22 Risk, Policy Hierarchy & Ethics Practice Questions & Answers

1. 1. A hospital's records server is missing several vendor security patches. A ransomware group is known to scan the internet for exactly those unpatched versions. In standard risk vocabulary, how should the missing patches themselves be classified?

   • A.The threat, because software left unpatched is what actually inflicts the harm
   • B.The vulnerability, because it is a weakness an outside force is able to exploit✓ Answer
   • C.The threat vector, because it is the route the ransomware group travels inward
   • D.The risk, because exposure grows for every day the patches remain uninstalled

   A vulnerability is a weakness or gap in an asset or control that a threat can exploit. The ransomware group is the external threat, and the breach that could follow is the risk; the unapplied patches are the gap itself, which is what makes them the vulnerability.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (threat, vulnerability, risk)Report a problem with this question

2. 2. An organization has no staff, facilities, or operations within hundreds of miles of any coastline, yet its draft risk register lists hurricane storm surge as a threat. Under CC-level risk concepts, what is this organization's risk from storm surge?

   • A.Moderate, because every threat that can be named carries a baseline risk until treated
   • B.Essentially none, because a threat that meets no matching vulnerability creates no risk✓ Answer
   • C.High, because impact by itself sets the rating when a threat can destroy whole facilities
   • D.Undefined, because no risk can be rated until a quantitative method assigns it a value

   Risk exists only where a threat and a matching vulnerability intersect. An inland organization has no exposure that storm surge could act upon, so the threat is real in the world but produces no risk here; naming a threat does not by itself create risk.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk as the intersection of threat and vulnerability)Report a problem with this question

3. 3. A risk analyst records a scenario as “unlikely to occur, but it would halt production for three weeks.” Which two risk factors has the analyst just described?

   • A.“Unlikely” is the impact and “three weeks of lost production” is the likelihood
   • B.“Unlikely” is the residual risk and “three weeks of lost production” is the inherent risk
   • C.“Unlikely” is the likelihood and “three weeks of lost production” is the impact✓ Answer
   • D.“Unlikely” is the risk tolerance and “three weeks of lost production” is the risk appetite

   Likelihood is the probability that a risk materializes, while impact is the magnitude of the consequence if it does. Risk is assessed as a function of the two together, which is why a rare event with severe consequences can still deserve treatment.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (likelihood and impact)Report a problem with this question

4. 4. A newly hired security manager is launching an organization's first formal risk management programme. Which activity belongs at the start of the risk management lifecycle?

   • A.Assigning likelihood and impact ratings to each scenario on the register
   • B.Selecting the controls that will reduce the most serious exposures
   • C.Buying a cyber-insurance policy to cover the losses that would remain
   • D.Identifying and inventorying the assets that the organization depends upon✓ Answer

   The lifecycle begins with identification, and an organization cannot protect, rate, or insure what it has not first catalogued. Asset inventory establishes what has value, which is the input every later stage of assessment and treatment depends on.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk management lifecycle)Report a problem with this question

5. 5. A team has identified its assets, threats and vulnerabilities and has ranked every scenario by likelihood and impact. According to the risk management lifecycle, what comes NEXT?

   • A.Closing the register, because a completed assessment concludes the lifecycle's work
   • B.Deciding how each risk will be treated: avoided, mitigated, transferred or accepted✓ Answer
   • C.Restarting identification, because the threat landscape shifts faster than it is rated
   • D.Notifying regulators, because assessed risks must be disclosed outside the organization

   The lifecycle runs identify, assess, treat, then monitor. Prioritized results are the input to a treatment decision, and monitoring follows treatment as a continuous activity rather than replacing it, so the ranked register is not an end point.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk management processes)Report a problem with this question

6. 6. Before any safeguards existed, a data-loss scenario was rated high. After encryption, access reviews and monitoring were deployed, the exposure that remains is rated low. What is that remaining exposure called, and what must be done with it?

   • A.Inherent risk, which has to be driven to zero before the system may be put into service
   • B.Residual risk, which must fall within tolerance and then be formally accepted by management✓ Answer
   • C.Transferred risk, which now belongs to the vendors whose products provide those safeguards
   • D.Avoided risk, which needs no owner because the deployed controls removed the threat itself

   Inherent risk is the exposure before controls; what survives the controls is residual risk. No control set reduces risk to zero, so the residual must be brought within the organization's stated tolerance and then formally accepted by management, which owns that decision.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (inherent risk, residual risk, risk acceptance)Report a problem with this question

7. 7. A retailer evaluates a loyalty feature that would require storing customers' passport numbers. Management concludes the exposure cannot be brought within tolerance and cancels the feature before development begins. Which risk treatment is this?

   • A.Mitigation, because cancelling the work lowers the likelihood that the data leaks
   • B.Acceptance, because management has chosen to live with the exposure as it stands
   • C.Transference, because dropping the feature pushes the exposure onto competitors
   • D.Avoidance, because the activity that would create the exposure is never undertaken✓ Answer

   Avoidance means not starting, or discontinuing, the activity so the risk cannot arise at all. Mitigation would keep the feature and add controls around it, whereas here the exposure is eliminated by removing its cause rather than by reducing it.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk treatment: avoidance)Report a problem with this question

8. 8. A manufacturer purchases a cyber-insurance policy covering breach-response costs and business-interruption losses. Which statement BEST describes what the policy accomplishes?

   • A.It removes the risk outright, because a third party has assumed all the consequences
   • B.It avoids the risk, because insured activities no longer require controls of their own
   • C.It transfers much of the financial impact, while accountability stays with the company✓ Answer
   • D.It records acceptance of the risk, because paying a premium is a decision to absorb losses

   Transference shifts financial consequences to a third party; it does not shift the risk itself. Reputational damage, regulatory exposure and ultimate accountability for protecting the data remain with the organization, so controls are still required.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk treatment: transference/sharing)Report a problem with this question

9. 9. A legacy reporting tool carries a low-impact flaw. Management compares the remediation cost with the expected loss, finds remediation costs more, records the decision with a named owner and a review date, and takes no further action. Which treatment is this?

   • A.Acceptance, because it is a documented, approved choice to absorb an exposure✓ Answer
   • B.Neglect, because leaving a known flaw in place is always a failure of due care
   • C.Mitigation, because naming an owner and a review date lowers the likelihood
   • D.Transference, because the named owner now carries the loss personally instead

   Acceptance is a deliberate, documented and management-approved decision to absorb a risk that sits within tolerance, typically because the control would cost more than the expected loss. Simply ignoring a flaw is not acceptance, because no one has weighed or owned the decision.

   Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk treatment: acceptance)Report a problem with this question

10. 10. A company cannot stop accepting online payments and cannot obtain insurance for the exposure, but it can add multifactor authentication, tokenization and continuous monitoring to the payment path. Which risk treatment is being applied?

    • A.Avoidance, since new controls remove the conditions an attacker would need
    • B.Transference, since third-party technology shifts the loss to its vendors
    • C.Acceptance, since the business carries on knowing losses remain possible
    • D.Mitigation, since controls are added to lower both the likelihood and the impact✓ Answer

    Mitigation, also called reduction, keeps the activity running and applies controls that lower likelihood, impact, or both. It is distinguished from avoidance because the business process continues, and from transference because no third party assumes the financial consequence.

    Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk treatment: mitigation)Report a problem with this question

11. 11. A risk team rates each scenario Low, Medium or High using the judgment of department heads in a workshop, then plots the results on a heat map. Which approach is this, and what is its main limitation?

    • A.Qualitative, and it yields no monetary figures to support cost-benefit comparison✓ Answer
    • B.Quantitative, and it sets aside expert opinion in favour of raw incident counts
    • C.Quantitative, and it demands loss data that most organizations do not actually hold
    • D.Qualitative, and it may be applied only to reputational and other intangible harm

    Qualitative assessment uses subjective, descriptive ratings drawn from expert judgment and is typically displayed on a matrix or heat map. Because it produces no monetary values, it cannot directly support a cost-benefit case, which is what quantitative assessment adds.

    Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (qualitative and quantitative risk assessment)Report a problem with this question

12. 12. A security analyst documents a high residual risk in a new application and recommends against going live; the project sponsor wants to launch anyway. Under standard risk governance, who is ultimately accountable for accepting that risk?

    • A.The security analyst, who has the deepest technical understanding of the exposure
    • B.The system administrators, who operate the application and set its configuration
    • C.The internal audit team, which independently tests whether the controls are adequate
    • D.The senior executives, who own the business objectives the exposure is taken for✓ Answer

    Risk appetite and tolerance are set by senior management and the board, and the same level owns the decision to accept residual risk, because it owns the business objectives that the risk is being taken to achieve. Practitioners advise and implement, but they do not accept risk on the organization's behalf.

    Source: ISC2 CC Exam Outline, Security Principles — understand risk management concepts (risk tolerance and risk acceptance by senior management)Report a problem with this question

13. 13. A merchant's compliance officer lists four obligations the business must meet. Which one is a contractual industry standard rather than a law or government regulation?

    • A.The Payment Card Industry Data Security Standard, enforced through card-brand agreements✓ Answer
    • B.The EU General Data Protection Regulation, enforced by national authorities
    • C.The US HIPAA Security Rule, enforced by a federal department against covered entities
    • D.A state data-breach notification statute, enforced by that state's attorney general

    A law or regulation is imposed by a government and enforced by the state, while the payment card standard is imposed by the card brands through contract and enforced by fines and loss of processing privileges. Non-compliance is a breach of agreement, not of statute.

    Source: ISC2 CC Exam Outline, Security Principles — understand governance concepts (regulations and laws vs. standards)Report a problem with this question

14. 14. A privately owned United States manufacturer adopts the NIST Cybersecurity Framework to organize its security programme. What is that framework's status for this company?

    • A.An international treaty obligation, because states agree together on framework adoption
    • B.A binding federal regulation, because NIST publications carry the force of law nationwide
    • C.A voluntary framework the company has chosen to follow, unless a contract requires it✓ Answer
    • D.An enforceable industry standard, because auditors may fine any firm that departs from it

    Frameworks and guidelines are reference material an organization chooses to adopt; NIST guidance is mandatory for US federal agencies but voluntary for private industry unless a contract, regulator or customer requirement imports it. Adoption is a management decision, not a legal duty.

    Source: ISC2 CC Exam Outline, Security Principles — understand governance concepts (frameworks and guidelines)Report a problem with this question

15. 15. Among the document types in a security governance hierarchy, which one is advisory rather than mandatory?

    • A.Standards, which name recommended technologies that teams may swap out as convenient
    • B.Guidelines, which offer recommended practice and leave room for professional judgment✓ Answer
    • C.Procedures, which propose an order of steps that staff may rearrange to suit the task
    • D.Policies, which state management's aspirations without obliging anyone to follow them

    Guidelines are the only discretionary tier of the hierarchy: they suggest good practice and permit judgment. Policies, standards and procedures are all binding on those they cover, which is why treating a standard or a procedure as optional is a compliance failure.

    Source: ISC2 CC Exam Outline, Security Principles — understand governance concepts (policies, standards, procedures, guidelines)Report a problem with this question

16. 16. A governance document contains this sentence: “All company laptops must use full-disk encryption with AES-256.” Which document type does that sentence belong to?

    • A.A policy, because it is management's high-level statement of what the company values
    • B.A procedure, because it tells an administrator how to encrypt each laptop step by step
    • C.A standard, because it fixes the specific, measurable requirement that carries out policy✓ Answer
    • D.A guideline, because it recommends a strong algorithm that teams ought to prefer when possible

    A policy says what and why in technology-neutral terms; a standard says what specifically, naming the uniform, measurable requirement that implements the policy. Because the sentence is mandatory and names a precise technology without giving steps, it is a standard.

    Source: ISC2 CC Exam Outline, Security Principles — understand governance concepts (policies, standards, procedures)Report a problem with this question

17. 17. What gives an organization's security policy its authority over employees?

    • A.Technical review by the security engineering team, which confirms it is workable
    • B.Approval by senior management, which directs and is accountable for the business✓ Answer
    • C.Acknowledgement by affected staff, who sign it during annual awareness training
    • D.Certification by an external auditor, which confirms it matches industry practice

    Governance is exercised top down: a policy becomes binding because the senior management that directs the organization issues and endorses it. Technical review, audit opinions and employee acknowledgement may support a policy, but none of them confers authority.

