Decision governance and risk boundaries Review questions Decision governance and risk boundaries — Integrated Summary Start a security decision with a service, an objective and an explicit tolerance rather than an abstract threat list. Turn risk appetite into a threshold owned by a decision maker, then describe a causal scenario linking threat source, access path, asset and consequence while separating known facts from uncertainty. Compare a portfolio of controls rather than a single tool: one may reduce likelihood, another consequence, and their combination may retain a shared dependency or operating cost. Check units, assumptions and sensitivity; expected loss is not a promise that an incident will cost precisely that amount. Record rejected alternatives, their reasons, the risk owner, and a date to reopen the decision if facts change. A service tolerance makes the escalation point visible. Success is a decision that remains auditable under uncertainty.
Review questions Test your understanding with these questions. Marking and saved results are available with a free account.
Question 1 A firm tolerates at most two hours of order-service loss but its register only says risk appetite is low. What makes this an actionable threshold? Rewrite appetite as very low Count installed security tools Name an owner who escalates a forecast breach of two hours with evidence and review date Promise that no outage will occur Question 2 Which statement describes a causal risk scenario rather than a generic risk label? A stolen supplier account changes a payment destination and missing approval logs delay discovery High cyberattack risk Buy a new tool immediately Anything might happen Question 3 One control reduces event likelihood and another limits consequence. What must be checked before adding their benefits? Whether their vendors have different names Overlap of effect and assumed independence Dashboard colors Team certification count Question 4 Who may accept a service risk above the defined tolerance after alternatives are presented? The tool owner alone The report writer The authorized risk-acceptance role together with the service owner Anyone at the meeting Question 5 What belongs on a critical booking-service path map? Supplier logo only User identity, trust boundary, transaction store, and external dependency Office device count Booking-page color Question 6 In a zero-trust model, what does the policy enforcement point (PEP) do? Approve budget Write the board risk decision Apply permit or deny to a resource access request Trust every user on the internal network Question 7 What distinguishes event logging from actionable detection? The signal arrives, is classified, has analyst capacity and prompts a defined action There is no difference Logging means the threat is contained Detection needs no timing Question 8 What is the minimum for a temporary exception for a legacy scanner? An oral promise with no date Open access to the entire system Exemption from all tests Scope, privilege, duration, compensating control, owner and closure date Question 9 How should an incident be classified before investigation is complete? By alert name alone By observed service effect and current evidence with uncertainty stated By the alert tool's reputation Wait for the final report before any decision Question 10 What should the first containment decision for a suspect admin account achieve? Erase all logs immediately Shut the service for a year Stop continuing harm while preserving evidence for analysis and recovery Publish a statement before checking scope Question 11 What belongs in the first public update during an unresolved incident? Confirmed facts, known effect, practical step and next update time An unverified final cause All sensitive evidence details A promise that no incident will recur Question 12 What closes a post-incident improvement action? Writing a lesson-learned sentence Naming an owner without a date Media attention ending A control change with owner, acceptance test and follow-up result Question 13 Which pair distinguishes RTO and RPO for an order service? Both are contract retention periods RTO is time to return the transaction; RPO is acceptable age of lost data RTO counts backups and RPO servers Both are budget caps Question 14 Why is the existence of a backup insufficient after ransomware? Every backup is necessarily infected Backups cannot store files The copy must be tested clean and usable, then transactions reconciled before service return is declared Ransomware never affects recovery Question 15 What does a tabletop prove compared with a functional restore test? It probes roles and decisions but does not prove real-data restore time It automatically proves RPO It always restores data It removes the need to measure a transaction Question 16 Why can a two-region service still fail in both regions? Two regions prevent every outage The second is always slower RTO never applies to suppliers Shared identity or DNS can disable both paths Question 17 How should a low-spend identity supplier first be tiered? Invoice value alone Effect on essential transactions, privilege and proven substitution time Employee count Age of its brand logo Question 18 What is the strongest evidence for exit from a login-code supplier? A clause saying export on request A replacement vendor quote Correct data and preference transfer, valid code transaction in a safe test, and old access revoked A recent marketing certificate Question 19 Eight of ten critical services were tested and six passed. What share of all critical services has proven success? 6/10 = 60% 6/8 = 75% 8/10 = 80% 100% because the rest did not fail Question 20 What is an acceptance gate in a twelve-month roadmap for? Proving that money was spent Changing the annual title Ensuring all projects start together Releasing the next phase only after a specific service result that can fail Create a free account to mark your answers and save your progress.
