I85PREP
⌘ K
CCSM Elite R82 study materials
CCSM Elite R82 study resources

CCSM Elite R82 practice questions

One question at a time. Build your CCSM Elite R82 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Architecture and Design

In a layered security architecture, which layer is responsible for enforcing access control decisions based on subject identity and object classification?

  1. The network address translation gateway
  2. The security kernel's reference monitor function Correct answer.
  3. The physical perimeter fence and badge system
  4. The presentation layer of the application

Explanation

The reference monitor is the abstract enforcement mechanism that validates every access request against the security policy, and it is typically realized inside the security kernel. Perimeter and network controls are supporting layers, not the decision point for subject-to-object authorization.

Question 2Security Architecture and Design

Which property must a reference monitor satisfy for it to be considered trustworthy?

  1. It must be implemented in hardware only
  2. It must be complete, isolated, and verifiable Correct answer.
  3. It must be distributed across multiple administrative domains
  4. It must be configurable by end users at runtime

Explanation

A trustworthy reference monitor must mediate every access (complete), resist tampering (isolated), and be small enough to be analyzed formally (verifiable). Distribution, hardware-only implementation, and user configurability all undermine rather than establish those properties.

Question 3Security Architecture and Design

A defense-in-depth design places independent controls at the host, network, and data tiers so that a single failure does not expose the asset. Which design principle does this most directly express?

  1. Economy of mechanism
  2. Redundancy of controls Correct answer.
  3. Open design
  4. Least common mechanism

Explanation

Defense in depth relies on redundant, independent controls so that compromise of one layer does not yield access to the asset. Least common mechanism and economy of mechanism concern shared paths and simplicity, not layered duplication.

Question 4Security Architecture and Design

Which security model is specifically designed to prevent information flow from a higher classification to a lower one by assigning subjects clearance levels and objects labels?

  1. Clark-Wilson
  2. Biba
  3. Brewer-Nash
  4. Bell-LaPadula Correct answer.

Explanation

Bell-LaPadula addresses confidentiality with the no-read-up and no-write-down rules, which block high-classification data from flowing to lower levels. Biba is its integrity mirror image, and Clark-Wilson and Brewer-Nash address different concerns.

Question 5Security Architecture and Design

Under the Biba integrity model, which rule prevents a subject from reading an object at a lower integrity level?

  1. The simple integrity axiom Correct answer.
  2. The star integrity property
  3. The invocation property
  4. The tranquility principle

Explanation

The simple integrity axiom, often stated as no-read-down, stops a subject from ingesting lower-integrity data that could contaminate its own integrity level. The star property governs writes, while invocation and tranquility are Clark-Wilson and Bell-LaPadula concepts respectively.

Question 6Security Architecture and Design

A system designer needs a formal model that enforces integrity using well-formed transactions and separation of duty, with certified transformation procedures. Which model should be selected?

  1. Bell-LaPadula
  2. Graham-Denning
  3. Clark-Wilson Correct answer.
  4. Biba

Explanation

Clark-Wilson defines constrained data items, transformation procedures, and integrity verification procedures to enforce well-formed transactions and separation of duty. Biba and Bell-LaPadula use lattice labels, and Graham-Denning enumerates rights-based access operations.

Question 7Security Architecture and Design

In the Common Criteria framework, what does an Evaluation Assurance Level (EAL) communicate about a product?

  1. The depth and rigor of the evaluation performed on the product Correct answer.
  2. The monetary cost of certifying the product
  3. The number of vulnerabilities patched in the product
  4. The functional capabilities the product provides to users

Explanation

EALs describe the assurance, meaning the rigor and depth of analysis applied during evaluation, not the feature set. Functional requirements are captured separately in the Security Target and Protection Profile.

Question 8Security Architecture and Design

An architect is choosing between a Protection Profile and a Security Target in a Common Criteria evaluation. Which statement correctly distinguishes them?

  1. A Security Target is issued only after a Protection Profile has been retired
  2. A Protection Profile describes a product's implementation, while a Security Target defines a class of products
  3. A Protection Profile defines requirements for a class of products, while a Security Target describes a specific product's security claims Correct answer.
  4. Both documents are identical and interchangeable in all evaluations

Explanation

A Protection Profile states reusable security requirements for a category of products, whereas a Security Target states the security claims and requirements for one specific product under evaluation. They serve different roles and are not interchangeable.

Question 9Security Architecture and Design

Which cryptographic approach allows two parties who have never met to establish a shared secret over an untrusted channel without prior shared keys?

  1. Password-based authentication over TLS
  2. Symmetric key distribution via a trusted courier
  3. Public key exchange such as Diffie-Hellman Correct answer.
  4. Hash-based message authentication codes

Explanation

Diffie-Hellman and similar public key exchanges let parties derive a shared secret over an open channel, though they require authentication to resist man-in-the-middle attacks. Symmetric distribution and password schemes assume pre-existing shared material.

Question 10Security Architecture and Design

A design requires that compromise of a single symmetric key must not expose past session traffic. Which property should the protocol provide?

  1. Perfect forward secrecy Correct answer.
  2. Certificate pinning
  3. Key escrow
  4. Non-repudiation

Explanation

Perfect forward secrecy uses ephemeral key agreement so that compromise of a long-term key does not reveal previously established session keys. Non-repudiation, escrow, and pinning address different security goals.

Question 11Security Architecture and Design

In a mandatory access control system, what determines whether a subject may access an object?

  1. The strength of the subject's password
  2. System-wide policy labels assigned to subjects and objects Correct answer.
  3. The object owner's discretionary permission list
  4. The subject's role membership at login

Explanation

Mandatory access control bases decisions on system-assigned labels such as clearance and classification, not on owner discretion. Discretionary lists and role membership are characteristics of DAC and RBAC respectively.

Question 12Security Architecture and Design

An organization wants access decisions driven by job functions rather than individual identities, with permissions grouped so that staff can be reassigned quickly. Which access control model best fits?

  1. Role-based access control Correct answer.
  2. Rule-based access control
  3. Mandatory access control
  4. Discretionary access control

Explanation

Role-based access control assigns permissions to roles and then assigns users to roles, which simplifies reassignment and enforces function-based authorization. DAC relies on owner discretion, MAC on labels, and rule-based control on conditional rules.

Question 13Security Architecture and Design

Which statement best describes the purpose of the Trusted Computing Base (TCB) in a secure system?

  1. It is the set of components that must be trusted to enforce the security policy Correct answer.
  2. It is the audit log repository for security events
  3. It is the network segment that hosts authentication servers
  4. It is the collection of applications available to end users

Explanation

The TCB comprises all hardware, firmware, and software components whose correct operation is necessary to enforce the security policy. Minimizing and verifying the TCB is a core architectural goal.

Question 14Security Architecture and Design

A security architect reduces the TCB by removing unnecessary services from a hardened host. Which principle is being applied?

  1. Fail-safe defaults
  2. Defense in depth
  3. Least functionality Correct answer.
  4. Separation of duties

Explanation

Least functionality means configuring systems to provide only the capabilities required for the mission, which shrinks the attack surface and the TCB. Separation of duties, defense in depth, and fail-safe defaults address different concerns.

Question 15Security Architecture and Design

A system fails closed when its authorization service becomes unavailable, denying all access requests. Which design principle does this behavior demonstrate?

  1. Fail-safe defaults Correct answer.
  2. Psychological acceptability
  3. Open design
  4. Least common mechanism

Explanation

Fail-safe defaults specify that access should be denied when the system cannot make a correct decision, which is exactly what failing closed does. The other principles address design transparency, shared mechanisms, and usability.

Question 16Security Architecture and Design

Which technique best mitigates a covert timing channel between two processes on the same host?

  1. Encrypting all interprocess messages with AES-256
  2. Logging all system calls to a remote syslog server
  3. Introducing randomized delays and limiting shared resource contention Correct answer.
  4. Increasing the process priority of the sender

Explanation

Covert timing channels exploit observable differences in shared resource usage, so randomizing delays and reducing contention blunts the signal. Encryption does not remove timing observability, and logging or priority changes do not close the channel.

Question 17Security Architecture and Design

An architect is evaluating a security kernel design and wants to confirm it prevents subjects from bypassing mediation. Which property is being verified?

  1. Tamper resistance of the kernel
  2. Isolation of the audit trail
  3. Verifiability of the kernel source
  4. Completeness of mediation Correct answer.

Explanation

Completeness of mediation means every access by every subject to every object passes through the reference monitor, so no bypass path exists. Tamper resistance and verifiability are the other reference monitor properties.

Question 18Security Architecture and Design

Which security architecture pattern places a dedicated intermediary that inspects and filters traffic between zones, ensuring no direct path exists between them?

  1. Single-homed host with host-based firewalls only
  2. Flat network with VLAN segmentation
  3. Peer-to-peer mesh between zones
  4. Bastion host with a screened subnet Correct answer.

Explanation

A bastion host in a screened subnet forces traffic through an inspected choke point, which is a classic perimeter architecture for zone separation. Flat networks, meshes, and single-homed hosts do not create a mandatory inspection point.

Question 19Security Architecture and Design

A design uses a hypervisor to isolate multiple tenants on shared hardware. Which security concern is most specific to this architecture?

  1. Loss of physical access controls at the data center
  2. Reduced ability to perform network address translation
  3. Inability to apply security patches to guest operating systems
  4. Cross-tenant data remanence in shared memory and storage Correct answer.

Explanation

Multi-tenant virtualization concentrates risk in shared resources such as memory, caches, and storage, where residual data can leak between tenants. Physical controls, guest patching, and NAT are not unique to the hypervisor architecture.

Question 20Security Architecture and Design

Which statement correctly describes the relationship between a security policy and a security mechanism?

  1. The policy states what is allowed, and the mechanism enforces it Correct answer.
  2. The mechanism is always implemented in hardware, while the policy is in software
  3. They are synonyms and may be used interchangeably
  4. The mechanism defines what is allowed, and the policy implements it

Explanation

A security policy is the statement of rules and objectives, while mechanisms are the technical means that enforce those rules. Mechanisms can be implemented in hardware or software, so implementation medium is not what distinguishes them.

Question 21Security Architecture and Design

An architect is designing a system that must resist a determined attacker with insider knowledge of the design. Which principle supports publishing the design while keeping keys secret?

  1. Security through obscurity
  2. Open design Correct answer.
  3. Least privilege
  4. Need to know

Explanation

Open design, articulated by Kerckhoffs, holds that security should depend on secret keys rather than secrecy of the design. Obscurity may add friction but cannot be the foundation of resistance to a knowledgeable attacker.

Question 22Security Architecture and Design

A threat model identifies that an attacker could replay a captured authentication token to gain access. Which architectural control most directly addresses this?

  1. Encrypting the token with a static shared key
  2. Storing tokens in browser local storage
  3. Adding nonces and short token lifetimes with server-side validation Correct answer.
  4. Increasing password complexity requirements

Explanation

Replay attacks are defeated by binding tokens to a nonce or timestamp and enforcing short validity with server-side checks so a captured token cannot be reused. Password complexity, static encryption, and client storage do not prevent replay.

Question 23Security Architecture and Design

Which property of a cryptographic hash function is most important when the hash is used to detect unauthorized modification of a stored configuration file?

  1. Collision resistance Correct answer.
  2. Output length of exactly 128 bits
  3. Reversibility for recovery purposes
  4. Preimage resistance only

Explanation

Collision resistance prevents an attacker from substituting a different file with the same hash, which is essential for integrity verification. Preimage resistance alone does not stop a crafted substitute, and hashes must not be reversible.

Question 24Security Architecture and Design

In a system using the Chinese Wall model, a consultant who has worked on Client A's account may not access Client B's data when A and B are competitors. Which concept does this restriction represent?

  1. Trusted path
  2. Integrity label
  3. Conflict of interest class Correct answer.
  4. Covert channel

Explanation

The Chinese Wall model groups competing companies into conflict of interest classes and prevents a subject from accessing datasets across conflicting classes. Integrity labels, covert channels, and trusted paths are unrelated concepts.

Question 25Security Architecture and Design

A security architect must choose an assurance approach for a high-value component where formal mathematical proof of correctness is required. Which evaluation approach is most appropriate?

  1. A penetration test performed once before release
  2. A self-assessment questionnaire completed by the vendor
  3. Common Criteria EAL7 with formal design verification Correct answer.
  4. Common Criteria EAL1 functional testing

Explanation

EAL7 includes formal verification of the design and is the highest assurance level in Common Criteria, matching a requirement for mathematical proof. Self-assessment, single penetration tests, and EAL1 provide far weaker assurance.

Question 26Security Architecture and Design

An architect classifies a system as handling 'availability' as its primary security objective. Which design choice most directly supports that objective?

  1. Applying mandatory access controls to restrict subject-object access
  2. Deploying redundant components with automatic failover and load balancing Correct answer.
  3. Encrypting data at rest with keys held in a hardware security module
  4. Enforcing strict input validation on all user-supplied fields

Explanation

The three core security objectives are confidentiality, integrity, and availability. Availability concerns ensuring timely and reliable access to data and services, which redundancy and failover directly provide. The other choices primarily serve integrity or confidentiality rather than uptime.

Question 27Security Architecture and Design

A security architect is documenting the boundary between trusted and untrusted components. Which description best characterizes the reference monitor concept?

  1. A logging service that records every access attempt after it has been completed
  2. A hardware module that stores cryptographic keys and performs bulk encryption
  3. A policy language used to express which roles may invoke which operations
  4. An abstract machine that mediates all access between subjects and objects and is tamper-proof Correct answer.

Explanation

The reference monitor is an abstract concept describing the access-control mechanism that mediates every access, is always invoked, and cannot be bypassed or tampered with. Real implementations that satisfy these properties are called security kernels. Logging, key storage, and policy languages are supporting elements, not the reference monitor itself.

Question 28Security Architecture and Design

An architect must ensure a system cannot be tricked into executing attacker-supplied instructions through crafted input. Which design principle most directly addresses this class of flaw?

  1. Input validation and output encoding at trust boundaries Correct answer.
  2. Complete mediation of every request
  3. Separation of duties among administrators
  4. Least privilege for service accounts

Explanation

Injection-style flaws arise when untrusted data is interpreted as code or commands. Validating and canonicalizing input and encoding output at each trust boundary prevents data from being treated as instructions. The other principles limit the damage an account or role can cause but do not stop untrusted data from being misinterpreted.

Question 29Security Architecture and Design

An architect is selecting an assurance approach for a component where the cost of a flaw is extreme and the specification can be expressed formally. Which assurance method provides the strongest evidence of correctness?

  1. Formal verification of the design against a formal specification Correct answer.
  2. Static analysis tooling run in the continuous integration pipeline
  3. Independent penetration testing of the deployed component
  4. A code review performed by two senior developers

Explanation

Formal verification proves that a model of the system satisfies a formally stated specification, giving the strongest assurance when the specification is expressible mathematically. Testing and review provide evidence of quality but cannot exhaustively cover the input space. Static analysis finds classes of defects but does not prove conformance to a specification.

Question 30Security Architecture and Design

A security architect must prevent a high-integrity process from writing to a lower-integrity object while still allowing the reverse flow. Which model and rule set enforces that constraint?

  1. Biba, which forbids writing up and reading down Correct answer.
  2. Clark-Wilson, which constrains access through transformation procedures
  3. Bell-LaPadula, which forbids reading up and writing down
  4. Brewer-Nash, which dynamically restricts access based on conflict of interest

Explanation

Biba is an integrity model whose simple integrity property forbids a subject from reading lower-integrity data, and whose integrity star property forbids writing to a higher-integrity object. This blocks low-integrity data from contaminating high-integrity data. Bell-LaPadula protects confidentiality, while Clark-Wilson and Brewer-Nash address different concerns.

Question 31Risk Management and Governance

In a risk management framework, what does the term 'risk appetite' most precisely describe?

  1. The maximum financial loss a single business unit may absorb before escalation
  2. The amount and type of risk an organization is willing to pursue or retain to meet its objectives Correct answer.
  3. The list of risks that have been transferred to an insurer or third party
  4. The residual risk remaining after all mitigating controls are applied

Explanation

Risk appetite is a governance-level statement of how much and what kinds of risk the organization chooses to accept in pursuit of its objectives. It is set by the board or executive leadership and then expressed through tolerances and limits at lower levels. Loss caps, transfer lists, and residual figures are downstream instruments, not the appetite itself.

Question 32Risk Management and Governance

Which statement best captures the difference between risk tolerance and risk appetite?

  1. Tolerance is a qualitative narrative while appetite is always quantitative
  2. Tolerance is the acceptable variation around appetite expressed as measurable limits Correct answer.
  3. Tolerance is set by regulators while appetite is set by internal audit
  4. Tolerance applies only to operational risk while appetite covers strategic risk

Explanation

Appetite is the high-level declaration of willingness to take risk; tolerance operationalizes it into measurable boundaries and thresholds that trigger action when breached. Tolerances are usually expressed per risk category and cascade into limits and key risk indicators. The two are linked, not divided by risk type or by who sets them.

Question 33Risk Management and Governance

A three-lines model assigns independent assurance over risk management to which function?

  1. The third line, internal audit, which provides independent objective assurance Correct answer.
  2. The second line, which designs the risk framework and monitors compliance
  3. The first line, which owns and manages the risk day to day
  4. The external auditor, who reports to the audit committee on controls

Explanation

In the three-lines model, the first line owns and manages risk, the second line provides oversight and challenge through the risk and compliance functions, and the third line provides independent assurance. Internal audit sits in the third line and reports functionally to the audit committee to preserve independence. External audit provides assurance on financial statements, not on the design of the risk framework.

Question 34Risk Management and Governance

A board committee wants assurance that risk reporting is reliable without compromising the independence of the assurance provider. Which reporting line best supports this?

  1. The internal audit head reports administratively and functionally to the chief financial officer
  2. The internal audit head reports to the external auditor for scope approval
  3. The internal audit head reports to the head of risk and compliance for day-to-day direction
  4. The internal audit head reports functionally to the audit committee and administratively to the chief executive Correct answer.

Explanation

Dual reporting preserves independence: functional reporting to the audit committee safeguards the audit agenda, while administrative reporting to the chief executive handles HR and budget matters. Reporting to the CFO or the risk function creates a conflict because audit must assess those areas objectively. External audit does not direct internal audit scope.

Question 35Risk Management and Governance

In enterprise risk management, inherent risk is best defined as which of the following?

  1. The level of risk before any controls or mitigations are considered Correct answer.
  2. The risk that exceeds the organization's stated tolerance
  3. The risk that remains after controls have been designed and tested
  4. The risk that has been accepted by the board without treatment

Explanation

Inherent risk is the exposure that exists before controls are applied, providing a baseline against which control effectiveness is judged. Residual risk is what remains after controls, and the gap between the two indicates how much mitigation the controls actually deliver. Risks above tolerance require escalation rather than redefinition.

Question 36Risk Management and Governance

A control self-assessment shows a key control has a residual risk score well above tolerance while its inherent score is unchanged. What is the most reasonable interpretation?

  1. The risk has been transferred and should be removed from the register
  2. The tolerance threshold must be raised to match the residual score
  3. The control is operating effectively and the inherent rating should be lowered
  4. The control is weaker or less effective than previously assumed, so mitigation is insufficient Correct answer.

Explanation

If inherent risk is constant and residual risk rises, the implied effectiveness of the controls has fallen. That signals control degradation, design gaps, or testing that revealed weaknesses, and it should trigger remediation or escalation. Adjusting the inherent rating or the tolerance to fit the result would mask the issue rather than resolve it.

Question 37Risk Management and Governance

Which of the following is the clearest example of risk transfer rather than risk avoidance?

  1. Purchasing commercial insurance against cyber incident costs Correct answer.
  2. Adding a second approval step before payments are released
  3. Deciding not to enter a new foreign market
  4. Discontinuing a product line that carries product liability exposure

Explanation

Transfer shifts the financial consequence of a risk to a third party, most commonly through insurance or contractual indemnities, while the underlying activity continues. Avoidance means exiting the activity entirely, and mitigation reduces likelihood or impact through controls. Adding approvals and declining to enter a market are avoidance or mitigation, not transfer.

Question 38Risk Management and Governance

A firm buys insurance for a risk but the policy carries a large deductible. How should the retained portion be treated in the risk register?

  1. It should be merged into the insurer's risk profile and no longer tracked
  2. It should be recorded as retained risk up to the deductible and any exclusions Correct answer.
  3. It should be removed because insurance has transferred the whole risk
  4. It should be reclassified as an opportunity because insurance was purchased

Explanation

Insurance transfers loss above the deductible and within policy terms, but the deductible, co-insurance, and exclusions remain with the organization. Those retained elements must stay visible in the register and be measured against tolerance. Treating the whole risk as transferred overstates the protection actually obtained.

Question 39Risk Management and Governance

Which item is best classified as a key risk indicator rather than a key performance indicator?

  1. Percentage of customer complaints resolved within two days
  2. Number of failed login attempts per thousand sessions Correct answer.
  3. Quarterly revenue growth against plan
  4. Employee engagement score from the annual survey

Explanation

A key risk indicator tracks a driver or precursor of risk exposure, such as failed authentication attempts that signal rising cyber or fraud risk. Key performance indicators measure progress toward business objectives. Complaint resolution time, revenue growth, and engagement scores describe performance outcomes rather than forward-looking risk signals.

Question 40Risk Management and Governance

A risk register holds 400 entries and management cannot prioritize them. Which change most improves decision usefulness?

  1. Increasing the review frequency of every entry to weekly
  2. Scoring each risk on likelihood and impact and ranking by exposure against appetite Correct answer.
  3. Consolidating all entries into a single corporate-level risk
  4. Adding more free-text fields to capture each risk owner's narrative

Explanation

Prioritization requires a consistent scoring scheme that combines likelihood and impact and compares the result with appetite, so attention goes to the exposures that matter most. More narrative fields or more frequent reviews add effort without improving ranking. Collapsing everything into one entry destroys the granularity needed to assign owners and controls.

Question 41Risk Management and Governance

Under a typical governance structure, who holds ultimate accountability for the organization's enterprise risk management framework?

  1. The internal audit function, which assures the framework
  2. The board of directors, acting through its risk or audit committee Correct answer.
  3. The business unit managers, who own individual risks
  4. The chief risk officer, who designs and operates the framework

Explanation

The board is ultimately accountable for risk oversight and approves the appetite and framework, often delegating detailed oversight to a risk or audit committee. The chief risk officer designs and operates the framework, internal audit assures it, and business managers own specific risks. Accountability rests with the board even though execution is delegated.

Question 42Risk Management and Governance

A risk committee meets quarterly and reviews only risks that have already materialized. Which governance weakness does this most clearly represent?

  1. Excessive delegation of authority to business units
  2. A backward-looking focus that undermines proactive risk oversight Correct answer.
  3. Overreliance on external auditors for risk assessment
  4. Insufficient documentation of control testing evidence

Explanation

Effective risk governance is forward-looking: it monitors emerging and changing exposures against appetite, not just incidents that have already occurred. Reviewing only realized events turns the committee into a post-mortem body and leaves emerging risks unmanaged. The other options describe different weaknesses not evidenced by the scenario.

Question 43Risk Management and Governance

Which statement about the risk universe in an enterprise risk management program is most accurate?

  1. It is limited to risks that have previously caused losses
  2. It is identical for every organization in the same industry
  3. It is a structured inventory of risk categories and exposures relevant to the organization's objectives Correct answer.
  4. It is created once and remains static unless an incident occurs

Explanation

The risk universe is a structured, organization-specific view of the categories and exposures that could affect objectives, and it forms the scope for assessment and monitoring. It should be refreshed as strategy, environment, and operations change. It is neither limited to historical losses nor identical across firms.

Question 44Risk Management and Governance

A heat map plots likelihood against impact with several risks clustered in the high-impact, low-likelihood corner. What is the most defensible governance response?

  1. Reclassify them as opportunities to balance the portfolio
  2. Ignore them because low-likelihood events rarely occur
  3. Treat them as candidates for transfer or contingency planning given severe impact Correct answer.
  4. Remove them from the register until likelihood increases

Explanation

Low-likelihood, high-impact risks can be ruinous, so they warrant transfer mechanisms such as insurance, plus contingency and continuity planning. Dismissing them because they are unlikely confuses frequency with severity. Removing them from the register eliminates the visibility needed to prepare.

Question 45Risk Management and Governance

Which of the following best describes the purpose of a risk control matrix?

  1. To record the minutes of risk committee meetings
  2. To list the organization's insurance policies and their coverage limits
  3. To summarize the organization's financial statements for the board
  4. To map identified risks to the controls that mitigate them and the evidence of operation Correct answer.

Explanation

A risk control matrix links each risk to the specific controls designed to address it, along with owners, testing methods, and evidence. It supports assessment of whether mitigation is adequate and where gaps exist. Insurance schedules, meeting minutes, and financial statements serve different purposes.

Question 46Risk Management and Governance

A regulator introduces a new reporting obligation with a six-month deadline. How should this be handled in the risk framework?

  1. Treat it as a legal matter outside the risk framework entirely
  2. Defer any action until the obligation takes effect and breaches occur
  3. Record it as an opportunity because it may improve market reputation
  4. Log it as a compliance risk, assess the impact and readiness, and assign an owner with milestones Correct answer.

Explanation

A new obligation creates compliance and operational risk that should be assessed for impact and readiness, assigned an owner, and tracked through implementation milestones. Waiting for breaches converts a manageable change into an incident. Regulatory change is squarely within the risk framework's scope.

Question 47Risk Management and Governance

Which practice most strengthens the independence of a second-line risk function?

  1. Assigning the risk function responsibility for executing business transactions
  2. Having the risk function report to the business units whose risks it monitors
  3. Allowing the risk function to approve its own control testing results
  4. Giving the risk function authority to challenge and escalate independent of revenue owners Correct answer.

Explanation

Independence in the second line depends on the authority to challenge business decisions and escalate concerns without pressure from revenue owners, backed by a reporting line to senior leadership or the board. Reporting to the units it oversees, self-approving its testing, or executing transactions would compromise objectivity.

Question 48Risk Management and Governance

What is the primary purpose of stress testing within a risk management program?

  1. To replace the risk register with a single scenario output
  2. To evaluate how exposures behave under severe but plausible scenarios Correct answer.
  3. To satisfy insurance underwriting requirements only
  4. To confirm that historical average conditions will continue

Explanation

Stress testing examines portfolio or operational resilience under severe but plausible scenarios that go beyond business-as-usual assumptions. It reveals vulnerabilities and capital or liquidity shortfalls that average-based measures hide. It complements rather than replaces the risk register and is not limited to insurance needs.

Question 49Risk Management and Governance

A firm's risk appetite statement says it has 'low tolerance for compliance breaches' but its incentive scheme rewards sales volume with no compliance component. What is the governance concern?

  1. The incentive scheme conflicts with the stated appetite and undermines the risk culture Correct answer.
  2. The incentive scheme should be expanded to reward more volume
  3. The appetite statement is too vague to be measured
  4. Compliance breaches are operational and unrelated to incentives

Explanation

Risk appetite only shapes behavior when incentives, limits, and consequences align with it. Rewarding volume alone while declaring low tolerance for breaches creates a structural conflict that encourages the very behavior the appetite prohibits. Governance requires aligning remuneration and performance measures with stated risk boundaries.

Question 50Risk Management and Governance

Which of the following is the most appropriate role for the board's risk committee regarding the chief risk officer?

  1. Conducting the internal audit of the risk function
  2. Delegating all risk decisions to the chief risk officer without review
  3. Providing oversight, challenging the risk profile, and supporting the chief risk officer's independence Correct answer.
  4. Directing the chief risk officer's daily activities and approving individual trades

Explanation

The risk committee oversees and challenges the risk profile and protects the chief risk officer's ability to raise concerns without retaliation. It should not micro-manage daily operations or approve individual transactions, and it does not perform internal audit work. Its value lies in independent oversight and escalation.