The BEST metric to monitor the risk associated with changes deployed to production is the percentage of:
Which of the following is MOST important to consider when determining risk appetite?
Which of the following BEST protects organizational data within a production cloud environment?
Which of the following techniques is MOST helpful when quantifying the potential loss impact of cyber risk?
Which of the following is the BEST way to identify changes to the risk landscape?
A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?
Which of the following risk activities is BEST facilitated by enterprise architecture (EA)?
Which of the following is the MOST important success factor when introducing risk management in an organization?
Which of the following is the GREATEST risk associated with an environment that lacks documentation of the architecture?
Which of the following tools is MOST effective in identifying trends in the IT risk profile?
After several security incidents resulting in significant financial losses, IT management has decided to outsource the security function to a third party that provides 24/7 security operation services. Which risk response option has management implemented?
Which of the following would MOST likely cause management to unknowingly accept excessive risk?
What is the PRIMARY reason an organization should include background checks on roles with elevated access to production as part of its hiring process?
The operational risk associated with attacks on a web application should be owned by the individual in charge of:
Which of the following is MOST important to communicate to senior management during the initial implementation of a risk management program?
In order to determining a risk is under-controlled the risk practitioner will need to
An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST.
Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?
Which of the following approaches MOST effectively enables accountability for data protection?
Which of the following techniques would be used during a risk assessment to demonstrate to stakeholders that all known alternatives were evaluated?
Following a business continuity planning exercise, an organization decides to accept an identified risk associated with a critical business system. Which of the following should be done next?
Which of the following BEST reduces the risk associated with the theft of a laptop containing sensitive information?
Which of the following is the MOST important reason to integrate IT risk management practices into the enterprise-wide operational risk management framework?
Which of the following risk register updates is MOST important for senior management to review?
When assessing the maturity level of an organization’s risk management framework, which of the following should be of GREATEST concern to a risk practitioner?
An organization has made a decision to purchase a new IT system. During when phase of the system development life cycle (SDLC) will identified risk MOST likely lead to architecture and design trade-offs?
Which of the following is the PRIMARY consideration when determining the impact to an organization after the discovery of malware on an endpoint device?
Which of the following is the BEST indication that an organization ' s IT asset life cycle is poorly managed?
After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to
An organization ' s IT infrastructure is running end-of-life software that is not allowed without exception approval. Which of the following would provide the MOST helpful information to justify investing in updated software?
Which of the following BEST mitigates reputational risk associated with disinformation campaigns against an organization?
Which of the following should be given the HIGHEST priority when developing a response plan for risk assessment results?
Which of the following process controls BEST mitigates the risk of an employee issuing fraudulent payments to a vendor?
Which of the following is the PRIMARY reason for monitoring activities performed in a production database environment?
The PRIMARY reason to have risk owners assigned to entries in the risk register is to ensure:
Which of the following is MOST important to consider when selecting risk indicators (KRIs)? The ability to:
Which of the following should be done FIRST when developing a data protection management plan?
Which stakeholder is MOST important to include when defining a risk profile during me selection process for a new third party application?
A risk practitioner is collaborating with key stakeholders to prioritize a large number of IT risk scenarios. Which scenarios should receive the PRIMARY focus?
Who is PRIMARILY accountable for identifying risk on a daily basis and ensuring adherence to the organization ' s policies?
Which of the following would be of MOST concern to a risk practitioner reviewing risk action plans for documented IT risk scenarios?
An organization requires a third party for processing customer personal data. Which of the following is the BEST approach when sharing data over a public network?
Which of the following is MOST important requirement to include in a Software as a Service (SaaS) vendor contract to ensure data is protected?
Which of the following is the MOST important benefit of reporting risk assessment results to senior management?
Which of the following is the MOST effective control to ensure user access is maintained on a least-privilege basis?
Which of the following is the PRIMARY risk management responsibility of the second line in the three lines model?
Which of the following would be the GREATEST challenge when implementing a corporate risk framework for a global organization?
Which of the following would be MOST helpful to a risk practitioner when ensuring that mitigated risk remains within acceptable limits?
Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?
Which of the following is the MOST efficient method for monitoring control effectiveness?
An organization has implemented a preventive control to lock user accounts after three unsuccessful login attempts. This practice has been proven to be unproductive, and a change in the control threshold value has been recommended. Who should authorize changing this threshold?
Which of the following should a risk practitioner recommend FIRST when an increasing trend of risk events and subsequent losses has been identified?
The MOST essential content to include in an IT risk awareness program is how to:
Which of the following is the MOST valuable data source to support the optimization of an existing key risk indicator (KRI)?
Which of the following is a risk practitioner ' s MOST important action to reduce the likelihood of internal fraud?
Which of the following would be MOST helpful to an information security management team when allocating resources to mitigate exposures?
Which of me following is MOST helpful to mitigate the risk associated with an application under development not meeting business objectives?
Recent changes in an organization ' s business strategy requires an application to increase its recovery point objective (RPO). Which of the following MUST be updated?
Which of the following is the BEST approach for selecting controls to minimize risk?
Which of the following is the BEST way to quantify the likelihood of risk materialization?
Which of the following is MOST important to ensure before using risk reports in decision making?
After migrating a key financial system to a new provider, it was discovered that a developer could gain access to the production environment. Which of the following is the BEST way to mitigate the risk in this situation?
Real-time monitoring of security cameras implemented within a retail store is an example of which type of control?
Which of the following controls would BEST reduce the likelihood of a successful network attack through social engineering?
While reviewing the risk register, a risk practitioner notices that different business units have significant variances in inherent risk for the same risk scenario. Which of the following is the BEST course of action?
Which of the following is MOST important information to review when developing plans for using emerging technologies?
Which of the following is the MOST critical factor to consider when determining an organization ' s risk appetite?
Which of the following is the MOST important consideration for the board and senior leadership
regarding the organization ' s approach to risk management for emerging technologies?
