1
Single choice~75s
Which activity BEST represents due care rather than due diligence?
CISSP
ISC2_CISSPReady to test yourself?
A timed, blueprint-proportional exam drawn fresh from this bank — with a per-domain score report.
🔓 Free preview: showing 10 of 252 questions. Unlock the full bank — every question, explanation, and reference.
Unlock all 252 questions →10 questions across 8 topics. Choose an answer for each question, then check it to see the correct answer and explanation.
Filter by topic
10 questions in Security and Risk Management
D1_RISK
Security and Risk Management
10 questions in topicGovernance, compliance and ethics, risk analysis and treatment, threat modeling, BCP, and personnel security.
2
Single choice~110s
An asset valued at $500,000 has an exposure factor of 40% for a threat occurring twice per year. What is the ALE?
3
Single choice~110s
A control costs $120,000 annually and reduces ALE from $300,000 to $60,000. What is the annual value of the control?
4
Single choice~75s
Who is ultimately accountable for the organization's information security program?
5
Single choice~75s
In STRIDE, an attacker denying they performed a transaction maps to which threat?
6
Single choice~75s
Which document is advisory rather than mandatory?
7
Single choice~75s
An organization's inherent risk is high, controls reduce it substantially, and management formally signs off on what remains. What remains is BEST called:
8
Single choice~75s
Which intellectual property protection requires public disclosure in exchange for exclusive rights?
9
Single choice~75s
Which best describes the purpose of a service organization control (SOC) 2 report to a customer's risk program?
10
Single choice~75s
The PRIMARY security purpose of mandatory vacations is to: