Free Certified Information Systems Risk Manager exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Information Systems Risk Manager exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A risk manager is establishing the organizational context that will guide later assessment, response, and monitoring decisions. Which component of the NIST risk management process is the manager performing?

   1. A.Risk framingCorrect answer: A
   2. B.Risk monitoring
   3. C.Risk assessment
   4. D.Risk response

   Explanation: NIST states that "The first component of risk management addresses how organizations frame risk or establish a risk context". Establishing that decision context is risk framing.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View — Section 2.1, Components of Risk Management, p. 6

2. 2A risk analyst identifies a weakness in a system's security procedures that a threat source could exploit. Which risk concept describes that weakness?

   1. A.Threat source
   2. B.Threat event
   3. C.Adverse impact
   4. D.VulnerabilityCorrect answer: D

   Explanation: NIST states that "A vulnerability is a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source." The described weakness meets that definition.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Vulnerabilities and Predisposing Conditions, p. 9

3. 3Leadership specifies the level of uncertainty the organization is prepared to accept in pursuing its objectives. Which element of its risk frame is leadership establishing?

   1. A.Risk assumptions
   2. B.Risk toleranceCorrect answer: B
   3. C.Risk constraints
   4. D.Risk priorities

   Explanation: NIST defines this element: "Risk tolerance is the level of risk or degree of uncertainty that is acceptable to organizations". Leadership is specifying acceptable uncertainty.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View — Section 2.3.3, Risk Management Strategy, p. 14

4. 4A risk manager describes an information security risk using the basic relationship in NIST SP 800-30. Which pair does that definition identify as the typical factors of risk?

   1. A.Impact and likelihoodCorrect answer: A
   2. B.Impact and vulnerability
   3. C.Threat source and vulnerability
   4. D.Threat source and likelihood

   Explanation: NIST describes risk as "typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence." The other factors can inform an assessment, but this definition identifies impact and likelihood.

   Reference: Guide for Conducting Risk Assessments — Section 2.3, Key Risk Concepts, p. 6

5. 5A risk manager examines the shared values, beliefs, and norms influencing how employees make decisions. What organizational feature is being examined?

   1. A.Organizational risk strategy
   2. B.Organizational risk tolerance
   3. C.Organizational cultureCorrect answer: C
   4. D.Organizational risk constraints

   Explanation: NIST defines the concept: "Organizational culture refers to the values, beliefs, and norms that influence the behaviors and actions of the senior leaders/executives and individual members of organizations." These shared influences describe culture.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View — Section 2.7, Organizational Culture, p. 28

6. 6A risk analyst chooses a quantitative assessment instead of using ordered risk categories. What distinguishes the quantitative values in the approach described by NIST SP 800-30?

   1. A.Their values are expressed as ordered nonnumerical categories.
   2. B.Their meanings and proportions are limited to the assessment context.
   3. C.Their meanings and proportions are maintained beyond the assessment context.Correct answer: C
   4. D.Their values are expressed as numeric bins with context-specific meanings.

   Explanation: NIST describes quantitative assessments as using numbers "where the meanings and proportionality of values are maintained inside and outside the context of the assessment". Context-specific numeric bins describe a semi-quantitative approach.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.2, Assessment Approaches, p. 14

7. 7Under the NIST Risk Management Framework, which role explicitly accepts the remaining risk as the final action before an information system is placed into operation?

   1. A.System owner
   2. B.Authorizing officialCorrect answer: B
   3. C.Control assessor
   4. D.Common control provider

   Explanation: NIST states that "the final action before a system is placed into operation is the explicit acceptance of risk by the authorizing official." The other roles have different risk management responsibilities.

   Reference: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy — Chapter 3, The Process, p. 24

8. 8A risk team selects the asset/impact-oriented analysis approach described in NIST SP 800-30. What should it identify as the starting point?

   1. A.Existing controls and their assessment results
   2. B.Threat sources and potentially relevant threat events
   3. C.Exploitable weaknesses and predisposing conditions
   4. D.Critical assets and adverse impacts of concernCorrect answer: D

   Explanation: NIST states that "An asset/impact-oriented approach starts with the identification of impacts or consequences of concern and critical assets". Threats and vulnerabilities are then analyzed in relation to those assets and impacts.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.3, Analysis Approaches, p. 15

9. 9Senior leaders issue broad cybersecurity risk guidance, and a program manager translates it into a specific acceptable level for a program objective. Under NIST IR 8286A, how do the two statements relate?

   1. A.Appetite measures risk before response; tolerance measures risk after response.
   2. B.Tolerance provides broad guidance; appetite applies it to specific objectives.
   3. C.Appetite provides broad guidance; tolerance applies it to specific objectives.Correct answer: C
   4. D.Tolerance measures risk before response; appetite measures risk after response.

   Explanation: NIST states, "Where risk appetite statements define the overarching risk guidance, risk tolerance statements define the specific application of that direction." The program-level statement applies the broad guidance.

   Reference: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management — Section 2.1.2, Risk Appetite and Risk Tolerance, p. 15

10. 10A risk manager needs to evaluate how the loss of a system asset could affect revenue, operations, and reputation. Which analysis provides a basis for identifying the asset's business criticality?

    1. A.Business impact analysisCorrect answer: A
    2. B.Control effectiveness assessment
    3. C.Vulnerability assessment
    4. D.Threat source assessment

    Explanation: NIST notes that "A BIA can help document many aspects of the value of an asset that may extend well beyond replacement costs." The described business consequences inform the asset's criticality.

    Reference: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management — Section 2.2.1, Asset Identification and Valuation, p. 25