    Source: ISC2 CC Exam Outline, Security Principles — understand governance concepts (policy issued and approved by senior management)Report a problem with this question

18. 18. A company engages an outside firm to assess a critical vendor's security controls and produce a report; it then funds and enforces the corrective measures the report recommends. Which terms describe the two activities, in order?

    • A.Negligence, then due care, because hiring an outside firm delegates responsibility
    • B.Due care, then due diligence, because acting precedes verifying the action worked
    • C.Due diligence, then due care, because knowing precedes acting on what is known✓ Answer
    • D.Due diligence, then negligence, because acting on another firm's report is imprudent

    Due diligence is the knowing: investigating, assessing and understanding what should be done. Due care is the doing: acting on that knowledge as a reasonable person would, by funding, applying and enforcing the measures. Knowledge necessarily comes before informed action.

    Source: ISC2 CC Exam Outline, Security Principles — Maintain professional and ethical conduct (due care and due diligence)Report a problem with this question

19. 19. A company is breached even though it had assessed the risk, funded reasonable controls and documented its decisions. Against what standard is its exercise of due care judged?

    • A.Against the outcome, since any successful attack demonstrates that care was lacking
    • B.Against the market, since due care requires buying the most advanced products sold
    • C.Against an auditor's certificate, since only certification can establish due care
    • D.Against the prudent person rule, since a reasonable peer's conduct is the measure✓ Answer

    Due care is measured by the prudent person rule: would a reasonable, prudent person in the same role with the same information have acted the same way? Because the rule judges the quality of the decision rather than the outcome, suffering a breach is not automatically negligence.

    Source: ISC2 CC Exam Outline, Security Principles — Maintain professional and ethical conduct (due care, prudent person standard)Report a problem with this question

20. 20. A certified professional finds that a client's product contains a flaw that could endanger the public. The client instructs him to say nothing in order to protect its reputation. Under the ISC2 Code of Ethics, which duty prevails, and why?

    • A.The duty to protect society, because the canons are applied in the order they appear✓ Answer
    • B.The duty to the client, because principals are owed the profession's strongest obligation
    • C.The duty to the profession, because public disclosure would embarrass practitioners
    • D.The professional's own preference, because the four canons carry equal weight in conflict

    The four canons are ordered, and when they conflict the lower-numbered canon governs. Canon I, protecting society, the common good and public trust, therefore outranks Canon III, the duty of diligent service to principals such as an employer or client.

    Source: ISC2 Code of Ethics, Canons I and III (canons applied in order of precedence)Report a problem with this question

21. 21. The ISC2 Code of Ethics states four canons in a fixed order. Which one is the SECOND canon?

    • A.“Act honorably, honestly, justly, responsibly, and legally.”✓ Answer
    • B.“Advance and protect the profession.”
    • C.“Provide diligent and competent service to principals.”
    • D.“Protect society, the common good, necessary public trust and confidence, and the infrastructure.”

    The canons run: protect society and the infrastructure; act honorably, honestly, justly, responsibly and legally; provide diligent and competent service to principals; advance and protect the profession. The order matters because it decides which duty wins when two conflict.

    Source: ISC2 Code of Ethics, Canon IIReport a problem with this question

22. 22. ISC2 maintains a Code of Ethics and also publishes a separate Code of Professional Conduct. Which statement describes the relationship between the two correctly?

    • A.The Code of Ethics is mandatory for certification holders; the conduct code guides broadly✓ Answer
    • B.Both codes are mandatory, and breaching either one is grounds for revoking a certification
    • C.The Code of Ethics binds employees only, while the conduct code binds outside contractors
    • D.The conduct code has replaced the Code of Ethics, so the four canons no longer bind members

    Adherence to the Code of Ethics is a condition of holding an ISC2 certification, and a violation can be sanctioned up to revocation. The Code of Professional Conduct builds upon it as non-binding guidance addressed to cybersecurity practitioners generally; it neither replaces the four canons nor becomes a basis for certification.

    Source: ISC2 Code of Ethics (adherence required of all members) and the ISC2 Code of Professional Conduct (supplemental, non-mandatory guidance)Report a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →