23–25 correct
Excellent mastery
You can connect I14 governance, risk, controls, suppliers, metrics, and leadership decisions with strong evidence discipline.
High School IntermediateModule I1425-Question Module Test
I14 Security Policies and Risk Module Test
Test your mastery of fictional governance, risk assessment, business impact, treatment, controls, standards, exceptions, third-party risk, metrics, reporting, ownership, validation, and review.
Readiness Check
Before You Begin
0/5 ready
Assessment Rules
Complete One Exact 25-Question Assessment
1
Answer all 25 questions in the single quiz below.
2
Choose one answer before revealing the explanation.
3
Use only the fictional evidence and concepts from Module I14.
4
Do not assume missing evidence proves compromise, intent, outage, or impact.
5
Record your total score after completing every question.
6
Use the mastery review to revisit the lesson connected to each missed concept.
Check Your Understanding
I14 Module Test: 25 Questions
Choose your answers first. Explanations appear only after submission.
1. What is the main purpose of fictional security governance?
2. Who should normally accept significant fictional residual business risk?
3. Which statement correctly distinguishes fictional policy, standard, and procedure?
4. What makes a fictional risk scenario complete?
5. What is the difference between fictional inherent and residual risk?
6. Why should fictional evidence confidence be recorded separately from risk level?
7. What is the purpose of a fictional business-impact analysis?
8. What is the difference between fictional RTO and RPO?
9. What does a fictional missing business recovery owner prove?
10. Which fictional asset usually deserves the highest recovery priority?
11. Which set lists valid fictional risk-treatment options?
12. What does fictional risk transfer accomplish?
13. What makes a fictional compensating control defensible?
14. What should happen before a major fictional control change?
15. What is the strongest conclusion after a fictional control implementation ticket is completed?
16. What makes a fictional exception defensible?
17. What does an expired fictional supplier exception with an active account prove?
18. Why should fictional exceptions have expiration dates?
19. What is a fictional fourth party?
20. Why is fictional supplier concentration risk important?
21. What should a fictional supplier exit plan include?
22. What is the difference between fictional control coverage and control effectiveness?
23. What does a fictional ninety-eight percent compliance rate prove when the denominator and exclusions are unclear?
24. What belongs in a fictional leadership security report?
25. What makes the complete fictional I14 governance and risk package defensible?
Score Guide
Interpret Your Result
20–22 correct
Strong mastery
Review the few areas where ownership, evidence limits, or treatment choices were unclear.
17–19 correct
Developing mastery
Revisit the matching lessons and strengthen risk scenarios, supplier lifecycle, exceptions, and metric definitions.
13–16 correct
Partial mastery
Complete a structured review of I14.1 through I14.8 before moving forward.
0–12 correct
Rebuild foundations
Return to the lesson workflows, scenario labs, checklists, and portfolio artifacts in order.
Mastery Review
Match Missed Questions to the Right Lesson
1
I14.1 Governance and policy foundations
Mastery check
Distinguish authority, accountability, policy ownership, control ownership, risk ownership, escalation, and review.
Review guidance
Revisit I14.1 when decision rights or governance roles are unclear.
2
I14.2 Risk identification and assessment
Mastery check
Write a complete risk scenario and separate risk level from evidence confidence.
Review guidance
Revisit I14.2 when a score appears without evidence, assumptions, alternatives, and limits.
3
I14.3 Asset, data, and business impact
Mastery check
Connect criticality, dependencies, RTO, RPO, minimum service, and recovery ownership.
Review guidance
Revisit I14.3 when recovery priorities rely only on technical preference.
4
I14.4 Treatment and controls
Mastery check
Compare treatment options and validate business fit, dependencies, rollback, effectiveness, and residual risk.
Review guidance
Revisit I14.4 when implementation is treated as proof of effectiveness.
5
I14.5 Standards, procedures, and exceptions
Mastery check
Distinguish document layers and build controlled, time-bound exceptions.
Review guidance
Revisit I14.5 when deviations lack scope, authority, monitoring, expiration, or sunset plans.
6
I14.6 Third-party and supply-chain risk
Mastery check
Map suppliers, fourth parties, data, access, contracts, concentration, monitoring, recovery, and exit.
Review guidance
Revisit I14.6 when one report or contract is treated as complete assurance.
7
I14.7 Metrics, reporting, and review
Mastery check
Define purpose, scope, numerator, denominator, exclusions, source health, confidence, and decision use.
Review guidance
Revisit I14.7 when percentages or dashboard colors are treated as conclusions.
8
I14.8 Integrated lab
Mastery check
Prioritize active exposure, missing authority, recovery uncertainty, supplier dependencies, evidence limits, validation, and closure.
Review guidance
Revisit I14.8 when the final package lacks sequencing, ownership, or reassessment.
Defender Habits
I14 Module Mastery Checklist
Portfolio Prompt
Final Module Portfolio Check
Review your fictional I14 Security Policies and Risk Package. Confirm that it contains a governance charter, responsibility matrix, asset and BIA register, evidence-quality register, risk register, treatment plan, policy hierarchy, exception register, supplier review, metrics catalog, priority action plan, validation and closure criteria, reassessment triggers, technical report, leadership summary, reflection, and portfolio-safety statement.
Every finding should link to exact fictional evidence, confidence, alternatives, and limitations.
Every risk should have an authorized owner, treatment, deadline, and review trigger.
Every control should have an objective, business fit, evidence, validation, monitoring, and closure criteria.
Every artifact must remain fully fictional and privacy-safe.
Key Takeaways
What You Should Remember
1.Governance defines who has authority and accountability for security and risk decisions.
2.Risk assessment connects assets, scenarios, evidence, controls, likelihood, impact, uncertainty, ownership, and review.
3.Business-impact analysis guides dependency-aware recovery priorities.
4.Treatment decisions require proportionate controls, validation, business fit, and residual-risk ownership.
5.Exceptions must be narrow, controlled, approved, time-bound, monitored, and removable.
6.Supplier oversight covers the full lifecycle from business need through exit.
7.Metrics become useful only when their definitions, sources, limits, meaning, owners, and decisions are clear.
8.A defensible final package preserves both serious gaps and the limits of what the evidence proves.
Module Navigation