Free PCIRM sample questions

Correct answer: Advise the CIO that information risk management must span the entire information lifecycle, beginning at the creation or collection phase and ending with secure destruction.

Information risk management must be applied throughout the entire information lifecycle—from creation/collection, storage, use, sharing, archiving, to final destruction. Waiting until a system is in production ignores risks during the design, development, and data collection phases, violating the 'secure by design' principle.

Correct answer: The inability to demonstrate due diligence to regulators, leading to severe reputational damage, loss of stakeholder confidence, and punitive regulatory fines.

While all options represent negative outcomes, the most severe and long-term consequence of lacking an IRM programme is the failure to demonstrate due diligence. In regulated industries, this leads to loss of stakeholder confidence, reputational ruin, and massive regulatory penalties (e.g., under GDPR or FCA regulations), which can threaten the organisation's survival.

Correct answer: False

False. The scenario describes 'Availability' or 'Resilience'. Non-repudiation is the assurance that someone cannot deny the validity of something (e.g., denying that they sent a specific message or executed a specific transaction).

Correct answer: ISO 31000 for enterprise-wide risk management and ISO 27005 for information security risk management.

ISO 31000 provides the overarching guidelines for enterprise-wide risk management applicable to any type of risk. ISO 27005 provides specific guidelines for information security risk management. Using them together ensures that information security risks are managed in a way that aligns perfectly with corporate risk governance.