I85PREP
⌘ K
CNCC(C) study materials
CNCC(C) study resources

CNCC(C) practice questions

One question at a time. Build your CNCC(C) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Architecture and Security Fundamentals

Which OSI layer is responsible for logical addressing and path selection between networks?

  1. Session layer
  2. Transport layer
  3. Data link layer
  4. Network layer Correct answer.

Explanation

The network layer handles logical (IP) addressing and routing decisions that move packets between different networks. The data link layer deals with physical addressing on a local segment, and the transport layer provides end-to-end delivery between processes.

Question 2Network Architecture and Security Fundamentals

What is the primary function of ARP on an IPv4 network?

  1. Assign IP addresses to hosts dynamically
  2. Translate private addresses to public addresses
  3. Encrypt traffic between two hosts
  4. Resolve an IP address to a MAC address Correct answer.

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its hardware address. This mapping lets a host build the frame needed to deliver a packet on the local link.

Question 3Network Architecture and Security Fundamentals

Which transport protocol provides reliable, ordered delivery with acknowledgments and retransmission?

  1. ARP
  2. UDP
  3. ICMP
  4. TCP Correct answer.

Explanation

TCP establishes a connection, numbers segments, acknowledges received data, and retransmits anything lost, so the byte stream arrives in order. UDP sends datagrams without these guarantees, while ICMP and ARP are not transport protocols for application data.

Question 4Network Architecture and Security Fundamentals

Which well-known port does a client contact to reach a standard HTTPS web server?

  1. 53
  2. 22
  3. 443 Correct answer.
  4. 80

Explanation

HTTPS by convention listens on TCP port 443, so a browser targeting https:// addresses connects there by default. Port 80 is plain HTTP, port 22 is SSH, and port 53 is DNS.

Question 5Network Architecture and Security Fundamentals

What does a subnet mask define for an IPv4 host?

  1. Which DNS server the host should query
  2. Which VLAN the switch should assign
  3. Which bits of the address identify the network portion Correct answer.
  4. Which default gateway is closest to the host

Explanation

The mask is a bit pattern where the 1 bits mark the network portion of the address and the 0 bits mark the host portion. The host uses that boundary to decide whether a destination is local or must be sent to a gateway.

Question 6Network Architecture and Security Fundamentals

Which device forwards frames based on destination MAC addresses within a single broadcast domain?

  1. Hub
  2. Firewall
  3. Layer 2 switch Correct answer.
  4. Router

Explanation

A switch learns which MAC address lives on which port and forwards frames only toward the correct port. A router moves packets between networks using IP addresses, and a hub simply repeats signals to every port.

Question 7Network Architecture and Security Fundamentals

Which statement describes the difference between symmetric and asymmetric encryption?

  1. Symmetric provides authentication while asymmetric provides confidentiality only
  2. Symmetric is only used for signing while asymmetric is only used for bulk data
  3. Symmetric uses one shared key while asymmetric uses a public and private key pair Correct answer.
  4. Symmetric uses a public and private key pair while asymmetric uses one shared key

Explanation

Symmetric algorithms use the same secret key for encryption and decryption, which is fast but requires secure key distribution. Asymmetric algorithms use a mathematically related key pair, so the public key can be shared openly while the private key stays secret.

Question 8Network Architecture and Security Fundamentals

Which security principle states that a user should receive only the access needed to perform their job?

  1. Defense in depth
  2. Least privilege Correct answer.
  3. Zero trust
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights required for its tasks, shrinking the damage a compromised or misused account can cause. Separation of duties instead splits critical tasks among people, and defense in depth layers multiple controls.

Question 9Network Architecture and Security Fundamentals

A host has address 192.168.10.130 with mask 255.255.255.192. Which address is the directed broadcast address of its subnet?

  1. 192.168.10.128
  2. 192.168.10.255
  3. 192.168.10.191 Correct answer.
  4. 192.168.10.129

Explanation

A /26 mask gives blocks of 64 addresses, so the subnets are .0, .64, .128, and .192. The host .130 falls in the .128 block, whose broadcast is the last address before the next block, .191.

Question 10Network Architecture and Security Fundamentals

A packet from 10.1.1.5 to 10.1.2.20 arrives at a router. What does the router use to choose the outgoing interface?

  1. The TTL value carried in the IP header
  2. The destination TCP port number
  3. The source MAC address recorded in the frame header
  4. The destination IP address matched against its routing table Correct answer.

Explanation

A router performs a longest-prefix match of the destination IP address against its routing table to select the next hop and outgoing interface. MAC addresses are rewritten hop by hop, and port numbers and TTL do not select routes.

Question 11Network Architecture and Security Fundamentals

Why does a stateful firewall permit return traffic for a session that the internal host initiated?

  1. It inspects only the source MAC address of each packet
  2. It tracks the connection state and allows packets belonging to an established session Correct answer.
  3. It relies on the internal host to re-authenticate each packet
  4. It allows all inbound traffic from any external source by default

Explanation

A stateful firewall records each permitted session in a state table and lets replies that match an existing entry pass back. This avoids writing a separate inbound rule for every ephemeral return flow.

Question 12Network Architecture and Security Fundamentals

Which record type should an administrator create so that mail is delivered to a domain's mail servers?

  1. CNAME
  2. MX Correct answer.
  3. A
  4. PTR

Explanation

MX records name the mail exchangers for a domain and carry a preference value that senders use to order them. A records map names to IPv4 addresses, CNAMEs create aliases, and PTR records support reverse lookups.

Question 13Network Architecture and Security Fundamentals

What does the three-way handshake accomplish before TCP data transfer begins?

  1. It assigns an IP address to the client
  2. It synchronizes initial sequence numbers and confirms both sides can send and receive Correct answer.
  3. It resolves the server hostname to an address
  4. It negotiates the encryption keys used for the session

Explanation

The SYN, SYN-ACK, ACK exchange lets each side advertise its initial sequence number and confirms bidirectional reachability. Only after this exchange does the connection enter the established state and carry data.

Question 14Network Architecture and Security Fundamentals

An attacker floods a server with SYN packets from spoofed source addresses. Which resource is most directly exhausted?

  1. The server's DNS zone records
  2. The server's ARP cache entries
  3. The server's table of half-open connections Correct answer.
  4. The server's disk space for log files

Explanation

Each SYN creates a half-open entry awaiting the final ACK, and spoofed sources never complete the handshake, so the backlog fills. Legitimate clients are then unable to open new connections.

Question 15Network Architecture and Security Fundamentals

Which characteristic distinguishes a virus from a worm?

  1. A virus needs a host file or user action to spread, while a worm propagates on its own Correct answer.
  2. A virus targets servers, while a worm targets workstations
  3. A virus spreads only over email, while a worm spreads only over USB drives
  4. A virus encrypts files, while a worm only displays messages

Explanation

A virus attaches to a host program or document and typically requires the host to be executed or opened to spread. A worm is self-contained and spreads across networks by exploiting services without user involvement.

Question 16Network Architecture and Security Fundamentals

What is the main security weakness of WEP in wireless networks?

  1. It cannot authenticate clients at all
  2. It requires certificates that are too large for clients
  3. Its RC4-based key stream can be recovered from captured traffic Correct answer.
  4. It only supports the 5 GHz band

Explanation

WEP combines a short static key with a 24-bit initialization vector using RC4, and repeated IVs let an attacker collect enough traffic to recover the key. This design flaw makes WEP unsuitable regardless of key length.

Question 17Network Architecture and Security Fundamentals

Which IPsec mode encrypts the entire original packet, including its headers, by wrapping it in a new IP header?

  1. Tunnel mode Correct answer.
  2. Main mode
  3. Transport mode
  4. Aggressive mode

Explanation

Tunnel mode encapsulates the whole original packet inside a new IP packet, hiding the inner addresses from the transit network. Transport mode protects only the payload and leaves the original IP header in the clear.

Question 18Network Architecture and Security Fundamentals

What does a digital signature primarily provide to a recipient?

  1. Anonymity of the sender on the network
  2. Confidentiality of the message contents
  3. Proof of origin and integrity of the message Correct answer.
  4. Compression of the message for transport

Explanation

The sender signs a hash of the message with a private key, and anyone with the public key can verify both that the message came from the key holder and that it was not altered. Confidentiality requires separate encryption.

Question 19Network Architecture and Security Fundamentals

A company places its web servers in a screened subnet reachable from the internet while keeping databases on an internal segment. Which design concept does this illustrate?

  1. Single sign-on
  2. Flat network topology
  3. Network segmentation with a DMZ Correct answer.
  4. Load balancing

Explanation

Putting internet-facing servers in a separate screened subnet limits what an attacker who compromises them can reach. The internal database segment stays behind additional filtering, so compromise of the web tier does not grant direct access.

Question 20Network Architecture and Security Fundamentals

Which address range is reserved for IPv4 link-local autoconfiguration?

  1. 172.16.0.0/12
  2. 10.0.0.0/8
  3. 169.254.0.0/16 Correct answer.
  4. 127.0.0.0/8

Explanation

When DHCP fails, an IPv4 host may self-assign an address in 169.254.0.0/16, which is valid only on the local link. The other ranges serve private networking or loopback purposes.

Question 21Network Architecture and Security Fundamentals

A host with address 172.16.45.200/28 sends a packet to 172.16.45.210. What will the host do?

  1. Forward the packet to its default gateway for routing
  2. Send the packet to the DNS server for resolution
  3. Drop the packet because the destination is in another subnet
  4. Resolve the destination MAC with ARP and send the frame directly on the local link Correct answer.

Explanation

A /28 mask yields blocks of 16, so 172.16.45.200 and 172.16.45.210 both fall inside 172.16.45.192/28. Because the destination is on-link, the host ARPs for it and delivers the frame directly.

Question 22Network Architecture and Security Fundamentals

An organization needs to divide 192.168.5.0/24 into subnets supporting at least 50 usable hosts each. What is the largest number of such subnets it can create?

  1. 16
  2. 8
  3. 2
  4. 4 Correct answer.

Explanation

Fifty usable hosts require 6 host bits, giving 62 usable addresses per subnet, so the prefix must be /26. Borrowing 2 bits from the /24 host portion yields 4 subnets of 64 addresses each.

Question 23Network Architecture and Security Fundamentals

Why is ARP spoofing effective for launching an on-path attack on a local subnet?

  1. ARP replies are validated against DNS records
  2. Switches block all broadcast frames by default
  3. Hosts accept unsolicited ARP replies and update their mappings without verification Correct answer.
  4. ARP messages are encrypted with a shared group key

Explanation

ARP has no authentication, so a host that receives a gratuitous reply claiming an address maps to the attacker's MAC will overwrite its cache. Traffic for the gateway is then sent to the attacker, who can relay it while reading it.

Question 24Network Architecture and Security Fundamentals

A TLS session is established between a client and a server. Which statement best describes the role of the server's certificate in that exchange?

  1. It stores the symmetric session key for later reuse
  2. It binds the server's public key to its identity through a trusted issuer's signature Correct answer.
  3. It encrypts the session's bulk data with a long-term shared secret
  4. It proves the client's identity to the server

Explanation

The certificate contains the server's public key and identity, signed by a certificate authority the client trusts. During the handshake the server proves possession of the matching private key, letting the client authenticate the endpoint before deriving session keys.

Question 25Network Architecture and Security Fundamentals

An administrator wants to allow inbound HTTPS to one internal server while preventing internet hosts from initiating connections to any other internal host. Which control best achieves this?

  1. An any-any access rule applied to the external interface
  2. A static route pointing all internet traffic to the internal server
  3. A hub connecting the internet link to the internal segment
  4. A stateful firewall rule permitting inbound TCP 443 to that server's address only Correct answer.

Explanation

A rule scoped to the server's address and destination port 443 permits exactly the intended service while stateful tracking handles return traffic. All other inbound initiation attempts are denied by the default policy.

Question 26Network Architecture and Security Fundamentals

Which OSI layer is responsible for logical addressing and path selection between different networks?

  1. Layer 4, the transport layer
  2. Layer 1, the physical layer
  3. Layer 2, the data link layer
  4. Layer 3, the network layer Correct answer.

Explanation

The network layer handles logical addressing and routing, deciding how packets travel between separate networks. Layer 2 handles frames within a local segment, while layer 4 manages end-to-end delivery and ports. Routers operate primarily at layer 3 for this reason.

Question 27Network Architecture and Security Fundamentals

Which protocol resolves a known IPv4 address into a hardware address on a local network?

