NEW QUESTION 1
- (Exam Topic 3)
Which of the following would be a risk practitioner's BEST course of action when a project team has accepted a risk outside the established risk appetite?
A. Reject the risk acceptance and require mitigating controls.
B. Monitor the residual risk level of the acc...
NEW QUESTION 1
- (Exam Topic 3)
Which of the following would be a risk practitioner's BEST course of action when a project team has accepted a risk outs
A. Reject the risk acceptance and require mitigating controls.
B. Monitor the residual risk level of the accepted risk.
C. Escalate the risk decision to the project sponsor for review.
D. Document the risk decision in the project risk register.
NEW QUESTION 2
- (Exam Topic 3)
Which of the following controls BEST enables an organization to ensure a complete and accurate IT asset inventory?
A. Prohibiting the use of personal devices for business
B. Performing network scanning for unknown devices
C. Requesting an asset list from business owners
D. Documenting asset configuration baselines
NEW QUESTION 3
- (Exam Topic 3)
When defining thresholds for control key performance indicators (KPIs). it is MOST helpful to align:
A. information risk assessments with enterprise risk assessments.
B. key risk indicators (KRIs) with risk appetite of the business.
C. the control key performance indicators (KPIs) with audit findings.
D. control performance with risk tolerance of business owners.
NEW QUESTION 4
- (Exam Topic 3)
The PRIMARY objective for requiring an independent review of an organization's IT risk management process should be
A. assess gaps in IT risk management operations and strategic focus.
B. confirm that IT risk assessment results are expressed as business impact.
C. verify implemented controls to reduce the likelihood of threat materialization.
D. ensure IT risk management is focused on mitigating potential risk.
NEW QUESTION 5
- (Exam Topic 3)
Which of the following BEST enables an organization to determine whether external emerging risk factors will impact the
A. Control identification and mitigation
B. Adoption of a compliance-based approach
C. Prevention and detection techniques
D. Scenario analysis and stress testing
NEW QUESTION 6
- (Exam Topic 3)
Which of the following is the MAIN purpose of monitoring risk?
A. Communication
B. Risk analysis
C. Decision support
D. Benchmarking
NEW QUESTION 7
- (Exam Topic 3)
Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?
,After implementing countermeasures listed in ‘’Risk Response Descriptions’’ for each of the Risk IDs, which of the follow
change?
A. Risk Impact Rating
B. Risk Owner
C. Risk Likelihood Rating
D. Risk Exposure
NEW QUESTION 9
- (Exam Topic 3)
Which of the following would BEST indicate to senior management that IT processes are improving?
A. Changes in the number of intrusions detected
B. Changes in the number of security exceptions
C. Changes in the position in the maturity model
D. Changes to the structure of the risk register
NEW QUESTION 10
- (Exam Topic 3)
Which of the following is a risk practitioner's BEST recommendation to address an organization's need to secure multiple
A. Apply available security patches.
B. Schedule a penetration test.
C. Conduct a business impact analysis (BIA)
D. Perform a vulnerability analysis.
,C. Management attestation that the control is operating effectively
D. Automated data indicating that risk has been reduced
NEW QUESTION 15
- (Exam Topic 3)
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cyc
A. Risk monitoring
B. Risk mitigation
C. Risk aggregation
D. Risk assessment
NEW QUESTION 17
- (Exam Topic 3)
Which of the following BEST indicates the effectiveness of anti-malware software?
A. Number of staff hours lost due to malware attacks
B. Number of downtime hours in business critical servers
C. Number of patches made to anti-malware software
D. Number of successful attacks by malicious software
NEW QUESTION 22
- (Exam Topic 3)
In an organization that allows employee use of social media accounts for work purposes, which of the following is the BE
information from being exposed?
A. Educating employees on what needs to be kept confidential
B. Implementing a data loss prevention (DLP) solution
C. Taking punitive action against employees who expose confidential data
D. Requiring employees to sign nondisclosure agreements
NEW QUESTION 26
- (Exam Topic 3)
Which of We following is the MOST effective control to address the risk associated with compromising data privacy with
A. Establish baseline security configurations with the cloud service provider.
B. Require the cloud prowler 10 disclose past data privacy breaches.
C. Ensure the cloud service provider performs an annual risk assessment.
D. Specify cloud service provider liability for data privacy breaches in the contract
NEW QUESTION 28
- (Exam Topic 3)
Which of the following would provide the BEST evidence of an effective internal control environment/?
A. Risk assessment results
B. Adherence to governing policies
C. Regular stakeholder briefings
D. Independent audit results
NEW QUESTION 32
- (Exam Topic 3)
A risk practitioner identifies a database application that has been developed and implemented by the business independ
BEST course of action?
A. Escalate the concern to senior management.
B. Document the reasons for the exception.
C. Include the application in IT risk assessments.
D. Propose that the application be transferred to IT.
, B. Validate organizational risk appetite.
C. Review results of prior risk assessments.
D. Include the current and desired states in the risk register.
NEW QUESTION 47
- (Exam Topic 3)
Which of the following presents the GREATEST risk to change control in business application development over the com
A. Emphasis on multiple application testing cycles
B. Lack of an integrated development environment (IDE) tool
C. Introduction of requirements that have not been approved
D. Bypassing quality requirements before go-live
NEW QUESTION 49
- (Exam Topic 3)
Which of the following is the BEST evidence that a user account has been properly authorized?
A. An email from the user accepting the account
B. Notification from human resources that the account is active
C. User privileges matching the request form
D. Formal approval of the account by the user's manager
NEW QUESTION 54
- (Exam Topic 3)
An employee lost a personal mobile device that may contain sensitive corporate information. What should be the risk pra
A. Conduct a risk analysis.
B. Initiate a remote data wipe.
C. Invoke the incident response plan
D. Disable the user account.
NEW QUESTION 59
- (Exam Topic 3)
Which of the following is the MOST comprehensive resource for prioritizing the implementation of information systems c
A. Data classification policy
B. Emerging technology trends
C. The IT strategic plan
D. The risk register
NEW QUESTION 61
- (Exam Topic 3)
When of the following is the BEST key control indicator (KCI) to determine the effectiveness of en intrusion prevention s
A. Percentage of system uptime
B. Percentage of relevant threats mitigated
C. Total number of threats identified
D. Reaction time of the system to threats
NEW QUESTION 64
- (Exam Topic 3)
Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?
A. The number of stakeholders involved in IT risk identification workshops
B. The percentage of corporate budget allocated to IT risk activities
C. The percentage of incidents presented to the board
D. The number of executives attending IT security awareness training
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller THEEXCELLENCELIBRARY. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $16.99. You're not tied to anything after your purchase.
