EC-Council Certified Chief Information Security Officer (CCISO) practice questions

Try 25 supported questions from the 188-question bank. Check each answer when you are ready and keep this preview’s progress privately in your browser.

Back to the 712-50 exam guide Switch to a timed mock

Free preview

25 of 188 questions are open

This sample includes answers, available explanations, official references and curated community discussion. An Exam Pass unlocks the private complete bank for this exam.

See Exam Pass pricing

Answer support

What is available on this page

10 contested answers

Questions: 25
Explanations: 25
Candidate context: 25
Question citations: 3

25 questions in this bank

Question 1 of 25
Which of the following activities results in change requests?
Show answer
Correct answer: C
How others answered
C60%
A20%
D20%
Only 60% agreed on this answer — treat it as contested rather than settled.
Explanation
A. Corrective actions Corrective actions involve addressing identified issues or problems within a system or process to prevent their recurrence. When corrective actions are implemented, they often require change requests to modify the existing system or process. These change requests capture the necessary modifications or updates needed to rectify the identified issues and improve the overall performance or functionality. Therefore, corrective actions typically lead to change requests as part of the process for implementing the necessary changes.
Adapted from community discussion by arifbhatkar · 2023-12-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 1 Report an issue
Candidate context
Question 1 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
P
Pika26
2023-09-18
3 upvotes
Answer should be A, corrective actions. Corrective actions are activities taken to address identified problems, issues, or defects that have occurred during the project execution. These activities may result in change requests, which are formal proposals to modify any project document, deliverable, or baseline.
A
arifbhatkar
2023-12-27
2 upvotes
A. Corrective actions Corrective actions involve addressing identified issues or problems within a system or process to prevent their recurrence. When corrective actions are implemented, they often require change requests to modify the existing system or process. These change requests capture the necessary modifications or updates needed to rectify the identified issues and improve the overall performance or functionality. Therefore, corrective actions typically lead to change requests as part of the process for implementing the necessary changes.
K
kaibutsu
2024-01-31
3 upvotes
I think we need more context. I can see A or C. If it said "Emergency Change" then I would say "Corrective."
M
musagul
2024-08-12
Selected C1 upvote
You must create a change request when you are doing preventive action. Because the "preventive action" can prevent legal business processes. C is Correct.
Question 2 of 25
Which of the following is the MOST important component of any change management process?
Show answer
Correct answer: C
How others answered
C67%
A33%
Only 67% agreed on this answer — treat it as contested rather than settled.
Explanation
I would argue back out procedures are equally important with the best will in the world in today's complex systems it is impossible to predict all the effects of changes so being able to back-out a change quickly and smoothly is a vital safety net.
Adapted from community discussion by Kentish · 2023-04-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 2 Report an issue
Candidate context
Question 2 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
K
Kentish
2023-04-03
3 upvotes
I would argue back out procedures are equally important with the best will in the world in today's complex systems it is impossible to predict all the effects of changes so being able to back-out a change quickly and smoothly is a vital safety net.
V
Valen2259
2024-09-03
1 upvote
D. It has to be; whilst outage planning maybe at the behest of the system/operational window. You need a plan should that update go wrong. You will not get Management approval unless you have a roll-back plan. Back-out procedures are essential because, no matter how well a change is planned, there is always a risk of failure or unintended consequences. A well-documented and tested back-out procedure allows for a quick and controlled response, minimizing risks and maintaining system stability.
J
johndoe69
2024-06-02
Selected C1 upvote
C. ITIL (Information Technology Infrastructure Library): ITIL emphasizes the importance of a structured change management process, including approval tracking to manage risks and ensure changes are beneficial.
O
ONERAPTOR
2023-11-22
1 upvote
Answer is C This is key to ensuring that all changes are reviewed, authorized, and documented before implementation. Approval tracking ensures accountability and oversight, which are critical for managing risks associated with changes. It helps in ensuring that changes align with the organization's policies, compliance requirements, and business objectives.
Question 3 of 25
Risk appetite is typically determined by which of the following organizational functions?
Show answer
Correct answer: B
How others answered
B67%
A33%
Only 67% agreed on this answer — treat it as contested rather than settled.
Explanation
I think this should the Board Of Director. I think they must determine the Risk Appetite of the business and NOT the Business Units. The Business Units could be compensating?
Adapted from community discussion by Dzidzorli · 2020-06-18 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 3 Report an issue
Candidate context
Question 3 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
D
Dzidzorli
2020-06-18
7 upvotes
I think this should the Board Of Director. I think they must determine the Risk Appetite of the business and NOT the Business Units. The Business Units could be compensating?
P
Pika26
2023-03-19
3 upvotes
Answer is B. The risk appetite of an organization refers to the level of risk that an organization is willing to accept to achieve its objectives. This decision is typically made by senior management or the board of directors, as they are responsible for setting the overall strategic direction and risk tolerance of the organization. Business units, audit and compliance, and security may provide input into the risk appetite decision-making process, but they do not typically have the authority to make the final decision.
R
Rufus1
2021-10-25
4 upvotes
"Determined"... Can be Business Units to determine, and Board to approve. Very debating choices...
A
arifbhatkar
2023-07-02
1 upvote
The risk appetite is typically determined by the Board of Directors, making option B the correct answer. The Board of Directors holds the overall responsibility for setting the strategic direction and objectives of an organization, including its risk management approach. The risk appetite represents the level of risk that an organization is willing to accept in pursuit of its objectives. It reflects the organization's tolerance for risk and guides decision-making processes regarding risk management.
Question 4 of 25
A security professional has been promoted to be the CISO of an organization. The first task is to create a security policy for this organization. The CISO creates and publishes the security policy. This policy, however, is ignored and not enforced consistently. Which of the following is the MOST likely reason for the policy shortcomings?
Show answer
Correct answer: B
How others answered
B80%
D20%
Explanation
Lack of a formal security policy governance process: This is the most probable reason for the policy being ignored. Governance involves not just the creation of policies but also the mechanisms for enforcement, monitoring, and reviewing those policies. If there's no formal governance process, there's likely no mechanism to ensure that the policy is integrated into daily operations, no accountability for non-compliance, and no regular reviews or updates to the policy. All of these factors can lead to a policy being ignored or inconsistently enforced.
Adapted from community discussion by claudiosousa · 2024-01-21 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 4 Report an issue
Candidate context
Question 4 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
C
claudiosousa
2024-01-21
Selected B3 upvotes
Lack of a formal security policy governance process: This is the most probable reason for the policy being ignored. Governance involves not just the creation of policies but also the mechanisms for enforcement, monitoring, and reviewing those policies. If there's no formal governance process, there's likely no mechanism to ensure that the policy is integrated into daily operations, no accountability for non-compliance, and no regular reviews or updates to the policy. All of these factors can lead to a policy being ignored or inconsistently enforced.
R
RC2073
2023-08-24
Selected B1 upvote
B is correct. Refer to https://vceguide.com/which-of-the-following-is-the-most-likely-reason-for-the-policy-shortcomings/
C
claudiosousa
2024-08-29
1 upvote
D D. Lack of a formal security awareness program. Without a security awareness program, employees may not fully understand the policy, its importance, or their role in enforcing it, leading to it being ignored or inconsistently applied.
K
Kentish
2023-04-11
1 upvote
B makes sense as a governance process would ensure the policies are rolled out and adopted. part of this would be defining the roles and responsibilities so also answer C
Question 5 of 25
A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?
Show answer
Correct answer: D
How others answered
D50%
B25%
C25%
Only 50% agreed on this answer — treat it as contested rather than settled.
Explanation
D. Payment Card Industry Data Security Standards (PCI-DSS) Here's why: Option A: ITIL is a framework for IT service management, not a regulation. While it can be helpful in managing compliance processes, it doesn't directly dictate specific compliance requirements. Option B: NIST standards are broad and encompass various areas, including cybersecurity. However, they are not specific to retail companies or payment card data security. Option C: ISO standards also cover a wide range of areas, including some relevant to retail, like ISO 9001 for quality management. However, none directly address payment card data security like PCI-DSS does. Option D: PCI-DSS is a set of security standards specifically designed to ensure the safe handling of cardholder data by organizations that accept, transmit, or store payment card information. This directly applies to most, if not all, global retail companies that process customer payments.
Adapted from community discussion by ats831 · 2024-03-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 5 Report an issue
Candidate context
Question 5 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
ats831
2024-03-03
Selected D2 upvotes
D. Payment Card Industry Data Security Standards (PCI-DSS) Here's why: Option A: ITIL is a framework for IT service management, not a regulation. While it can be helpful in managing compliance processes, it doesn't directly dictate specific compliance requirements. Option B: NIST standards are broad and encompass various areas, including cybersecurity. However, they are not specific to retail companies or payment card data security. Option C: ISO standards also cover a wide range of areas, including some relevant to retail, like ISO 9001 for quality management. However, none directly address payment card data security like PCI-DSS does. Option D: PCI-DSS is a set of security standards specifically designed to ensure the safe handling of cardholder data by organizations that accept, transmit, or store payment card information. This directly applies to most, if not all, global retail companies that process customer payments.
U
U_Rock
2024-04-25
1 upvote
Keywords >> Retail. The only item tied specifically to "retail" is PCI DSS - as related to the protection of credit card payment transactions and the cardholder data.
I
ImranNY
2024-02-05
1 upvote
The quality of this question could be enhanced by indicating that this global retail company accepts Credit Card. It doesn’t indicate anywhere in the question.
B
Boats
2023-05-05
1 upvote
PCI-DSS is not a regulation as tnagy says. NIST is US based. It is a global company. The best answer is ISO.
Question 6 of 25
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered______________________.
Show answer
Correct answer: B
How others answered
B100%
Explanation
The CCISO all-in one exam page 74 has IPS's in Corrective and Preventative. Since Detective and Preventive or 2 different controls, A is wrong because there is no such controls as a "Preventative detection control" per the book EXAM TIP A control can be associated with more than one control functionality. For example, an IPS could be considered both preventive and corrective and fencing could be considered both....
Adapted from community discussion by Perseus_68 · 2024-09-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 6 Report an issue
Candidate context
Question 6 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
J
johndoe69
2024-12-03
Selected B1 upvote
NIST Special Publication 800-53: NIST defines corrective security controls as measures that are implemented to correct the impact of a security incident or vulnerability. In this case, dynamically blocking offending IP addresses after they are identified as threats serves to mitigate and correct the situation by preventing further malicious activity from those addresses (NIST, 2020). SANS Institute: The SANS Institute describes corrective controls as actions taken to eliminate or reduce the impact of an identified issue. Blocking IP addresses dynamically after detecting suspicious activity fits this description, as it aims to rectify the situation and prevent recurrence (SANS, 2021).
