Free BCS Practitioner Certificate in Information Risk Management Practice Questions

Sample Practice Questions

Try these 10 sample questions from the BCS Practitioner Certificate in Information Risk Management practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An agency assessed a system's information risk before deployment and is planning assessments during operation. Why should it revisit the original assessment even if that assessment was sound when completed?

   1. A.Systems, threats, and operating environments can change over time.Correct answer: A
   2. B.Assessments can include professional judgment about risk factors.
   3. C.Risk decisions can depend on organizational tolerance for risk.
   4. D.Assessments can consider impacts on several groups of stakeholders.

   Explanation: NIST explains that "the validity and usefulness of any risk assessment is bounded in time" because missions, systems, threats, and operating environments tend to change. The other factors describe risk assessment or decisions but do not explain why a sound assessment may become outdated.

   Reference: NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments — Section 2.2, Risk Assessment, page 6

2. 2A service disruption prevents authorized staff from accessing case files when they need them, although the files remain unchanged. Which information security property has been impaired by the disruption?

   1. A.Confidentiality
   2. B.AvailabilityCorrect answer: B
   3. C.Authenticity
   4. D.Integrity

   Explanation: NIST defines availability as "Ensuring timely and reliable access to and use of information." The interruption prevents timely access by authorized staff, so availability is impaired.

   Reference: NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments — Appendix B, Availability, page B-2

3. 3An agency is establishing an organization-wide information risk management program. NIST identifies whose strong commitment, direct involvement, and ongoing support as necessary for an effective program?

   1. A.Senior leaders and executivesCorrect answer: A
   2. B.Information system owners
   3. C.Mission and business owners
   4. D.Common control providers

   Explanation: NIST states that "organization‐wide risk management programs require the strong commitment, direct involvement, and ongoing support from senior leaders/executives." System, mission, and control owners participate in the program, while the cited requirement identifies senior leadership support.

   Reference: NIST SP 800-39: Managing Information Security Risk — Section 2.3.2, page 14

4. 4A business impact analysis establishes how far back in time transaction data can be restored after an outage, based on the latest backup. Which recovery measure is being determined?

   1. A.Recovery time objective
   2. B.Recovery point objectiveCorrect answer: B
   3. C.Maximum tolerable downtime
   4. D.Mean time to repair

   Explanation: NIST states that "The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered". It concerns the recoverable data point, rather than the time to restore the system.

   Reference: NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems — Section 3.2.1, Recovery Point Objective, page 17

5. 5An agency's risk matrix defines the risk score as the likelihood rating multiplied by the impact rating. For a threat rated 3 for likelihood and 4 for impact, what score does that matrix assign?

   1. A.3
   2. B.4
   3. C.7
   4. D.12Correct answer: D

   Explanation: NIST states that "Organizations assess the risks from threat events as a combination of likelihood and impact." Under this agency's specified matrix rule, 3 multiplied by 4 gives 12. The values 3 and 4 omit a factor, and 7 adds rather than multiplies the ratings.

   Reference: NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments — Section 3.2, Task 2-6, page 35

6. 6A risk treatment plan budgets $60,000 for implementation and $5,000 per year for maintenance over three years. Assuming those are the only costs, what is the total planned treatment cost for that period?

   1. A.$65,000
   2. B.$70,000
   3. C.$75,000Correct answer: C
   4. D.$180,000

   Explanation: NIST explains that "response costs should also include hardware and software maintenance". Over the stated period, the total is $60,000 plus three annual payments of $5,000, or $75,000.

   Reference: NIST IR 8286B Update 1: Prioritizing Cybersecurity Risk for Enterprise Risk Management — Section 2.4.1, Risk Response Cost, page 32

7. 7An agency has confirmed that a selected control is installed as specified. It now needs to determine whether the control has reduced the identified risk to the desired level. Which comparison addresses that question?

   1. A.Compare observed risk with the desired risk levelCorrect answer: A
   2. B.Compare current configuration with the approved configuration
   3. C.Compare the current threat environment with the prior environment
   4. D.Compare the actual installation date with the planned installation date

   Explanation: NIST says effectiveness monitoring determines whether implemented measures "have actually been effective in reducing identified risk to the desired level". Installation and configuration checks address implementation; they do not by themselves establish risk reduction.

   Reference: NIST SP 800-39: Managing Information Security Risk — Page 46, Monitoring Effectiveness

8. 8A practitioner is preparing the closing portion of a risk treatment business case for a nontechnical board. According to BCS guidance, what should the presentation finish by making clear?

   1. A.The proposed recommendations and the decisions requiredCorrect answer: A
   2. B.The estimated likelihood and the impact of each risk
   3. C.The implementation costs and the proposed delivery dates
   4. D.The information asset owners and the classification levels

   Explanation: BCS says the presentation "must finish with the recommendations and decisions they are required to make" for the treatment plan to move forward. Costs and risk information support the case, while the closing request identifies the decisions sought.

   Reference: BCS Practitioner Certificate in Information Risk Management Syllabus v7.1 — Page 17, Business Case Guidance

9. 9A federal agency is planning the frequency and resources for an information system risk assessment. NIST SP 800-30 states that these should be commensurate with which pair of assessment characteristics?

   1. A.The defined purpose and scopeCorrect answer: A
   2. B.The selected risk model and method
   3. C.The identified threats and vulnerabilities
   4. D.The established assumptions and constraints

   Explanation: NIST says that assessment frequency and resources are "commensurate with the expressly defined purpose and scope of the assessments". Risk models, threats, assumptions, and constraints inform assessment planning, but NIST identifies purpose and scope as the pair with which frequency and resources should be commensurate.

   Reference: NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments — Section 2.2, page 5

10. 10A system checks a user's presented credentials to verify the user's claimed identity before allowing access. Which security process is the system performing?

    1. A.Authorization
    2. B.Identification
    3. C.AuthenticationCorrect answer: C
    4. D.Non-repudiation

    Explanation: NIST defines authentication as "Verifying the identity of a user, process, or device". Checking credentials to verify a claimed identity is authentication; determining permissions is a separate authorization decision.

    Reference: NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments — Appendix B, Authentication, page B-2