Mandate and governance Review questions Mandate and governance Advisory work begins with an authorized decision, not a blanket promise of safety. Map the business service and dependencies, then distinguish availability, integrity and confidentiality consequences. The adviser analyzes; delegated management accepts remaining risk. A policy or meeting minute does not prove that a decision condition was fulfilled, so trace one scenario through register, action and closure evidence. Current and target CSF outcomes can frame priorities aligned to mission rather than a universal compliance score. A passing notification-backup test reduces that exposure but says nothing about corrupt delivery addresses. Deliver a bounded charter, service map and target outcomes with evidence and authority. The map is revisable; missing proof about an account or provider establishes neither failure nor safety.
Review questions Test your understanding with these questions. Marking and saved results are available with a free account.
Question 1 A director asks a consultant to sign acceptance of admin access risk while the account inventory is incomplete. What is the proper engagement output? Sign provisional acceptance while noting inventory gaps Define diagnostic scope and present options to delegated authority Declare the system safe because an old report recorded no incident Question 2 A backup email channel passes a notice test, but the order database may corrupt addresses. Which conclusion follows? Notice exposure fell; address-integrity risk remains separate Both risks fell because they share a delivery service The dependency map can be retired after one backup succeeds Question 3 A committee required removal of a shared account. The ticket is closed, but the account appears in configuration. What is the decisive check? Count committee minutes this quarter Check account state, login route and decision-condition date Treat ticket closure as new risk acceptance Question 4 A CSF Profile marks incident policy complete, but an exercise found no one authorized to stop the app. How should current state be recorded? Complete because policy exists An escalation-outcome gap with the exercise evidence and its limits Failed across every Framework outcome Question 5 Three phishing attempts were seen with no known diverted payment. Which scenario can be analyzed? Each message is a separate financial loss A stolen credential plus unverified supplier-account change leads to wrong payment Every incoming email proves the control failed Question 6 An identity dashboard shows MFA for every admin-group member, but an external local emergency account is untested. What is accurate? All privileged access is protected Coverage is shown for the central group only; the local account is unknown The local account has breached the organization Question 7 One of three restore tests failed, but the database had no outage this quarter. What cannot be computed from those observations? Uncertainty about restorability Future database-outage probability as one third Need to inspect the failed-test cause Question 8 IT calls address changes low risk because the site stays online, but a change may misdirect a sensitive shipment. What calibration step helps? Keep the color because availability did not change Compare address integrity with outage impact and test change controls Average the teams’ ratings Question 9 A shared support account is used at peak and the individual route is untested. Which transitional response is strongest? Retain the shared account indefinitely for service Limited individual accounts with a peak task test and a date to disable the shared one Record video only while everyone keeps the password Question 10 Inventory costs 10,000, shared-account removal costs 25,000 and depends on it, and new monitoring costs 35,000. Budget is 50,000. Which package addresses an evidenced path? Inventory then removal for 35,000 Removal alone for 25,000 Monitoring alone counted as shared-account closure Question 11 Two services use different vendors but both depend on one identity platform. What risk needs testing? That different contracts guarantee operating independence An outage of shared identity affecting both services at once That email backup resolves every identity scenario Question 12 A product manager wrote “risk accepted until release” without delegated authority or review condition. What is the decisive gap? A longer document title Clear authority, scenario, limits, duration and cancellation triggers Removing alternatives from the decision record Question 13 An old system needs a shared maintenance account while policy bans it within a month. What exception design is defensible? Silently renew until the system upgrade Scheduled sessions with safeguards, approval, expiry and upgrade plan Cancel the policy for every system Question 14 Thirty backup jobs succeeded, but restoring search exceeded the organizational time limit. Which claim do job records support? Search service recovers within the limit Recorded backup jobs completed; recovery capability needs an outcome test Every record from yesterday is intact Question 15 MFA covers 190 of 200 central accounts, then 20 local accounts outside inventory appear. What is honest reporting? 95% of all privileged access is protected 190/200 for central accounts, with local review and a separate full-population denominator Count all 20 as MFA failures without checking Question 16 A ransomware exercise detected encryption in 12 minutes, but isolation approval took 90. Which response targets that failure? Buy a faster detector alone A bounded containment authority with a test of decision time Declare success because detection worked Question 17 Eleven of 18 address changes have visible tickets; the partner says the rest had phone approvals. Which executive statement is accurate? Thirty-nine percent of changes were fraudulent Seven lack visible tickets; call evidence is needed before judging authorization All changes are authorized because the partner says so Question 18 Security wants to stop bank-account changes, product fears payout delay, and support claims manual capacity. What should happen next? Let the three teams vote on risk Test demand and manual capacity with a temporary approval route and near review Keep automation because commerce matters more Question 19 Individual identity worked in a modern app, but three old apps cannot log the operator. When can the transition gate close? As soon as the modern app succeeds After testing a suitable old-app solution and proving service continuity and attribution When the project budget is spent Question 20 A committee acknowledged the report and funded replacement access, but supplier access remains and the replacement is untested. What is the risk status? Closed by receipt signature Open; funding proves neither acceptance of exposure nor closure Closed because the plan has a date Create a free account to mark your answers and save your progress.