P
Perseus_68
2024-09-03
Selected B2 upvotes
The CCISO all-in one exam page 74 has IPS's in Corrective and Preventative. Since Detective and Preventive or 2 different controls, A is wrong because there is no such controls as a "Preventative detection control" per the book EXAM TIP A control can be associated with more than one control functionality. For example, an IPS could be considered both preventive and corrective and fencing could be considered both....
B
Bettoxicity
2024-12-31
Selected B1 upvote
Why not A: This is a contradictory term. Detection controls identify issues, while preventive controls aim to stop them before they occur. The system in question acts after malicious activity is detected, so it is not preventive.
V
VOAKDO_cciso
2023-11-29
Selected B1 upvote
COSO PDC Defense-in-Depth ModeL, ips=dynamically block. If we have a look to correctdive controls on COSO PDC, it says that IPS is a corrective control .
Question 7 of 25
An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?
Show answer
Correct answer: C
How others answered
C64%
B27%
Only 64% agreed on this answer — treat it as contested rather than settled.
Explanation
After defining the standard security controls and the conditions for their application, the next step is to analyze the existing controls on the systems to identify any gaps or overlaps. This analysis helps in understanding how well the current controls align with the new standards and where adjustments or enhancements are needed. By doing this, the organization can ensure that the new controls are effectively integrated and that all systems comply with the updated security requirements.
Adapted from community discussion by johndoe69 · 2024-07-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 7 Report an issue
Candidate context
Question 7 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
3
38eefed
2024-02-22
Selected C3 upvotes
Since the organization has already defined its security controls and their application conditions, the next step is to analyze the existing controls on systems (Option C). This will help the organization understand where these standard controls need to be applied or where existing controls may need to be updated.
J
johndoe69
2024-07-16
Selected C2 upvotes
After defining the standard security controls and the conditions for their application, the next step is to analyze the existing controls on the systems to identify any gaps or overlaps. This analysis helps in understanding how well the current controls align with the new standards and where adjustments or enhancements are needed. By doing this, the organization can ensure that the new controls are effectively integrated and that all systems comply with the updated security requirements.
E
Emporeo
2024-02-25
Selected C2 upvotes
analyze existing controls. asset classification must be in place already. how to apply the correct controls if you do not know the asset classification?
P
Perseus_68
2024-02-28
2 upvotes
That was my first thought. But the question does not state a program has been implemented and it is being reviewed. Our only info is the company has some documentation on controls, not that any have been applied, so the first step in Risk management is to categorize the Asset or System, pg 71 CCISO guide.
Question 8 of 25
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates. When multiple regulations or standards apply to your industry you should set controls to meet the___________________________.
Show answer
Correct answer: D
How others answered
D100%
Explanation
The question is clear "When multiple regulations or standards apply to your industry..." so the answer is D. If you don't implement the stricter one, you will be out of compliance and subject to whatever the fines are.
Adapted from community discussion by Otto_Aulicino · 2022-06-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 8 Report an issue
Candidate context
Question 8 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
O
Otto_Aulicino
2022-06-16
Selected D3 upvotes
The question is clear "When multiple regulations or standards apply to your industry..." so the answer is D. If you don't implement the stricter one, you will be out of compliance and subject to whatever the fines are.
G
GXG17
2021-10-27
4 upvotes
If you implement the easiest, you break the others stricter regulations. Correct answer is D
J
johndoe69
2024-12-04
Selected D1 upvote
Setting controls to meet the stricter regulation or standard ensures that your organization is compliant with all applicable regulations and standards. By adhering to the most stringent requirements, you effectively cover the less strict requirements as well, ensuring comprehensive compliance. This approach reduces the risk of non-compliance and potential legal and financial penalties.
R
Rufus1
2022-04-20
3 upvotes
I vote for the correct answer -> B Recommendations of your Legal Staff
Question 9 of 25
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda. The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?
Show answer
Correct answer: A
How others answered
A100%
Explanation
It is "A" based on how the question is written: "...CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization..." The answer could be "not reporting to the CEO" too, but the fact that the CISO is able to influence the IT departments and not others, makes "A" a better answer.
Adapted from community discussion by Otto_Aulicino · 2021-12-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 9 Report an issue
Candidate context
Question 9 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
O
Otto_Aulicino
2021-12-16
3 upvotes
It is "A" based on how the question is written: "...CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization..." The answer could be "not reporting to the CEO" too, but the fact that the CISO is able to influence the IT departments and not others, makes "A" a better answer.
J
johndoe69
2024-07-19
Selected A1 upvote
CISO Reporting Structure: When the CISO reports to the IT organization, their influence might be limited to the IT domain, making it challenging to implement and enforce security measures across other business units. This reporting structure can lead to a perception that security is just an IT issue rather than a critical enterprise-wide concern. To be effective, the CISO should ideally have a broader mandate and visibility across the organization, which is often achieved by reporting directly to the CEO or another high-level executive such as the COO.
B
BiteSize
2025-02-08
Selected A1 upvote
For those who are thinking C... YES, C is the same thing as "A." However, C could also mean the CISO reports to the janitor, making that answer worse because it is less specific. "A" is specific enough to tie into the question when it discusses IT services. Therefore, it is clearly the Better answer.
R
Rufus1
2021-10-20
2 upvotes
"A" means that CISO is in a non-executive role. There his transversal influence across the organization is limited. My opinion is that "A" is most objective choice.
Question 10 of 25
If your organization operates under a model of "assumption of breach", you should:
Show answer
Correct answer: C
How others answered
C67%
B33%
Only 67% agreed on this answer — treat it as contested rather than settled.
Explanation
The "assumption of breach" model operates on the premise that breaches are inevitable. Therefore, it's crucial to prioritize and focus security efforts on protecting high-value assets, as these are the most critical and potentially damaging if compromised. This approach helps in allocating resources efficiently to areas that matter the most, ensuring that the organization's most valuable and sensitive information is adequately protected.
Adapted from community discussion by johndoe69 · 2024-07-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 10 Report an issue
Candidate context
Question 10 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
J
johndoe69
2024-07-16
Selected C3 upvotes
The "assumption of breach" model operates on the premise that breaches are inevitable. Therefore, it's crucial to prioritize and focus security efforts on protecting high-value assets, as these are the most critical and potentially damaging if compromised. This approach helps in allocating resources efficiently to areas that matter the most, ensuring that the organization's most valuable and sensitive information is adequately protected.
E
Emporeo
2024-03-25
1 upvote
i honestly would pick none of the answers. Focus on most critical assets can't be the right answer, that would leave other assets vulnerable. Transferring risk to an insurance company? that might compensate some costs, but will NOT protect your company getting hit by a severe attack...and fines in case of regulations. My thoughts here are to harden the incident response process, implement a stronger process and tech, implement network segreration and strong IAM to limit the damage and potential lateral movement. Thats the theority everyone gets a victim of an attack..the difference is the severity and capability to stop bleeding..
7
7926e67
2024-01-26
Selected C1 upvote
If there is a breach, the organization will prioritize the security efforts on high value assets. It is too late to have insurance and you may not have enough resource to put on all assets as well.
P
perritoFaldero
2024-08-28
Selected C1 upvote
Under Assumption of breach not a single insurance company will sing a contract
Question 11 of 25
The network administrator wants to strengthen physical security in the organization. Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials. Which of following physical security measures should the administrator use?
Show answer
Correct answer: B
How others answered
B100%
Explanation
A network administrator implementing physical controls (which not the right way to do this, but anyway...) is likely interested in protecting network equipment, network circuits etc. A fence will unlikely do so, but the question clearly eliminates fence as an option, by stating "Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials" A fence doesn't restrict based on credentials (height is not a credential). A mantrap, while it can be unauthenticated, by definition it should.
Adapted from community discussion by Otto_Aulicino · 2021-12-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 11 Report an issue
Candidate context
Question 11 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
alfaMegatron
2024-08-14
Selected B1 upvote
A mantrap is a physical security device or space used to control and restrict access to a secure area. It consists of two or more interlocking doors, where the first door must close before the second door can open. The purpose of a mantrap is to ensure that only authorized personnel can gain entry to sensitive areas, such as data centers, secure buildings, or restricted rooms. In operation: Entry Process: An individual enters the mantrap through the first door, which then locks behind them. Verification: While inside the mantrap, the individual's credentials are verified, often using biometric systems, access cards, or security personnel. Exit Process: If the individual is authorized, the second door unlocks, allowing them to proceed into the secure area. If they are not authorized, they may be trapped inside the mantrap until security personnel intervene.
O
Otto_Aulicino
2021-12-16
2 upvotes
A network administrator implementing physical controls (which not the right way to do this, but anyway...) is likely interested in protecting network equipment, network circuits etc. A fence will unlikely do so, but the question clearly eliminates fence as an option, by stating "Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials" A fence doesn't restrict based on credentials (height is not a credential). A mantrap, while it can be unauthenticated, by definition it should.
J
johndoe69
2024-06-07
Selected B1 upvote
A mantrap is a physical security measure designed to control access to a restricted area. It typically consists of a small room with two sets of interlocking doors. Both doors cannot be open at the same time, and access is controlled by verifying the credentials of the person trying to enter the restricted zone. This ensures that only authorized individuals can pass through and prevents tailgating (unauthorized entry by following an authorized person).
E
e_karma
2021-02-18
2 upvotes
Fence is more of a detterent control than a preventive control in most cases. While mantraps are for sure Preventive controls
Question 12 of 25
Which of the following is a primary method of applying consistent configurations to IT systems?
Show answer
Correct answer: D
How others answered
D100%
Explanation
D. Templates. Templates provide a standardized and efficient way to apply consistent configurations to IT systems. A template is a pre-defined configuration or set of settings that can be applied to multiple systems or devices. By using templates, organizations can ensure that systems are configured consistently according to best practices and security requirements.
Adapted from community discussion by arifbhatkar · 2023-07-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 12 Report an issue
Candidate context
Question 12 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
arifbhatkar
2023-07-04
Selected D2 upvotes
D. Templates. Templates provide a standardized and efficient way to apply consistent configurations to IT systems. A template is a pre-defined configuration or set of settings that can be applied to multiple systems or devices. By using templates, organizations can ensure that systems are configured consistently according to best practices and security requirements.
O
Otto_Aulicino
2021-12-16
Selected D2 upvotes
D is the right answer here. A template standardizes the configuration. Patching goal is not to standardize, even though it may be a standard patch implemented across the board.
K
kaibutsu
2023-07-24
2 upvotes
Patching doesn't have anything to do with consistent configurations. The answer has to be D.
O
Otto_Aulicino
2021-12-16
2 upvotes
in the absence of hardening, templates would be better than patching.
Question 13 of 25
When dealing with a risk management process, asset classification is important because it will impact the overall:
Show answer
Correct answer: A
How others answered
A80%
B20%
Explanation
B is correct, because Asset classification is important in the risk management process because it will impact the overall risk treatment. Asset classification involves identifying and categorizing assets based on their value, criticality, sensitivity, and other relevant factors. This classification helps determine the appropriate level of protection and resources that should be allocated to each asset. Based on the classification of assets, the organization can determine the appropriate risk treatment strategy, which may include risk avoidance, risk mitigation, risk transfer, or risk acceptance.
Adapted from community discussion by Pika26 · 2023-03-19 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 13 Report an issue
Candidate context
Question 13 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
P
Pika26
2023-03-19
4 upvotes
B is correct, because Asset classification is important in the risk management process because it will impact the overall risk treatment. Asset classification involves identifying and categorizing assets based on their value, criticality, sensitivity, and other relevant factors. This classification helps determine the appropriate level of protection and resources that should be allocated to each asset. Based on the classification of assets, the organization can determine the appropriate risk treatment strategy, which may include risk avoidance, risk mitigation, risk transfer, or risk acceptance.
J
JeBaCas
2024-08-04
2 upvotes
Asst classification or categorization determines the CIA needs. Risk Treatment will be affected by it due to controls should be aligned to these needs, however is more important for threat identification since these are the once that will determine if risk is be treated or accepted (criteria). Besides, treatment can have other options than mitigation, where CIA needs are not relevant
T
tnagy
2023-03-10
Selected A2 upvotes
Assets must be classified to identify potential threats not to prepare for a remediation plan.
P
perritoFaldero
2024-08-28
Selected A2 upvotes
The asset determine the threats it is subject to. That is the very first step
Question 14 of 25
Which of the following best describes revenue?
Show answer
Correct answer: D
How others answered
D75%
C25%
Explanation
Revenue represents the total amount of money generated by the sale of goods or services related to the company's primary operations. It is often referred to as the "top line" because it is the starting point for calculating net income, which is known as the "bottom line." Revenue is a critical measure of the economic benefit that an organization derives from its regular business activities
Adapted from community discussion by johndoe69 · 2024-12-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 14 Report an issue
Candidate context
Question 14 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
J
johndoe69
2024-12-07
Selected D2 upvotes
Revenue represents the total amount of money generated by the sale of goods or services related to the company's primary operations. It is often referred to as the "top line" because it is the starting point for calculating net income, which is known as the "bottom line." Revenue is a critical measure of the economic benefit that an organization derives from its regular business activities
C
CYNLEE
2023-10-01
Selected D1 upvote
Not all increment of asset or cash are gained from product selling. For example, purchase of fixed asset is not a revenue gain
U
UNN_CCISO
2022-03-06
1 upvote
An economic benefit is any benefit that we can quantify in terms of the money that it generates. Net income and revenues, for example, are forms of economic benefit. Profit and net cash flow are also economic benefits.
E
e_karma
2021-08-18
1 upvote
The answer is c. The economic benefit derived form operating business is Profit not revenue.
Question 15 of 25
Which of the following defines the boundaries and scope of a risk assessment?
Show answer
Correct answer: C
How others answered
C58%
D42%
Only 58% agreed on this answer — treat it as contested rather than settled.
Explanation
The risk assessment charter is a document that defines the boundaries and scope of a risk assessment. It outlines the objectives, scope, methodology, roles, and responsibilities related to the risk assessment process. It provides a clear framework for conducting the assessment and helps ensure that all relevant aspects are considered within the defined boundaries.
Adapted from community discussion by skaf · 2023-09-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 15 Report an issue
Candidate context
Question 15 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
S
skaf
2023-09-26
Selected C2 upvotes
The risk assessment charter is a document that defines the boundaries and scope of a risk assessment. It outlines the objectives, scope, methodology, roles, and responsibilities related to the risk assessment process. It provides a clear framework for conducting the assessment and helps ensure that all relevant aspects are considered within the defined boundaries.
A
alfaMegatron
2024-08-15
Selected C1 upvote
A Risk Assessment Charter is a formal document that outlines the objectives, scope, roles, responsibilities, and methodologies for conducting a risk assessment within an organization. It serves as a foundational guide to ensure that the risk assessment process is well-organized, consistent, and aligned with the organization's overall risk management strategy.
A
arifbhatkar
2023-07-05
Selected C1 upvote
The correct answer is C. The risk assessment charter. The risk assessment charter: The risk assessment charter outlines the purpose, objectives, scope, and responsibilities of the risk assessment. It defines the boundaries within which the assessment will be conducted, including the systems, processes, assets, and risks that will be considered.
N
Nickknock
2023-09-03
Selected C2 upvotes
The correct answer is c, charter. CCISO manual page 120 -121defining a security charter.
Question 16 of 25
Which of the following best describes an access control process that confirms the identity of the entity seeking access to a logical or physical area?
Show answer
Correct answer: C
How others answered
C100%
Explanation
The answer is "C" . Authentication is the process of confirming a claimed Identity . Authorization is the process of granting access according to the identity.
Adapted from community discussion by e_karma · 2021-02-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 16 Report an issue
Candidate context
Question 16 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
V
VOAKDO_cciso
2023-05-24
Selected C2 upvotes
AUTHENTICATION: confirms who we are... AUTHORIZATION: grant access or not after AUTHENTICATION process has finished
J
johndoe69
2024-07-19
Selected C1 upvote
Reference: NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations "Authentication: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system."
E
e_karma
2021-02-18
2 upvotes
The answer is "C" . Authentication is the process of confirming a claimed Identity . Authorization is the process of granting access according to the identity.
V
VOAKDO_cciso
2023-05-24
Selected C1 upvote
of course, AUTHENTICATION,=process of confirming identity is called AUTHENTICATION
Question 17 of 25
As the CISO, you have been tasked with the execution of the company's key management program. You MUST ensure the integrity of encryption keys at the point of generation. Which principal of encryption key control will ensure no single individual can constitute or re-constitute a key?
Show answer
Correct answer: C
How others answered
C100%
Explanation
Dual Control means that no one person should be able to manage your encryption keys. Creating, distributing, and defining access controls should require at least two individuals working together to accomplish the task. ---- Split Knowledge applies to the manual generation of encryption keys, or at any point where encryption keys are available in the clear. More than one person should be required to constitute or re-constitute a key in this situation. Seems A the right answer
Adapted from community discussion by Rufus1 · 2021-10-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 17 Report an issue
Candidate context
Question 17 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
R
Rufus1
2021-10-20
2 upvotes
Dual Control means that no one person should be able to manage your encryption keys. Creating, distributing, and defining access controls should require at least two individuals working together to accomplish the task. ---- Split Knowledge applies to the manual generation of encryption keys, or at any point where encryption keys are available in the clear. More than one person should be required to constitute or re-constitute a key in this situation. Seems A the right answer
J
johndoe69
2024-07-19
Selected C1 upvote
Reference: NIST Special Publication 800-57 Part 1 Rev. 5: Recommendation for Key Management – Part 1: General "Split knowledge is a condition under which two or more parties separately have key components that individually convey no knowledge of the resultant cryptographic key. Only when combined can the key be reconstituted."
7
7926e67
2024-01-30
Selected C1 upvote
When we look at the definition of split knowledge and dual control, dual control means that it takes more than one individual to create this key rotation ceremony. When we look at split knowledge, it says that when we create the key, no one individual has any knowledge of the resulting key.
E
e_karma
2021-02-18
2 upvotes
The answer is "C". The person given reference should have read this own reference doocument. It clearly says that Split Knowledge is needed to constitute and re constitute keys
Question 18 of 25
Which of the following would negatively impact a log analysis of a multinational organization?
Show answer
Correct answer: C
How others answered
C100%
Explanation
he correct answer is C. Each node set to local time. Setting each node to local time would negatively impact a log analysis of a multinational organization. In order to perform effective log analysis, it is important to have consistent and standardized timestamps across all log entries. If each node within the organization is set to local time, it would introduce inconsistencies in the timestamps recorded in the log files, making it difficult to correlate events accurately and perform accurate analysis across different systems and regions.
Adapted from community discussion by arifbhatkar · 2023-07-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 18 Report an issue
Candidate context
Question 18 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
arifbhatkar
2023-07-05
Selected C2 upvotes
he correct answer is C. Each node set to local time. Setting each node to local time would negatively impact a log analysis of a multinational organization. In order to perform effective log analysis, it is important to have consistent and standardized timestamps across all log entries. If each node within the organization is set to local time, it would introduce inconsistencies in the timestamps recorded in the log files, making it difficult to correlate events accurately and perform accurate analysis across different systems and regions.
L
LARdT
2022-04-26
3 upvotes
A. Would be beneficial B. Would be a necessary good practice C. Is not good, makes correlation difficult. This would be the forensic answer. D This can be argued to be the worst as information is lost in the aggregation. You would have to resort to the unaggregated logs to investigate an incident.
J
johndoe69
2024-07-19
Selected C1 upvote
NIST Special Publication 800-92: Guide to Computer Security Log Management "When the clocks on systems are not synchronized, event correlation can become very difficult, and events from one system may appear to have occurred before they actually did, relative to the time on another system. It is strongly recommended that organizations use a common time synchronization protocol, such as Network Time Protocol (NTP), to ensure that the clocks on all systems are synchronized."
V
vmathan
2021-11-06
1 upvote
I also have the same concern about local time, But still the log analysis will not be delayed but this cause mapping the chronology of event. But if the local aggregation is done, then we need to analyse each log which will cause delay
Question 19 of 25
Which of the following statements below regarding Key Performance indicators (KPIs) are true?
Show answer
Correct answer: C
How others answered
C83%
B17%
Explanation
KPIs should be standardized throughout the organization to ensure consistency and comparability. This allows for easier correlation and benchmarking across different departments or business units.
Adapted from community discussion by arifbhatkar · 2023-07-05 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 19 Report an issue
Candidate context
Question 19 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
arifbhatkar
2023-07-05
Selected C3 upvotes
KPIs should be standardized throughout the organization to ensure consistency and comparability. This allows for easier correlation and benchmarking across different departments or business units.
M
musagul
2024-02-24
Selected C1 upvote
Question is insufficient. It must say MOST or BEST as it includes more than one true answer. Here we can see C is the most suitable argument.
J
johndoe69
2024-07-19
1 upvote
None of the provided statements accurately capture the full nature of KPIs. The correct approach involves collaboration in development, a combination of quantitative and qualitative measures, and both standard and domain-specific KPIs as appropriate to the organization’s needs.
A
Ath3na89
2024-05-10
1 upvote
KPIs are quantifiable measures that are developed collaboratively to align with strategic goals, and while they are primarily quantitative, they can also reflect qualitative aspects of performance.
Question 20 of 25
You have been hired as the Information System Security Officer (ISSO) for a US federal government agency. Your role is to ensure the security posture of the system is maintained. One of your tasks is to develop and maintain the system security plan (SSP) and supporting documentation. Which of the following is NOT documented in the SSP?
Show answer
Correct answer: B
How others answered
B33%
D33%
C33%
Only 33% agreed on this answer — treat it as contested rather than settled.
Explanation
Reference: https://www.govinfo.gov/content/pkg/GOVPUB-C13-63e84ab7af43b36228f10e4f0b5f8c38/pdf/GOVPUB-C13- 63e84ab7af43b36228f10e4f0b5f8c38.pdf (65)
Supporting references
nist.gov documentation
Permanent link to question 20 Report an issue
Candidate context
Question 20 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
arifbhatkar
2023-07-06
Selected B1 upvote
Option B, "Name of the connected system," is NOT typically documented in the System Security Plan (SSP). The SSP focuses on providing a comprehensive overview of the security controls and measures implemented for the specific system. It includes information such as the security controls in place, the type of information used in the system, the results of third-party audits and recommendations, and other details relevant to the security of the system.
C
chockalingam
2023-09-12
1 upvote
The system security plan describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems. https://csrc.nist.gov/glossary/term/information_system_security_plan#:~:text=The%20system%20security%20plan%20describes,or%20connections%20to%20other%20systems.
Question 21 of 25
Which of the following strategies provides the BEST response to a ransomware attack?
Show answer
Correct answer: A
How others answered
A60%
B40%
Only 60% agreed on this answer — treat it as contested rather than settled.
Explanation
Explanation: Real-time off-site replication: This strategy involves continuously copying data to an off-site location in real-time. This ensures that the most recent data is always available and can be quickly restored in case of a ransomware attack. Real-time replication minimizes data loss to the shortest possible time frame, as data is constantly being backed up as changes are made.
Adapted from community discussion by johndoe69 · 2024-07-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 21 Report an issue
Candidate context
Question 21 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
J
johndoe69
2024-07-19
Selected A2 upvotes
Explanation: Real-time off-site replication: This strategy involves continuously copying data to an off-site location in real-time. This ensures that the most recent data is always available and can be quickly restored in case of a ransomware attack. Real-time replication minimizes data loss to the shortest possible time frame, as data is constantly being backed up as changes are made.
A
arifbhatkar
2023-07-06
Selected A1 upvote
A. Real-time off-site replication Real-time off-site replication involves continuously replicating critical data to an off-site location, ensuring that an up-to-date copy of the data is available in case of an attack. This approach minimizes the potential data loss and reduces the downtime caused by a ransomware incident. It allows for quick restoration of systems and data from the replicated copies, enabling the organization to resume normal operations as soon as possible.
P
Pika26
2023-03-22
1 upvote
Answer is A. Real-time off-site replication Real-time off-site replication provides the best response to a ransomware attack because it constantly updates a copy of your data in a separate, secure location. This allows for faster recovery in the event of a ransomware attack, as you can quickly restore your systems and data from the replicated copy without having to rely on potentially outdated or compromised backups. Additionally, having off-site replication adds another layer of protection against data loss due to physical damage or other site-specific issues.
F
franciscoalvares
2023-08-30
2 upvotes
the correct answer in my view is incremental backup. real-time replication would replicate the encrypted file systems to the site. full backup would take longer to recover.
Question 22 of 25
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity. The performance quality audit activity is done in what project management process group?
Show answer
Correct answer: A
How others answered
A57%
B43%
Only 57% agreed on this answer — treat it as contested rather than settled.
Explanation
B. Controlling The performance quality audit activity falls within the Controlling process group in project management. This process group focuses on monitoring and controlling project performance, ensuring that the project stays on track, and making any necessary adjustments to keep the project aligned with its objectives. Quality audits help to assess whether the project is following the defined processes, standards, and guidelines to achieve the desired level of quality.
Adapted from community discussion by Pika26 · 2023-03-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
pmi.org documentation
Permanent link to question 22 Report an issue
Candidate context
Question 22 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
P
Pika26
2023-03-22
2 upvotes
B. Controlling The performance quality audit activity falls within the Controlling process group in project management. This process group focuses on monitoring and controlling project performance, ensuring that the project stays on track, and making any necessary adjustments to keep the project aligned with its objectives. Quality audits help to assess whether the project is following the defined processes, standards, and guidelines to achieve the desired level of quality.
C
CYNLEE
2023-04-07
Selected A2 upvotes
Quality Audit is part of Quality Assurance activities under Executing Process Group oer PMBOK https://www.pmi.org/learning/library/practice-three-project-quality-management-7198
A
alfaMegatron
2024-08-30
Selected A1 upvote
During execution stage, the project team carries out the tasks defined in the project plan. A performance quality audit at this stage ensures that the project's deliverables meet the required quality standards. It involves reviewing work processes, checking for compliance with project specifications, and ensuring that the project's outputs are aligned with the expected quality.
G
GeorgeForever
2024-09-08
Selected A1 upvote
Executing Process Group Activity #10: Perform quality audits Quality audits are done during executing phase. This is for checking whether quality requirements of the project are met.
Question 23 of 25
A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy. What is the MOST effective method of risk analysis to provide the CFO with the information required?
Show answer
Correct answer: A
How others answered
A100%
Explanation
The MOST effective method of risk analysis to provide the CFO with the information required in this scenario would be A. Conduct a quantitative risk assessment
Adapted from community discussion by arifbhatkar · 2023-07-06 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 23 Report an issue
Candidate context
Question 23 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
A
arifbhatkar
2023-07-06
Selected A4 upvotes
The MOST effective method of risk analysis to provide the CFO with the information required in this scenario would be A. Conduct a quantitative risk assessment
H
hussmohsin
2022-10-19
4 upvotes
Correct answer is A, quantitative risk assessment provide risk in numbers
P
Perseus_68
2024-02-23
Selected A2 upvotes
A quantitative assessment gives a direct projection of cost/benefit which is what the question asks to be delivered in financial terms.
M
musagul
2024-02-24
1 upvote
As CFO requires inputs in Financial Terms ($,€), conducting quantitative will address this. I really wonder who prepared this questions.
Question 24 of 25
What is the definition of Risk in Information Security?
Show answer
Correct answer: A
How others answered
A100%
Explanation
Answer is C. C. In Information Security, the definition of Risk is: Risk = Threat x Probability. Risk refers to the potential for harm or loss resulting from a threat exploiting a vulnerability. A threat is any potential danger that could harm or compromise the confidentiality, integrity, or availability of an organization's information assets. Probability refers to the likelihood of a threat exploiting a vulnerability, while vulnerability is a weakness or gap in an organization's security defenses that could be exploited by a threat. By multiplying the likelihood of a threat exploiting a vulnerability (i.e., probability) by the potential impact of a successful attack (i.e., threat), organizations can determine the level of risk associated with a particular information asset or system. This formula allows organizations to quantify and prioritize risks and determine appropriate risk treatment strategies.
Adapted from community discussion by Pika26 · 2023-03-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 24 Report an issue
Candidate context
Question 24 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
P
Pika26
2023-03-19
2 upvotes
Answer is C. C. In Information Security, the definition of Risk is: Risk = Threat x Probability. Risk refers to the potential for harm or loss resulting from a threat exploiting a vulnerability. A threat is any potential danger that could harm or compromise the confidentiality, integrity, or availability of an organization's information assets. Probability refers to the likelihood of a threat exploiting a vulnerability, while vulnerability is a weakness or gap in an organization's security defenses that could be exploited by a threat. By multiplying the likelihood of a threat exploiting a vulnerability (i.e., probability) by the potential impact of a successful attack (i.e., threat), organizations can determine the level of risk associated with a particular information asset or system. This formula allows organizations to quantify and prioritize risks and determine appropriate risk treatment strategies.
M
Mr_Magoo1518
2023-11-22
2 upvotes
How is risk calculated in security? Risk is the combination of the probability of an event and its consequence. In general, this can be explained as: Risk = Likelihood × Impact. In particular, IT risk is the business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.
B
Boats
2023-05-11
Selected A1 upvote
Risk is the combination of the probability of an event and its consequence. In general, this can be explained as: Risk = Likelihood × Impact.
N
nshams
2024-07-07
1 upvote
chance of occuring an incident like earthquake and outcome of it which is the impact combines total risk
Question 25 of 25
What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?
Show answer
Correct answer: B
How others answered
B100%
Explanation
According to NIST 800-30: (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf) Risk management processes include: (i) framing risk; (ii) assessing risk; (iii) responding to risk; and (iv) monitoring risk. B=assesing risk
Adapted from community discussion by VOAKDO_cciso · 2024-05-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
nist.gov documentation
Permanent link to question 25 Report an issue
Candidate context
Question 25 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 712-50 or CertExamHQ.
V
velasco
2021-05-28
6 upvotes
The Correct Answer is B. Perform the risk Assessment ( NIST Special Publication 800-30 which describes the process of assessing information security risk in support goal defined in SP 800-37 and SP 800-39 and include 4 Step: 1- Prepare for Assessment, 2- Conduct Assesment, 3- Communicate results and 4- Maintain Assesment )
V
VOAKDO_cciso
2024-05-27
Selected B3 upvotes
According to NIST 800-30: (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf) Risk management processes include: (i) framing risk; (ii) assessing risk; (iii) responding to risk; and (iv) monitoring risk. B=assesing risk
P
Pika26
2024-03-19
1 upvote
Answer is B. The National Institute of Standards and Technology (NIST) SP 800-30 standard provides guidance on creating a risk management methodology. The second step in this process is to perform a risk assessment, which involves identifying and analyzing potential risks to the organization's assets, operations, and individuals. This step helps to determine the likelihood and potential impact of these risks and enables organizations to prioritize their risk management efforts.
R
Rufus1
2022-10-25
1 upvote
Hypothetically, If question would has been "What is the SECOND step to creating a risk management methodology according to ISO-27005 ?" The answer is B - Risk Assessment

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

About this question bank

Community-contributed

Compiled from exam discussions posted publicly by other people on ExamTopics. Copyright in each contribution rests with its original author; it is reproduced here for study. Not verified by us — most items carry no explanation. To request removal, see our content policy.

Compiled from ExamTopics community discussions

Compiled from publicly posted community exam discussions. Contributed by third parties rather than written here, so accuracy varies and most items carry no explanation.

Across the private full bank: 76 explanations, 173 questions with candidate context and 4 questions with direct citations.

Version 1.0.0 · bank updated 2026-08-29. How we source questions