An audit reveals that there are changes in the environment that are not reflected in the risk profile. Which of the following is the BEST course of action?
When assessing the maturity level of an organization ' s risk management framework, which of the following deficiencies should be of GREATEST concern to a risk practitioner?
A risk practitioner has been asked to advise management on developing a log collection and correlation strategy. Which of the following should be the MOST important consideration when developing this strategy?
A department has been granted an exception to bypass the existing approval process for purchase orders. The risk practitioner should verify the exception has been approved by which of the following?
After identifying new risk events during a project, the project manager s NEXT step should be to:
Which of the following should be the MOST important consideration when performing a vendor risk assessment?
Following an acquisition, the acquiring company ' s risk practitioner has been asked to update the organization ' s IT risk profile What is the MOST important information to review from the acquired company to facilitate this task?
An organization ' s decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:
An organization has completed a risk assessment of one of its service providers. Who should be accountable for ensuring that risk responses are implemented?
Who is MOST important lo include in the assessment of existing IT risk scenarios?
What is the BEST information to present to business control owners when justifying costs related to controls?
A PRIMARY advantage of involving business management in evaluating and managing risk is that management:
From a data protection and regulatory compliance perspective, which of the following is the MOST important reason for a global organization to use immutable backups?
Which of the following is the MOST important reason to report on changes or trends related to an organization ' s IT risk profile?
Which risk analysis methodology uses diagrams to analyze causes and consequences of particular risk events?
Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization ' s risk appetite?
Which of the following is MOST important to determine as a result of a risk assessment?
A risk practitioners PRIMARY focus when validating a risk response action plan should be that risk response:
When developing a risk awareness training program, which of the following is the BEST way to promote a risk-aware culture?
An organization is considering the adoption of an aggressive business strategy to achieve desired growth From a risk management perspective what should the risk practitioner do NEXT?
Which of the following changes would be reflected in an organization ' s risk profile after the failure of a critical patch implementation?
Which of the following is the MOST important consideration when multiple risk practitioners capture risk scenarios in a single risk register?
Which of the following is MOST important for a risk practitioner to consider when determining the control requirements for data privacy arising from emerging technologies?
Which of the following should be the PRIMARY consideration when implementing controls for monitoring user activity logs?
Which of the following would be MOST useful to senior management when determining an appropriate risk response?
Which of the following observations should be of GREATEST concern to a risk practitioner assessing a third-party service provider for privacy risk?
Which of the following will BEST help an organization evaluate the control environment of several third-party vendors?
An organization recently experienced a cyber attack that resulted in the loss of confidential customer data. Which of the following is the risk practitioner ' s BEST recommendation after recovery steps have been completed?
Which of the following is the MOST important foundational element of an effective three lines of defense model for an organization?
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cycle?
Which key performance efficiency IKPI) BEST measures the effectiveness of an organization ' s disaster recovery program?
Which of the following is the BEST metric to measure employee adherence to organizational security policies?
Which of the following is MOST important when discussing risk within an organization?
Which of the following should be done FIRST when developing an initial set of risk scenarios for an organization?
Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?
A risk practitioner has been asked to propose a risk acceptance framework for an organization. Which of the following is the MOST important consideration for the risk practitioner to address in the framework?
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an antivirus program?
A risk practitioner is reviewing the status of an action plan to mitigate an emerging IT risk and finds the risk level has increased. The BEST course of action would be to:
Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:
A threat intelligence team has identified an indicator of compromise related to an advanced persistent threat (APT) actor. Which of the following is the risk practitioner ' s BEST course of action?
Which of the following is the BEST way to determine whether system settings are in alignment with control baselines?
Improvements in the design and implementation of a control will MOST likely result in an update to:
Digital signatures are an effective control method for information exchange over an insecure network because they:
A risk practitioner has been made aware of a problem in an IT system that was missed during a routine risk assessment. Which of the following is the practitioner ' s BEST course of action?
Reviewing results from which of the following is the BEST way to identify information systems control deficiencies?
An organization ' s IT team has proposed the adoption of cloud computing as a cost-saving measure for the business. Which of the following should be of GREATEST concern to the risk practitioner?
During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards. The overall control environment may still be effective if:
An organization is implementing internet of Things (loT) technology to control temperature and lighting in its headquarters. Which of the following should be of GREATEST concern?
Employees are repeatedly seen holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges. This behavior BEST represents:
An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?
Which of the following is the BEST way to detect zero-day malware on an end user ' s workstation?
Which of the following is MOST important for maintaining the effectiveness of an IT risk register?
When developing a risk awareness training program, which of the following training topics would BEST facilitate a thorough understanding of risk scenarios?
Which of the following is MOST important to consider when selecting and designing key control indicators (KCIs)?
Which of the following is the BEST way to incorporate continuous monitoring in IT risk policies?
Which of the following should be the risk practitioner s FIRST course of action when an organization has decided to expand into new product areas?
Which of the following is the BEST approach to mitigate the risk associated with outsourcing network management to an external vendor who will have access to sensitive information assets?
When a risk practitioner is determining a system ' s criticality. it is MOST helpful to review the associated:
A key risk indicator (KRI) indicates a reduction in the percentage of appropriately patched servers. Which of the following is the risk practitioner ' s BEST course of action?
Which of the following BEST indicates that an organizations risk management program is effective?
What would be the MAIN concern associated with a decentralized IT function maintaining multiple risk registers?
The BEST key performance indicator (KPI) to measure the effectiveness of a vendor risk management program is the percentage of:
Implementing which of the following controls would BEST reduce the impact of a vulnerability that has been exploited?
Which of the following would MOST likely lead to misaligned outcomes from enterprise architecture (EA)?
Which of the following activities should only be performed by the third line of defense?
Which of the following is the BEST approach to resolve a disagreement between stakeholders regarding the impact of a potential risk scenario?
Which of the following is MOST likely to be impacted when a global organization is required by law to implement a new data protection regulation across its operations?
A management team is on an aggressive mission to launch a new product to penetrate new markets and overlooks IT risk factors, threats, and vulnerabilities. This scenario BEST demonstrates an organization ' s risk:
Which of the following should be the PRIMARY basis for establishing a priority sequence when restoring business processes after a disruption?
Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?
Which of the following cloud service models is MOST appropriate for client organizations that want to maximize their control over management of the data life cycle?
Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?
When creating a program to manage data privacy risk, which of the following is MOST important to ensure that the program is successful?
Which of the following is the GREATEST benefit of involving business owners in risk scenario development?
Which of the following is MOST important to determine when assessing the potential risk exposure of a loss event involving personal data?
Which of the following is the BEST method for assessing control effectiveness?
A risk practitioner implemented a process to notify management of emergency changes that may not be approved. Which of the following is the BEST way to provide this information to management?
Which of the following is the FIRST step in managing the security risk associated with wearable technology in the workplace?
Which of the following BEST mitigates the risk of violating privacy laws when transferring personal information lo a supplier?
Which of the following is the MOST significant benefit of using quantitative risk analysis instead of qualitative risk analysis?
Which of the following is the GREATEST risk associated with inappropriate classification of data?
Which of the following is PRIMARILY responsible for providing assurance to the board of directors and senior management during the evaluation of a risk management program implementation?
The PRIMARY benefit of conducting continuous monitoring of access controls is the ability to identify:
Which of the following is MOST helpful in preventing risk events from materializing?
Which of The following BEST represents the desired risk posture for an organization?
A risk practitioner recently discovered that personal information from the production environment is required for testing purposes in non-production environments. Which of the following is the BEST recommendation to address this situation?
An organization is implementing Internet of Things (IoT) technology to control temperature and lighting in its headquarters. Which of the following should be of GREATEST concern?
An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would be based on:
When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?
Which of the following is MOST helpful to review when assessing the risk exposure associated with ransomware?
Which of the following criteria associated with key risk indicators (KRIs) BEST enables effective risk monitoring?
A penetration testing team discovered an ineffectively designed access control. Who is responsible for ensuring the control design gap is remediated?
Which risk response strategy could management apply to both positive and negative risk that has been identified?
During an acquisition, which of the following would provide the MOST useful input to the parent company ' s risk practitioner when developing risk scenarios for the post-acquisition phase?
The risk associated with inadvertent disclosure of database records from a public cloud service provider (CSP) would MOST effectively be reduced by:
Which of the following is a risk practitioner ' s BEST recommendation to address an organization ' s need to secure multiple systems with limited IT resources?
Which of the following would be the BEST key performance indicator (KPI) for monitoring the effectiveness of the IT asset management process?
Which of the following is MOST important for a risk practitioner to review during an IT risk assessment?
Which of the following is the MOST important reason to communicate risk assessments to senior management?
Which of the following is the BEST key performance indicator (KPI) for a server patch management process?
Which of the following is MOST important to enable well-informed cybersecurity risk decisions?
Which of the following BEST indicates that an organization ' s risk management processes are mature?
The FIRST step for a startup company when developing a disaster recovery plan (DRP) should be to identify:
A monthly payment report is generated from the enterprise resource planning (ERP) software to validate data against the old and new payroll systems. What is the BEST way to mitigate the risk associated with data integrity loss in the new payroll system after data migration?
Which of the following would be of GREATEST concern regarding an organization ' s asset management?
Which of the following provides the MOST reliable evidence of a control ' s effectiveness?
Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?
A control owner identifies that the organization ' s shared drive contains personally identifiable information (Pll) that can be accessed by all personnel. Which of the following is the MOST effective risk response?
An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes. Which of the following would be the BEST metric to determine if the program is performing as expected?
Which of the following is the PRIMARY reason to ensure software engineers test patches before release to the production environment?
Which of the following should be the HIGHEST priority when developing a risk response?
The MAIN purpose of reviewing a control after implementation is to validate that the control:
Which of the following observations would be GREATEST concern to a risk practitioner reviewing the implementation status of management action plans?
Which of the following is the PRIMARY objective of maintaining an information asset inventory?
What is the MOST important consideration when selecting key performance indicators (KPIs) for control monitoring?
Which of the following situations would BEST justify escalation to senior management?
Which of the following IT controls is MOST useful in mitigating the risk associated with inaccurate data?
An insurance company handling sensitive and personal information from its customers receives a large volume of telephone requests and electronic communications daily. Which of the following
is MOST important to include in a risk awareness training session for the customer service department?
Which of the following provides the MOST insight into an organization ' s IT threat exposure?
An organization ' s recovery team is attempting to recover critical data backups following a major flood in its data center. However, key team members do not know exactly what steps should be taken to address this crisis. Which of the following is the MOST likely cause of this situation?
An IT license audit has revealed that there are several unlicensed copies of co be to:
A systems interruption has been traced to a personal USB device plugged into the corporate network by an IT employee who bypassed internal control procedures. Of the following, who should be accountable?
A global organization is considering the acquisition of a competitor. Senior management has requested a review of the overall risk profile from the targeted organization. Which of the following components of this review would provide the MOST useful information?
Which type of cloud computing deployment provides the consumer the GREATEST degree of control over the environment?
Which of the following has the GREATEST impact on ensuring the alignment of the risk profile with business objectives?
Which of the following BEST helps to mitigate risk associated with users inputting incorrect data into a system?
Which of the following is the MOST important information to cover a business continuity awareness Ira nine, program for all employees of the organization?
Which of the following is the BEST course of action to help reduce the probability of an incident recurring?
Which of the following could BEST detect an in-house developer inserting malicious functions into a web-based application?
Which of the following is MOST helpful when prioritizing action plans for identified risk?
Which of the following methods would BEST contribute to identifying obscure risk scenarios?
Which of the following BEST enables an organization to determine whether external emerging risk factors will impact the organization ' s risk profile?
Which of the following is the MOST important reason for integrating IT risk management practices into enterprise risk management (ERM)?
Which of the following is MOST helpful in identifying new risk exposures due to changes in the business environment?
Which of the following would prompt changes in key risk indicator {KRI) thresholds?
Which of the following should be the FIRST consideration when establishing a new risk governance program?
Which of the following would be MOST important for a risk practitioner to provide to the internal audit department during the audit planning process?
Of the following, who should be responsible for determining the inherent risk rating of an application?
While reviewing a contract of a cloud services vendor, it was discovered that the vendor refuses to accept liability for a sensitive data breach. Which of the following controls will BES reduce the risk associated with such a data breach?
The MAIN reason for prioritizing IT risk responses is to enable an organization to:
Which of the following indicates an organization follows IT risk management best practice?
Which of the following is MOST important to sustainable development of secure IT services?
Which organizational role should be accountable for ensuring information assets are appropriately classified?
Which of the following BEST indicates that an organization has implemented IT performance requirements?
Which of the following would offer the MOST insight with regard to an organization ' s risk culture?
During a risk treatment plan review, a risk practitioner finds the approved risk action plan has not been completed However, there were other risk mitigation actions implemented. Which of the fallowing is the BEST course of action?
A risk practitioner is asked to present the results of the most recent technology risk assessment to executive management in a concise manner. Which of the following is MOST important to include in the presentation?
Which of the following is the GREATEST benefit of a three lines of defense structure?
Which of the following is MOST effective in continuous risk management process improvement?
Which of the following is the BEST indication of the effectiveness of a business continuity program?
A risk assessment has identified that departments have installed their own WiFi access points on the enterprise network. Which of the following would be MOST important to include in a report to senior management?
Which of the following should be an element of the risk appetite of an organization?
Senior leadership has set guidelines for the integration of a new acquisition. The guidelines allow for a variation in the level of risk-taking. The variation indicates which of the following risk management concepts?
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:
What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner ' s business impact analysis (BIA)?
Which of the following should be the PRIMARY driver for the prioritization of risk responses?
Senior management has asked a risk practitioner to develop technical risk scenarios related to a recently developed enterprise resource planning (ERP) system. These scenarios will be owned by the system manager. Which of the following would be the BEST method to use when developing the scenarios?
A risk practitioner ' s BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:
Which of the following is the PRIMARY benefit of using a risk map with stakeholders?
To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:
A risk practitioner has been notified of a social engineering attack using artificial intelligence (AI) technology to impersonate senior management personnel. Which of the following would BEST mitigate the impact of such attacks?
An IT department originally planned to outsource the hosting of its data center at an overseas location to reduce operational expenses. After a risk assessment, the department has decided to keep the data center in-house. How should the risk treatment response be reflected in the risk register?
Which of the following is the BEST indicator of an effective IT security awareness program?
Which of We following is the MOST effective control to address the risk associated with compromising data privacy within the cloud?
After undertaking a risk assessment of a production system, the MOST appropriate action is for the risk manager to:
Which of the following is MOST important when developing key risk indicators (KRIs)?
Which of the following provides the BEST evidence that a selected risk treatment plan is effective?
Which of the following is the BEST way to estimate the impact of an inherent risk over the next year?
Which of the following BEST assists in justifying an investment in automated controls?
During a risk assessment, a risk practitioner learns that an IT risk factor is adequately mitigated by compensating controls in an associated business process. Which of the following would enable the MOST effective management of the residual risk?
Which of the following would be a risk practitioner ' s BEST course of action when a project team has accepted a risk outside the established risk appetite?
Which of the following would BEST help minimize the risk associated with social engineering threats?
A recent regulatory requirement has the potential to affect an organization ' s use of a third party to supply outsourced business services. Which of the following is the BEST course of action?
Which of the following should be the PRIMARY focus of a disaster recovery management (DRM) framework and related processes?
Which of the following would BEST help to address the risk associated with malicious outsiders modifying application data?
To minimize risk in a software development project, when is the BEST time to conduct a risk analysis?
A peer review of a risk assessment finds that a relevant threat community was not included. Mitigation of the risk will require substantial changes to a software application. Which of the following is the BEST course of action?
The PRIMARY benefit of using a maturity model is that it helps to evaluate the:
Which of the following provides the MOST comprehensive information when developing a risk profile for a system?
An IT risk practitioner ' s report includes a treatment plan and projected risk ratings if recommendations are implemented. Once corrective actions are taken by the system owner, which of the following types of risk will the projected risk become?
An automobile manufacturer is considering implementing an Internet of Things (IoT) network to improve customer service by collecting customer and vehicle data. Which of the following would be the risk practitioner’s BEST recommendation?
The PRIMARY benefit of maintaining an up-to-date risk register is that it helps to:
Which of the following would BEST facilitate the implementation of data classification requirements?
A Software as a Service (SaaS) company wants to use aggregated data from its clients to improve its services via a machine learning (ML) model. However, its contracts do not clearly allow this use of aggregated data. What should the organization do NEXT?
Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization ' s security incident handling process?
A large organization recently restructured the IT department and has decided to outsource certain functions. What action should the control owners in the IT department take?
Which of the following is the BEST Key control indicator KCO to monitor the effectiveness of patch management?
Which of the following presents the GREATEST risk associated with the deployment of AI tools within an organization?
Management has noticed storage costs have increased exponentially over the last 10 years because most users do not delete their emails. Which of the following can BEST alleviate this issue while not sacrificing security?
An organization is planning to implement a Zero Trust model. From a cybersecunty perspective, which of the following is MOST important to ensure successful alignment with the overall inten Zero Trust?
It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:
Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?
An organization is reviewing a contract for a Software as a Service (SaaS) sales application with a 99.9% uptime service level agreement (SLA). Which of the following BEST describes ownership of availability risk?
A key performance indicator (KPI) has been established to monitor the number of software changes that fail and must be re-implemented. An increase in the KPI indicates an ineffective:
An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk practitioner do FIRST?
The PRIMARY objective of the board of directors periodically reviewing the risk profile is to help ensure:
The risk to an organization ' s reputation due to a recent cybersecurity breach is PRIMARILY considered to be:
During a data loss incident, which role in the RACI chart would be aligned to the risk practitioner?
Which of the following is the PRIMARY role of a data custodian in the risk management process?
Which of the following is MOST important to understand when determining an appropriate risk assessment approach?
Which of the following is MOST important for an organization to have in place when developing a risk management framework?
What is MOST important for the risk practitioner to understand when creating an initial IT risk register?
Which of the following is the PRIMARY objective of engaging key stakeholders in the IT risk assessment process?
Which of the following is the MOST effective way to evaluate control implementation processes?
A highly regulated enterprise is developing a new risk management plan to specifically address legal and regulatory risk scenarios What should be done FIRST by IT governance to support this effort?
Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery test of critical business processes?
The BEST reason to classify IT assets during a risk assessment is to determine the:
Which of the following is a risk practitioner ' s BEST course of action when a control is not meeting agreed-upon performance criteria?
Senior management is deciding whether to share confidential data with the organization ' s business partners. The BEST course of action for a risk practitioner would be to submit a report to senior management containing the:
Which of the following is the PRIMARY advantage of aligning generic risk scenarios with business objectives?
An organization has outsourced a critical process involving highly regulated data to a third party with servers located in a foreign country. Who is accountable for the confidentiality of this data?
Management has determined that it will take significant time to remediate exposures in the current IT control environment. Which of the following is the BEST course of action?
In addition to the risk exposure, which of the following is MOST important for senior management to understand prior to approving the use of artificial intelligence (Al) solutions?
When presenting risk, the BEST method to ensure that the risk is measurable against the organization ' s risk appetite is through the use of a:
Which of the following is the PRIMARY objective of establishing an organization ' s risk tolerance and appetite?
An organization has updated its acceptable use policy to mitigate the risk of employees disclosing confidential information. Which of the following is the BEST way to reinforce the effectiveness of this policy?
A segregation of duties control was found to be ineffective because it did not account for all applicable functions when evaluating access. Who is responsible for ensuring the control is designed to effectively address risk?
A user has contacted the risk practitioner regarding malware spreading laterally across the organization ' s corporate network. Which of the following is the risk practitioner’s BEST course of action?
Which of the following would BEST facilitate the maintenance of data classification requirements?
Which of the following is the GREATEST risk of relying on artificial intelligence (Al) within heuristic security systems?
Who should be PRIMARILY responsible for establishing an organization ' s IT risk culture?
When developing a response plan to address security incidents regarding sensitive data loss, it is MOST important
Which of the following is the BEST way to maintain a current list of organizational risk scenarios?
Which of the following is the FIRST step when conducting a business impact analysis (BIA)?
A third-party vendor has offered to perform user access provisioning and termination. Which of the following control accountabilities is BEST retained within the organization?
An organization has an approved bring your own device (BYOD) policy. Which of the following would BEST mitigate the security risk associated with the inappropriate use of enterprise applications on the devices?
A robotic process automation (RPA) project has implemented new robots to enhance the efficiency of a sales business process. Which of the following provides the BEST evidence that the new controls have been implemented successfully?
The analysis of which of the following will BEST help validate whether suspicious network activity is malicious?
A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner ' s NEXT step?
A risk practitioner is performing a risk assessment of recent external advancements in quantum computing. Which of the following would pose the GREATEST concern for the risk practitioner?
Which of the following risk register elements is MOST likely to be updated if the attack surface or exposure of an asset is reduced?
Before selecting a final risk response option for a given risk scenario, management should FIRST:
While reviewing an organization ' s monthly change management metrics, a risk practitioner notes that the number of emergency changes has increased substantially Which of the following would be the BEST approach for the risk practitioner to take?
When reporting on the performance of an organization ' s control environment including which of the following would BEST inform stakeholders risk decision-making?
The BEST way to obtain senior management support for investment in a control implementation would be to articulate the reduction in:
The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of:
A data privacy regulation has been revised to incorporate more stringent requirements for personal data protection. Which of the following provides the MOST important input to help ensure compliance with the revised regulation?
A root because analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators Who should be accountable for resolving the situation?
Which of the following would present the MOST significant risk to an organization when updating the incident response plan?
Which of the following is the BEST indicator of the effectiveness of a control?
Which of the following events is MOST likely to trigger the need to conduct a risk assessment?
IT management has deployed a major update to reduce the risk of system compromise. What is the BEST way to validate the effectiveness of this control?
Which of the following roles should be assigned accountability for monitoring risk levels?
Which of the following is an IT business owner ' s BEST course of action following an unexpected increase in emergency changes?
Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?
The BEST way for an organization to ensure that servers are compliant to security policy is
to review:
Within the system development life cycle (SDLC), controls should be specified during:
Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management ' s action plan?
An organization operates in a jurisdiction where heavy fines are imposed for leakage of customer data. Which of the following provides the BEST input to assess the inherent risk impact?
Of the following, who is accountable for ensuing the effectiveness of a control to mitigate risk?
Which of the following is MOST important for an organization that wants to reduce IT operational risk?
A technology company is developing a strategic artificial intelligence (Al)-driven application that has high potential business value. At what point should the enterprise risk profile be updated?
Which of the following BEST indicates the effectiveness of anti-malware software?
Which of the following is the BEST key performance indicator (KPI) to measure the ability to deliver uninterrupted IT services?
An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following should be the risk practitioner ' s NEXT course of action?
Which of the following is MOST useful for measuring the existing risk management process against a desired state?
Which of the following is the GREATEST risk associated with the misclassification of data?
Which of the following is the BEST criterion to determine whether higher residual risk ratings in the risk register should be accepted?
Which of the following is the BEST way for a risk practitioner to help management prioritize risk response?
An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the countrywhere it is collected. Which of the following should be done FIRST when addressing this situation?
An application owner has specified the acceptable downtime in the event of an incident to be much lower than the actual time required for the response team to recover the application. Which of the following should be the NEXT course of action?
Which of the following is the PRIMARY reason that risk management is important in project management?
Which of the following should an organization perform to forecast the effects of a disaster?
In an organization with a mature risk management program, which of the following would provide the BEST evidence that the IT risk profile is up to date?
Which of the following would be a risk practitioner ' s GREATEST concern with the use of a vulnerability scanning tool?
In the context of the three lines model, which of the following is responsible for providing assurance to senior management and the governing body through independent and objective reviews?
A department allows multiple users to perform maintenance on a system using a single set of credentials. A risk practitioner determined this practice to be high-risk. Which of the following is the MOST effective way to mitigate this risk?
Which of the following is the MOST important consideration when developing an organization ' s risk taxonomy?
Which of the following would be a weakness in procedures for controlling the migration of changes to production libraries?
Which of the following is MOST likely to introduce risk for financial institutions that use blockchain?
Which of the following trends would cause the GREATEST concern regarding the effectiveness of an organization ' s user access control processes? An increase in the:
Which of the following is the GREATEST benefit of identifying appropriate risk owners?
Which of the following is the PRIMARY objective of providing an aggregated view of IT risk to business management?
Which of the following is the BEST course of action when an organization wants to reduce likelihood in order to reduce a risk level?
A penetration test reveals several vulnerabilities in a web-facing application. Which of the following should be the FIRST step in selecting a risk response?
The BEST way to mitigate the high cost of retrieving electronic evidence associated with potential litigation is to implement policies and procedures for:
What is the PRIMARY reason to periodically review key performance indicators (KPIs)?
Which of the following is MOST important for developing effective key risk indicators (KRIs)?
A hospital recently implemented a new technology to allow virtual patient appointments. Which of the following should be the risk practitioner ' s FIRST course of action?
During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:
Which of the following will BEST help in communicating strategic risk priorities?
Which of the following methods is the BEST way to measure the effectiveness of automated information security controls prior to going live?
An organization ' s risk tolerance should be defined and approved by which of the following?
An organization is developing a plan to address new information security risks emerging from business changes. Which of the following BEST enables stakeholders to make decisions impacting organizational strategy?
An organization recently implemented new technologies that enable the use of robotic process automation. Which of the following is MOST important to reassess?
Which of the following is the MOST effective way to reduce potential losses due to ongoing expense fraud?
Which of the following approaches BEST identifies information systems control deficiencies?
Which of the following should be initiated when a high number of noncompliant conditions are observed during review of a control procedure?
Which of the following would BEST enable mitigation of newly identified risk factors related to internet of Things (loT)?
Which of the following presents the GREATEST concern associated with the
use of artificial intelligence (Al) systems?
Which of the following would provide the MOST useful information for communicating an organization’s risk level to senior management?
An organization is revising its IT security policy. Which of the following should be done FIRST to help ensure the policy is followed?
Which of the following will BEST communicate the importance of risk mitigation initiatives to senior management?
Which of the following will BEST help ensure that risk factors identified during an information systems review are addressed?
Automated code reviews to reduce the risk associated with web applications are MOST effective when performed:
Which of the following is the MOST important information to cover in a business continuity awareness training program for all employees of the organization?
An organization is adopting block chain for a new financial system. Which of the following should be the GREATEST concern for a risk practitioner evaluating the system ' s production readiness?
Prior to selecting key performance indicators (KPIs), itis MOST important to ensure:
Which of the following is the BEST metric to measure the effectiveness of an organization ' s disaster recovery program?
Which of the following is the BEST indicator of executive management ' s support for IT risk mitigation efforts?
An organization has raised the risk appetite for technology risk. The MOST likely result would be:
Which of the following is MOST helpful to facilitate the decision of recovery priorities in a disaster situation?
Which of the following is the BEST approach for determining whether a risk action plan is effective?
An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system. The risk practitioner is documenting the risk in the risk register. The risk should be owned by the:
An organization has adopted an emerging technology without following proper processes. Which of the following is the risk practitioner ' s BEST course of action to address this risk?
Which of the following is the MOST important objective of embedding risk management practices into the initiation phase of the project management life cycle?
The MOST important measure of the effectiveness of risk management in project implementation is the percentage of projects:
Which of the following would be the MOST critical issue related to the cooling system of a data center?
Which of the following shortcomings of perimeter security does Zero Trust aim to resolve?
An online retailer has decided to store its customer database with a cloud provider in an Infrastructure as a Service (laaS) configuration. During an initial review of preliminary risk scenarios, a risk practitioner identifies instances where sensitive customer information is stored unencrypted. Who is accountable for ensuring this encryption?
An organization is subject to a new regulation that requires nearly real-time recovery of its services following a disruption. Which of the following is the BEST way to manage the risk in this situation?
Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?
Which of the following is a risk practitioner ' s BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?
Which of the following is the MOST important consideration when developing risk strategies?
During which phase of the system development life cycle (SDLC) should information security requirements for the implementation of a new IT system be defined?
Which of the following is the BEST method to ensure a terminated employee ' s access to IT systems is revoked upon departure from the organization?
Which of the following provides The MOST useful information when determining a risk management program ' s maturity level?
Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST
Which of the following is the BEST way to manage the risk associated with malicious activities performed by database administrators (DBAs)?
Which of the following will BEST help to ensure implementation of corrective action plans?
Which of the following would provide executive management with the BEST information to make risk decisions as a result of a risk assessment?
Which of the following would BEST indicate to senior management that IT processes are improving?
Which of the following should be the PRIMARY recipient of reports showing the
progress of a current IT risk mitigation project?
Winch of the following key control indicators (KCIs) BEST indicates whether security requirements are identified and managed throughout a project He cycle?
Which of the following is the MOST important document regarding the treatment of sensitive data?
Which of the following presents the GREATEST security risk to an organization with a large number of Internet of Things (IoT) devices within its network?
Which of the following is MOST helpful in verifying that the implementation of a risk mitigation control has been completed as intended?
An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative ' s objectives?
Which of the following is the BEST indication that key risk indicators (KRls) should be revised?
Which of the following is MOST important when creating a program to reduce ethical risk?
Which of the following is the BEST control to detect an advanced persistent threat (APT)?
The following is the snapshot of a recently approved IT risk register maintained by an organization ' s information security department.
After implementing countermeasures listed in ‘’Risk Response Descriptions’’ for each of the Risk IDs, which of the following component of the register MUST change?
Which of the following would be MOST useful when measuring the progress of a risk response action plan?
A risk practitioner has been tasked with conducting a risk identification workshop with stakeholders to compile an IT risk profile. Which of the following would be MOST helpful in the brainstorming phase of this exercise?
Which of the following provides the MOST helpful information in identifying risk in an organization?
An organization is implementing data warehousing infrastructure. Senior management is concerned about safeguarding client data security in this new environment. Which of the following should the risk practitioner recommend be done NEXT?
Which of the following presents the GREATEST security risk associated with Internet of Things (IoT) technology?
An organization is developing a risk awareness program for contractors and consultants. Which of the following is MOST important for the organization to keep confidential?
Which of the following is MOST important when considering risk in an enterprise risk management (ERM) process?
Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?
An organization ' s finance team is proposing the adoption of a blockchain technology to provide a secure method for moving funds. Which of the following should the risk practitioner do FIRST?
Which of the following is the MOST appropriate risk owner for a payroll application that has recently been outsourced to a cloud software provider?
Which of the following is the BEST way to address IT regulatory compliance risk?
An organization uses a vendor to destroy hard drives. Which of the following would BEST reduce the risk of data leakage?
Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?
Which of the following should a risk practitioner recommend be done prior to disposal of server hardware containing confidential data?
The PRIMARY reason a risk practitioner would be interested in an internal audit report is to:
Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?
Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?
A risk practitioner is concerned with potential data loss in the event of a breach at a hosted third-party provider. Which of the following is the BEST way to mitigate this risk?
An organization has four different projects competing for funding to reduce overall IT risk. Which project should management defer?
Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable information (PII)?
Where is the FIRST place a risk practitioner should look to identify accountability for a specific risk?
Which of the following would MOST likely require a risk practitioner to update the risk register?
A bank recently incorporated Blockchain technology with the potential to impact known risk within the organization. Which of the following is the risk practitioner’s BEST course of action?
Which of the following is the MOST important component in a risk treatment plan?
Which of the following is the GREATEST benefit of analyzing logs collected from different systems?
A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk to acceptable levels. Which of the following should the risk practitioner do FIRST?
An organization ' s internal audit department is considering the implementation of robotics process automation (RPA) to automate certain continuous auditing tasks. Who would own the risk associated with ineffective design of the software bots?
Which of the following is the PRIMARY responsibility of the first line of defense related to computer-enabled fraud?
Which of the following is the BEST evidence that a user account has been properly authorized?
Which of the following is the PRIMARY risk management responsibility of the second line of defense?
An organization is concerned that its employees may be unintentionally disclosing data through the use of social media sites. Which of the following will MOST effectively mitigate tins risk?
Which of the following provides the MOST reliable evidence to support conclusions after completing an information systems controls assessment?
Which of the following is MOST important to include when reporting the effectiveness of risk management to senior management?
When determining which control deficiencies are most significant, which of the following would provide the MOST useful information?
Which of the following BEST enables risk mitigation associated with software licensing noncompliance?
Which of the following is MOST essential for an effective change control environment?
An organizations chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner ' s BEST course of action is to:
An organization has been notified that a disgruntled, terminated IT administrator has tried to break into the corporate network. Which of the following discoveries should be of GREATEST concern to the organization?
Which of these documents is MOST important to request from a cloud service
provider during a vendor risk assessment?
Which of the following is MOST important for the organization to consider before implementing a new in-house developed artificial intelligence (Al) solution?
A risk practitioner recently discovered that sensitive data from the production environment is required for testing purposes in non-production environments. Which of the following i the BEST recommendation to address this situation?
Which of the following emerging technologies is frequently used for botnet distributed denial of service (DDoS) attacks?
Which of the following is the PRIMARY risk management responsibility of the third line of defense?
During the creation of an organization ' s IT risk management program, the BEST time to identify key risk indicators (KRIs) is while:
Winch of the following can be concluded by analyzing the latest vulnerability report for the it infrastructure?
When a risk practitioner is building a key risk indicator (KRI) from aggregated data, it is CRITICAL that the data is derived from:
An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?
Which of the following is the BEST way to address a board ' s concern about the organization ' s current cybersecurity posture?
When a high-risk security breach occurs, which of the following would be MOST important to the person responsible for managing the incident?
Which of the following BEST indicates that additional or improved controls ate needed m the environment?
Which of the following is the PRIMARY reason for an organization to ensure the risk register is updated regularly?
It is MOST important that security controls for a new system be documented in:
The effectiveness of a control has decreased. What is the MOST likely effect on the associated risk?
An organization ' s risk management team wants to develop IT risk scenarios to show the impact of collecting and storing credit card information. Which of the following is the MOST comprehensive approach to capture this scenario?
A risk practitioner is advising management on proposed updates to the IT policy to include cloud usage. Which of the following should be the FIRST step in this process?
Which of the following is the GREATEST concern associated with the transmission of healthcare data across the internet?
Which of the following is the BEST way to reduce the likelihood of an individual performing a potentially harmful action as the result of unnecessary entitlement?
Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?
Who should be accountable for ensuring effective cybersecurity controls are established?
Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?
The MOST important consideration when selecting a control to mitigate an identified risk is whether:
Key risk indicators (KRIs) are MOST useful during which of the following risk management phases?
A control for mitigating risk in a key business area cannot be implemented immediately. Which of the following is the risk practitioner ' s BEST course of action when a compensating control needs to be applied?
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of IT policies? The number of:
After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:
An organization has committed to a business initiative with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner ' s MOST important action related to this decision?
A risk practitioner is reporting on an increasing trend of ransomware attacks in the industry. Which of the following information is MOST important to include to enable an informed response decision by key stakeholders?
Which of the following would be- MOST helpful to understand the impact of a new technology system on an organization ' s current risk profile?
An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?
An organization has recently hired a large number of part-time employees. During the annual audit, it was discovered that many user IDs and passwords were documented in procedure manuals for use by the part-time employees. Which of the following BEST describes this situation?
All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness, the BEST course of action would be to:
Which of the following BEST ensures that the data feeds used by an organization are complete and accurate?
Which of the following BEST enables a risk practitioner to focus on risk factors that could potentially affect the results of an IT initiative?
Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?
Which of the following would have the GREATEST impact on reducing the risk associated with the implementation of a big data project?
Which of the following is the MOST effective control to maintain the integrity of system configuration files?
Changes in which of the following would MOST likely cause a risk practitioner to adjust the risk impact rating in the risk register?
After the announcement of a new IT regulatory requirement, it is MOST important for a risk practitioner to;
Which of the following is the MOST important reason to restrict access to the risk register on a need-to-know basis?
Which of the following will be MOST effective to mitigate the risk associated with the loss of company data stored on personal devices?
Which of the following is the PRIMARY advantage of having a single integrated business continuity plan (BCP) rather than each business unit developing its own BCP?
Which of the following is the GREATEST benefit for an organization with a strong risk awareness culture?
A risk practitioner has been asked to evaluate a new cloud-based service to enhance an organization ' s access management capabilities. When is the BEST time for the risk practitioner to provide opinions on control strength?
What should be the PRIMARY driver for periodically reviewing and adjusting key risk indicators (KRIs)?
What is the MOST effective approach to promote ethical decision-making in a global organization?
Which of the following is the MOST important key performance indicator (KPI) to establish in the service level agreement (SLA) for an outsourced data center?
A Software as a Service (SaaS) provider has determined that the risk of a client ' s sensitive data being compromised is low. Which of the following is the client ' s BEST course of action?
Which of the following should be a risk practitioner ' s NEXT step upon learning the impact of an organization ' s noncompliance with a specific legal regulation?
A vendor ' s planned maintenance schedule will cause a critical application to temporarily lose failover capabilities. Of the following, who should approve this proposed schedule?
A risk practitioner wants to identify potential risk events that affect the continuity of a critical business process. Which of the following should the risk practitioner do FIRST?
Which of the following is the MOST important consideration for a risk practitioner when making a system implementation go-live recommendation?
When performing a risk assessment of a new service to support a core business process, which of the following should be done FIRST to ensure continuity of operations?
Which of the following is the BEST key performance indicator (KPI) for determining how well an IT policy is aligned to business requirements?
Which of the following is the FIRST step when conducting a business impact analysis (BIA)?
An organization has opened a subsidiary in a foreign country. Which of the following would be the BEST way to measure the effectiveness of the subsidiary ' s IT systems controls?
Which of the following is the BEST way to support communication of emerging risk?
Which of the following is MOST important to identify when developing top-down risk scenarios?
Which of the following should be the PRIMARY input to determine risk tolerance?
What should a risk practitioner do FIRST when vulnerability assessment results identify a weakness in an application?
The acceptance of control costs that exceed risk exposure is MOST likely an example of:
Which of the following would be MOST helpful when communicating roles associated with the IT risk management process?
Which of the following BEST enables an organization to increase the likelihood of identifying risk associated with unethical employee behavior?
Which of the following criteria is MOST important when developing a response to an attack that would compromise data?
When creating a separate IT risk register for a large organization, which of the following is MOST important to consider with regard to the existing corporate risk ' register?
The MOST important reason to monitor key risk indicators (KRIs) is to help management:
What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical legacy system?
Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?
Several vulnerabilities have been identified in an organization’s core financial systems. Which of the following would be the risk practitioner’s BEST course of action?
A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management. The BEST way to support risk-based decisions by senior management would be to:
A risk practitioner notices a risk scenario associated with data loss at the organization ' s cloud provider is assigned to the provider who should the risk scenario be reassigned to.
Which of the following BEST enables the timely detection of changes in the security control environment?
An internal audit report reveals that not all IT application databases have encryption in place. Which of the following information would be MOST important for assessing the risk impact?
Which of the following BEST indicates that an organization ' s disaster recovery plan (DRP) will mitigate the risk of the organization failing to recover from a major service disruption?
Which of the following observations would be the GREATEST concern to a risk practitioner evaluating an organization ' s risk management practices?
Who should be accountable for monitoring the control environment to ensure controls are effective?
A migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing. Which part of the risk register should be updated FIRST?
Which of the following BEST indicates the risk appetite and tolerance level (or the risk associated with business interruption caused by IT system failures?
Which of the following would be MOST helpful in assessing the risk associated with data loss due to human vulnerabilities?
Which of the following is the MOST important characteristic of a key risk indicator (KRI) to enable decision-making?
Which of the following provides the MOST useful information when determining if a specific control should be implemented?
Which of the following provides the MOST important information to facilitate a risk response decision?
Which of the following is a risk practitioner ' s MOST important course of action after learning that an organization ' s industry peers have experienced an increase in ransomware attacks?
Which of the following is MOST useful when performing a quantitative risk assessment?
Which of the following is a risk practitioner ' s BEST recommendation to help reduce IT risk associated with scheduling overruns when starting a new application development project?
Which of the following functions independently reviews and provides feedback regarding the achievement of organizational objectives?
Which of the following would be the BEST justification to invest in the development of a governance, risk, and compliance (GRC) solution?
An organization recently implemented an automated interface for uploading payment files to its banking system to replace manual processing. Which of the following elements of the risk register is MOST appropriate for the risk practitioner to update to reflect the improved control?
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 11 Oct 2026
