Question 1

One Tech's AO has been informed of a significant change in the threat landscape, which increases the likelihood of a previously low-impact vulnerability being exploited. What should the AO do in response to this new information?

Options :

A : Immediately revoke the system-s ATO

B : Request an updated security control assessment focusing on the affected vulnerability

C : Consult with the system owner and security team to evaluate the increased risk and determine appropriate mitigation measures

D : Wait for the next scheduled security control assessment to review the risk

Answer: C

Question 2

Which of the following best describes the benefits of using automation to support control assessments in the context of an information security program?

Options :

A : Automation completely eliminates the need for manual control assessments and human intervention

B : Automation reduces the time and effort required for control assessments by providing continuous monitoring and real-time reporting

C : Automation ensures that all security controls are implemented flawlessly, with no room for error

D : Automation guarantees that all assessed security controls will receive the highest possible effectiveness rating

Answer: B

Question 3

Which of the following is the MOST challenging aspect of asset identification in the context of information security risk management?

Options :

A : Identifying all assets within the organization-s network

B : Determining the value of each asset in terms of its importance to the organization

C : Identifying and categorizing assets based on their criticality to the organization-s operations

D : Determining the level of risk associated with each asset

Answer: A

Question 4

True or False: Risk response is the final step in the NIST Risk Management Framework and involves implementing security controls to address identified risks.

Options :

A : TRUE

B : FALSE

Answer: B

Question 5

Which of the following is a key factor in the success of a security awareness and training program?

Options :

A : Use of technical jargon and complex language

B : Delivery of training in a one-time, stand-alone format

C : Alignment with organizational goals and culture

D : Restriction of training to high-risk employees only

Answer: C

Higher Test Marks with Free Online CGRC Exam Practice

Buying Options: