Deck 4: Governance and Risk Management

Question 1

Which of the following is a characteristic of the silo-based approach to cybersecurity?

A) Compliance is discretionary.
B) Security is the responsibility of the IT department.
C) Little or no organizational accountability exists.
D) All of the above

Answer 1

All of the above

Question 2

At which of the following states of the CMM scale are there no documented policies and processes?

A) Ad hoc
B) Defined process
C) Optimized
D) Nonexistent

Answer 2

Ad hoc

Question 3

Which of the following best describes residual risk?

A) The likelihood of occurrence of a threat
B) The level of risk before security measures are applied
C) The level of risk after security measures are applied
D) The impact of risk if a threat is realized

Answer 3

The level of risk after security measures are applied

Question 4

Which of the following statements best describes risk transfer?

A) It shifts a portion of the risk responsibility or liability to other organizations.
B) It shifts the entire risk responsibility to other organizations.
C) It takes steps to eliminate or modify the risk.
D) None of the above

Question 5

Which of the following is the objective of risk assessment?

A) Identify the inherent risk
B) Determine the impact of a threat
C) Calculate the likelihood of a threat occurrence
D) All of the above

Question 6

Which of the following risk assessment methodologies was originally developed by CERT?

A) FAIR
B) OCTAVE
C) RMF
D) CMM

Question 7

Which of the following risks relates to negative public opinion?

A) Operational risk
B) Strategic risk
C) Financial risk
D) Reputational risk

Question 8

Which of the following statements best describes strategic risk?

A) Risk that relates to monetary loss
B) Risk that relates to adverse business decisions
C) Risk that relates to loss resulting from inadequate or failed processes or systems
D) Risk that relates to violations of laws, rules, regulations, or policy

Question 9

Which of the following is the magnitude of harm?

A) Risk
B) Threat
C) Impact
D) Vulnerability

Question 10

The two approaches to cybersecurity are silo-based and __________.

A) integrated
B) operational
C) environmental
D) strategic

Question 11

Which of the following refers to directives that codify organizational requirements?

A) Guidelines
B) Standards
C) Policies
D) Baselines

Question 12

Which of the following is the leading membership organization for Boards and Directors in the U.S.?

A) ISO
B) NIST
C) CERT
D) NACD

Question 13

Which of the following is a systematic, evidence-based evaluation of how well an organization conforms to such established criteria as Board-approved policies, regulatory requirements, and internationally recognized standards, such as the ISO 27000 series?

A) Audit report
B) Cybersecurity audit
C) CMM
D) CISA

Question 14

In the NIST Cybersecurity Framework, which governance subcategory references legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations?

A) ID.GV-1
B) ID.GV-2
C) ID.GV-3
D) ID.GV-4

Question 15

Which of the following refers to how much of the undesirable outcome a risk taker is willing to accept in exchange for the potential benefit?

A) Risk tolerance
B) Risk mitigation
C) Risk management
D) Risk acceptance

Question 16

Which of the following refers to the level of risk before security measures are applied?

A) Residual risk
B) Vulnerability
C) Inherent risk
D) Impact

Question 17

Which of the following is the final step in the NIST Risk Assessment methodology?

A) Communicate the results.
B) Prepare for the assessment.
C) Conduct the assessment.
D) Maintain the assessment.

Question 18

Which of the following refers to the process of managing, directing, controlling, and influencing organizational decisions, actions, and behaviors?

A) Governance
B) Risk sharing
C) Risk management
D) CMM

Question 19

OCTAVE is short for which of the following?

A) Operationally Critical Threat, Assessment, and Vulnerability Evaluation
B) Operationally Critical Threat, Asset, and Vulnerability Evaluation
C) Optimized Critical Threat, Assessment, and Vulnerability Evaluation
D) Optimized Critical Threat, Asset, and Vulnerability Evaluation

Question 20

Which of the following provides a model for understanding, analyzing, and quantifying information risk in quantitative financial and business terms?

A) RMF
B) NIST
C) FAIR
D) OCTAVE