  1. DHCP
  2. ARP Correct answer.
  3. ICMP
  4. DNS

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address. This mapping lets a host build a frame for delivery on the local segment. DNS maps names to addresses, and DHCP assigns addresses rather than resolving them.

Question 28Network Architecture and Security Fundamentals

A user reports that an internal web application is reachable by IP address but fails when the hostname is used. Which troubleshooting step best isolates the cause?

  1. Query the configured DNS server for the hostname Correct answer.
  2. Verify that the client's default gateway is reachable
  3. Check whether the server's NIC is operating at full duplex
  4. Confirm that the client's subnet mask matches the server's

Explanation

Working by IP but failing by name points to name resolution rather than connectivity, so querying the DNS server directly tests the suspect component. If the query returns the wrong record or times out, the fault lies in DNS configuration or records. Gateway, duplex, and mask problems would typically break IP-based access as well.

Question 29Network Architecture and Security Fundamentals

An administrator must let remote staff reach internal resources without exposing those servers directly to the internet, while keeping traffic encrypted end to end from the client. Which solution fits best?

  1. A remote-access VPN terminating on the network edge Correct answer.
  2. A stateless packet filter permitting inbound TCP 3389
  3. A reverse proxy publishing each internal server
  4. A DMZ that hosts copies of the internal servers

Explanation

A remote-access VPN authenticates users and creates an encrypted tunnel so internal hosts stay unreachable from the open internet. Traffic is protected from the client to the VPN gateway, and access can be restricted by policy. Publishing servers or opening management ports exposes them directly.

Question 30Network Architecture and Security Fundamentals

A switch port is configured to permit only one source MAC address and to shut down on violation. An attacker on another port floods frames with random source MAC addresses. What is the most likely effect on the protected port?

  1. The protected port will begin forwarding flooded frames
  2. The CAM table entry limit will be exceeded and the port will err-disable
  3. The attacker's frames will be dropped and the protected port stays up Correct answer.
  4. The protected port will fall back to hub mode and broadcast all traffic

Explanation

Port security limits apply per protected port, so spoofed frames arriving on other ports do not consume its allowed MAC entry. The violation counter on the attacker's own port would rise and that port would be disabled instead. Flooding affects the shared CAM table only if the table itself is exhausted, which is a separate condition.

Question 31Cybersecurity Governance, Law, and Compliance

Under China's Cybersecurity Law, which entity is designated as the primary responsible body for coordinating cybersecurity work nationwide?

  1. The Ministry of Public Security
  2. The National Development and Reform Commission
  3. The Cyberspace Administration of China Correct answer.
  4. The State Secrecy Bureau

Explanation

The Cybersecurity Law assigns the Cyberspace Administration of China the lead coordinating role for national cybersecurity protection and related supervision. Other departments handle specific functions within their own scopes rather than overall coordination.

Question 32Cybersecurity Governance, Law, and Compliance

Which principle requires that personal information be collected only for a clear and legitimate purpose and limited to what is necessary?

  1. Data anonymization
  2. Data localization
  3. Data portability
  4. Data minimization Correct answer.

Explanation

Data minimization limits collection and processing to the minimum necessary for a specified, legitimate purpose. It is a core principle in personal information protection regimes and reduces exposure from over-collection.

Question 33Cybersecurity Governance, Law, and Compliance

A company stores personal information of Chinese customers on servers located in Singapore. Under China's Personal Information Protection Law, which requirement applies to this cross-border transfer?

  1. It is prohibited unless the customers individually consent in writing
  2. It must satisfy one of the prescribed transfer mechanisms such as security assessment, certification, or standard contract Correct answer.
  3. It requires only internal management approval recorded in a log
  4. It is allowed freely because Singapore has adequate protection laws

Explanation

The Personal Information Protection Law requires cross-border transfers to rely on a prescribed mechanism, such as a security assessment, certification, or standard contractual clauses, plus notification and separate consent. Adequacy alone does not create a free-transfer exception.

Question 34Cybersecurity Governance, Law, and Compliance

Which of the following best describes the role of a data protection officer in an organization?

  1. Approving the annual financial statements of the organization
  2. Setting the organization's product pricing strategy
  3. Managing physical security guards at facilities
  4. Advising on compliance obligations and acting as a contact point for regulators and data subjects Correct answer.

Explanation

A data protection officer monitors compliance with privacy rules, advises the organization, and serves as a liaison with supervisory authorities and individuals. The role is advisory and oversight-oriented rather than operational in finance or facilities.

Question 35Cybersecurity Governance, Law, and Compliance

An employee discovers that a contractor has copied customer records onto a personal laptop. Which action best reflects an incident response obligation under governance frameworks?

  1. Delete the contractor's files quietly to avoid reputational harm
  2. Wait until the next quarterly audit to mention it
  3. Report through the incident process and preserve evidence while containing the exposure Correct answer.
  4. Post the details on social media to pressure the contractor

Explanation

Governance frameworks require timely internal reporting, containment, and evidence preservation so the incident can be assessed and any notification duties evaluated. Concealment or delay undermines both legal compliance and investigative integrity.

Question 36Cybersecurity Governance, Law, and Compliance

Which law is the primary statute governing the protection of personal information in China?

  1. Personal Information Protection Law Correct answer.
  2. Anti-Unfair Competition Law
  3. Cybersecurity Law
  4. Data Security Law

Explanation

The Personal Information Protection Law is the dedicated statute for processing personal information, setting rules on consent, individual rights, and cross-border transfer. The Cybersecurity Law and Data Security Law address broader network and data security concerns.

Question 37Cybersecurity Governance, Law, and Compliance

A financial institution must retain transaction records for a minimum period. Which governance concept does this requirement illustrate?

  1. Records retention obligation Correct answer.
  2. Purpose limitation
  3. Data portability
  4. Right to erasure

Explanation

Records retention obligations require organizations to keep certain records for a defined period to support audits, investigations, and regulatory oversight. This differs from principles governing how data is used or transferred.

Question 38Cybersecurity Governance, Law, and Compliance

Which of the following is the best example of a preventive security control in a governance program?

  1. Mandatory security awareness training before system access is granted Correct answer.
  2. Restoring data from backup after ransomware encryption
  3. Conducting a post-incident lessons-learned review
  4. Reviewing logs after a breach is detected

Explanation

Preventive controls stop incidents before they occur, and requiring training before granting access reduces the likelihood of human-error breaches. The other choices are detective or corrective activities that operate after or during an event.

Question 39Cybersecurity Governance, Law, and Compliance

An organization wants to demonstrate that its security controls meet a recognized standard to customers. Which approach most directly serves this goal?

  1. Obtaining independent certification against a recognized security standard Correct answer.
  2. Publishing an internal memo declaring full compliance
  3. Removing third-party vendors from the supply chain
  4. Increasing the marketing budget for security claims

Explanation

Independent certification provides third-party assurance that controls align with a recognized standard, which customers can rely on. Self-declaration lacks external validation and carries little evidentiary weight.

Question 40Cybersecurity Governance, Law, and Compliance

Under a typical governance model, who holds ultimate accountability for an organization's cybersecurity risk?

  1. The help desk supervisor
  2. The external penetration tester
  3. The board of directors Correct answer.
  4. The junior security analyst

Explanation

Ultimate accountability for risk oversight rests with the board, which sets risk appetite and holds management responsible. Operational roles execute controls but do not bear governing accountability.

Question 41Cybersecurity Governance, Law, and Compliance

A multinational firm processes data of EU residents and also Chinese customers. Which statement best describes its compliance challenge?

  1. It may choose one jurisdiction's rules and ignore the others
  2. It must satisfy overlapping obligations from multiple jurisdictions simultaneously Correct answer.
  3. It is exempt because it operates across borders
  4. It only needs to follow the law of its headquarters country

Explanation

Cross-border operations create overlapping legal obligations, and organizations generally must meet each applicable regime's requirements rather than selecting one. Extraterritorial reach means headquarters location does not limit exposure.

Question 42Cybersecurity Governance, Law, and Compliance

Which activity best exemplifies a data protection impact assessment?

  1. Counting the number of servers in a data center
  2. Systematically evaluating privacy risks of a new processing activity before launch Correct answer.
  3. Testing whether firewalls block unauthorized traffic
  4. Reviewing employee expense claims for fraud

Explanation

A data protection impact assessment identifies and mitigates privacy risks of a planned processing activity before it begins. It focuses on risks to individuals from data handling, not on infrastructure counts or financial controls.

Question 43Cybersecurity Governance, Law, and Compliance

An organization receives a lawful request from a regulator for customer records. What is the most appropriate governance response?

  1. Delete the records so they cannot be provided
  2. Ignore the request to protect customer privacy
  3. Forward the full database to all staff for review
  4. Validate the request's legal basis and respond through an authorized, documented process Correct answer.

Explanation

Governance requires verifying the legal authority of a request and responding through a controlled, documented channel that preserves accountability. Ignoring, over-sharing, or destroying records each create legal and ethical exposure.

Question 44Cybersecurity Governance, Law, and Compliance

Which element is most essential to a defensible security policy framework?

  1. Policies approved by senior management with defined roles and review cycles Correct answer.
  2. Policies written once and never revisited
  3. Verbal instructions that are never documented
  4. A long list of technical tools without ownership

Explanation

A defensible framework needs formal management approval, clear ownership, and periodic review so policies stay current and enforceable. Undocumented or static instructions cannot demonstrate governance.

Question 45Cybersecurity Governance, Law, and Compliance

A vendor will process sensitive customer data on the organization's behalf. Which contractual element is most important for governance?

  1. A clause allowing the vendor to resell the data
  2. A promise that no incidents will ever occur
  3. Unlimited liability waivers for the vendor
  4. Defined security obligations, audit rights, and breach notification duties Correct answer.

Explanation

Vendor contracts should impose security obligations, preserve the customer's right to audit, and require timely breach notification so risk can be managed. Provisions that expand vendor freedom or disclaim accountability undermine governance.

Question 46Cybersecurity Governance, Law, and Compliance

Which statement accurately reflects the relationship between the Data Security Law and the Cybersecurity Law in China?

  1. They are complementary statutes, with one emphasizing data classification and the other network security Correct answer.
  2. Neither applies to private organizations
  3. The Data Security Law repeals the Cybersecurity Law entirely
  4. They are identical in scope and fully replace each other

Explanation

The two statutes operate together: the Cybersecurity Law addresses network security, while the Data Security Law adds data classification, handling, and security obligations. They are complementary rather than mutually exclusive.

Question 47Cybersecurity Governance, Law, and Compliance

An organization classifies data by sensitivity and applies stronger controls to the most sensitive tier. What governance outcome does this primarily achieve?

  1. Elimination of all security incidents
  2. Guaranteed customer consent for all uses
  3. Proportionate protection aligned with risk Correct answer.
  4. Complete removal of regulatory obligations

Explanation

Tiered classification lets organizations apply controls proportional to sensitivity and risk, focusing resources where harm would be greatest. It reduces risk but cannot eliminate incidents or legal duties.

Question 48Cybersecurity Governance, Law, and Compliance

Which of the following best describes the purpose of a security awareness program from a governance perspective?

  1. Replacing all technical controls with training
  2. Reducing human-factor risk and supporting a culture of compliance Correct answer.
  3. Shifting legal liability entirely to employees
  4. Satisfying auditors without changing behavior

Explanation

Awareness programs reduce human-factor risk and build a compliance culture that supports policy effectiveness. They complement technical controls rather than replace them and cannot shift legal liability away from the organization.

Question 49Cybersecurity Governance, Law, and Compliance

A breach affects individuals in multiple countries with different notification deadlines. What is the most prudent governance approach?

  1. Wait for all deadlines to pass before notifying anyone
  2. Map each jurisdiction's deadlines and notify according to the earliest applicable requirements Correct answer.
  3. Notify only the country with the largest customer base
  4. Notify only if media coverage occurs

Explanation

When multiple notification regimes apply, organizations should map each deadline and comply with the strictest applicable timing to avoid missing any obligation. Selective or delayed notification risks penalties in the omitted jurisdictions.

Question 50Cybersecurity Governance, Law, and Compliance

Which of the following is a key component of an organization's risk appetite statement?

  1. The level of risk the organization is willing to accept in pursuit of its objectives Correct answer.
  2. A list of every employee's job title
  3. The marketing slogan for the coming year
  4. A complete inventory of office furniture

Explanation

A risk appetite statement articulates how much risk the organization will accept to pursue its goals, guiding decisions and control investment. It is a governance instrument, not an operational inventory.