CCISO Information Security & Risk Management 2 — Questions and Answers
Question 1: A CISO is implementing a risk-based security program. Which framework specifically integrates risk management into a continuous monitoring strategy for federal information systems?
- ISO 27001
- NIST RMF (Correct answer)
- COBIT 5
- FAIR
Correct answer: NIST RMF
NIST Risk Management Framework (RMF) provides a disciplined, structured, and flexible process that integrates security and risk management into the system development life cycle for federal systems.
Question 2: When conducting a risk assessment, the term 'threat agent' most accurately refers to:
- A vulnerability exploited by attackers
- An entity that initiates a threat event (Correct answer)
- The likelihood of a security incident occurring
- The impact of an exploited vulnerability
Correct answer: An entity that initiates a threat event
A threat agent is the actor or entity (person, organization, or natural event) that can exploit a vulnerability to cause harm to an asset.
Question 3: An organization's risk register shows a residual risk that exceeds the acceptable risk threshold. What is the MOST appropriate CISO action?
- Accept the risk and document the exception
- Transfer the risk to a third party immediately
- Escalate to executive leadership for a risk acceptance decision (Correct answer)
- Implement additional controls to reduce the residual risk
Correct answer: Escalate to executive leadership for a risk acceptance decision
When residual risk exceeds the acceptable threshold, the CISO must escalate to executive leadership who have the authority to formally accept or direct additional risk treatment.
Question 4: Which risk treatment option is applied when an organization decides to stop performing an activity that generates unacceptable risk?
- Risk mitigation
- Risk avoidance (Correct answer)
- Risk transfer
- Risk acceptance
Correct answer: Risk avoidance
Risk avoidance eliminates the risk by discontinuing the activity or process that creates the unacceptable exposure.
Question 5: A qualitative risk assessment differs from a quantitative risk assessment primarily because it:
- Uses statistical models and financial values to express risk
- Relies on subjective ratings such as high, medium, and low (Correct answer)
- Calculates Annual Loss Expectancy (ALE) for each risk
- Requires certified actuaries to perform the assessment
Correct answer: Relies on subjective ratings such as high, medium, and low
Qualitative risk assessments use descriptive scales (high/medium/low) rather than numerical financial values, making them faster but more subjective than quantitative methods.
Question 6: In the context of information security governance, which of the following BEST describes the relationship between policies, standards, and procedures?
- Policies are technical; standards are managerial; procedures are strategic
- Policies set direction; standards define requirements; procedures provide step-by-step instructions (Correct answer)
- Procedures override policies when conflicts arise in operations
- Standards are optional guidance while policies are mandatory requirements
Correct answer: Policies set direction; standards define requirements; procedures provide step-by-step instructions
Policies establish high-level direction and intent, standards set specific mandatory requirements, and procedures provide detailed step-by-step instructions for implementation.
Question 7: An organization uses ALE (Annual Loss Expectancy) to prioritize security investments. ALE is calculated as:
- Asset Value × Threat Frequency
- Single Loss Expectancy × Annualized Rate of Occurrence (Correct answer)
- Asset Value − Safeguard Value
- Exposure Factor × Annualized Rate of Occurrence
Correct answer: Single Loss Expectancy × Annualized Rate of Occurrence
ALE = SLE × ARO, where Single Loss Expectancy is the financial loss per incident and Annualized Rate of Occurrence is how often the incident is expected per year.
CCISO Information Security & Risk Management 2
A CISO is implementing a risk-based security program.
Which framework specifically integrates risk management into a continuous monitoring strategy for federal information systems?