Exam 4: Governance and Risk Management

Which of the following is a systematic, evidence-based evaluation of how well an organization conforms to such established criteria as Board-approved policies, regulatory requirements, and internationally recognized standards, such as the ISO 27000 series?

Which of the following is a characteristic of the silo-based approach to cybersecurity?

Which of the following risk assessment methodologies was originally developed by CERT?

Which of the following refers to the process of managing, directing, controlling, and influencing organizational decisions, actions, and behaviors?

Which of the following is the leading membership organization for Boards and Directors in the U.S.?

Which of the following refers to how much of the undesirable outcome a risk taker is willing to accept in exchange for the potential benefit?

Which of the following refers to the level of risk before security measures are applied?

OCTAVE is short for which of the following?

Which of the following is the magnitude of harm?

Which of the following best describes residual risk?

Which of the following provides a model for understanding, analyzing, and quantifying information risk in quantitative financial and business terms?

Which of the following refers to directives that codify organizational requirements?

In the NIST Cybersecurity Framework, which governance subcategory references legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations?

Which of the following is the objective of risk assessment?

Which of the following risks relates to negative public opinion?

At which of the following states of the CMM scale are there no documented policies and processes?

Which of the following statements best describes risk transfer?

The two approaches to cybersecurity are silo-based and __________.

Which of the following is the final step in the NIST Risk Assessment methodology?

Which of the following statements best describes strategic risk?