accepted Answer

A)   Residual risk
B)   Vulnerability
C)   Inherent risk
D)   ImpactE) A) and B)
F) A) and C)

Question 20

Which of the following refers to the process of managing, directing, controlling, and influencing organizational decisions, actions, and behaviors?

Accepted Answer

A)   Governance
B)   Risk sharing
C)   Risk management
D)   CMME) A) and D)
F) All of the above

Exam 4: Governance and Risk Management

Which of the following risks relates to negative public opinion?

Correct AnswerverifiedShow Answer

Which of the following is the leading membership organization for Boards and Directors in the U.S.?

Correct AnswerverifiedShow Answer

Which of the following best describes residual risk?

Correct AnswerverifiedShow Answer

Which of the following is a systematic, evidence-based evaluation of how well an organization conforms to such established criteria as Board-approved policies, regulatory requirements, and internationally recognized standards, such as the ISO 27000 series?

Correct AnswerverifiedB

Which of the following risk assessment methodologies was originally developed by CERT?

Correct AnswerverifiedB

In the NIST Cybersecurity Framework, which governance subcategory references legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations?

Correct AnswerverifiedShow Answer

Which of the following is a characteristic of the silo-based approach to cybersecurity?

Correct AnswerverifiedD

Which of the following is the objective of risk assessment?

Correct AnswerverifiedShow Answer

Which of the following provides a model for understanding, analyzing, and quantifying information risk in quantitative financial and business terms?

Correct AnswerverifiedShow Answer

Which of the following statements best describes strategic risk?

Correct AnswerverifiedShow Answer

Which of the following refers to directives that codify organizational requirements?

Correct AnswerverifiedShow Answer

OCTAVE is short for which of the following?

Correct AnswerverifiedShow Answer

The two approaches to cybersecurity are silo-based and __________.

Correct AnswerverifiedShow Answer

Which of the following statements best describes risk transfer?

Correct AnswerverifiedShow Answer

At which of the following states of the CMM scale are there no documented policies and processes?

Correct AnswerverifiedShow Answer

Which of the following refers to how much of the undesirable outcome a risk taker is willing to accept in exchange for the potential benefit?

Correct AnswerverifiedShow Answer

Which of the following is the final step in the NIST Risk Assessment methodology?

Correct AnswerverifiedShow Answer

Which of the following is the magnitude of harm?

Correct AnswerverifiedShow Answer

Which of the following refers to the level of risk before security measures are applied?

Correct AnswerverifiedShow Answer

Which of the following refers to the process of managing, directing, controlling, and influencing organizational decisions, actions, and behaviors?

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
B

Correct Answer
verified
B

Correct Answer
verified

Correct Answer
verified
D

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified