CRISC Certified in Risk and Information Systems Control Questions and Answers
Which of the following is MOST important for effective communication of a risk profile to relevant stakeholders?
Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth’’?
IT management has asked for a consolidated view into the organization ' s risk profile to enable project prioritization and resource allocation. Which of the following materials would
be MOST helpful?
Which of the following would prompt changes in key risk indicator {KRI) thresholds?
Which of the following practices BEST mitigates risk related to enterprise-wide ethical decision making in a multi-national organization?
Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?
Which of the following is the PRIMARY purpose for ensuring senior management understands the organization’s risk universe in relation to the IT risk management program?
Which of the following is the MOST important factor to consider when determining whether to approve a policy exception request?
Which of the following is MOST important for a risk practitioner to review during an IT risk assessment?
An organization has an internal control that requires all access for employees be removed within 15 days of their termination date. Which of the following should the risk practitioner use to monitor
adherence to the 15-day threshold?
Which of the following BEST supports the management of identified risk scenarios?
Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?
A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?
When assigning control ownership, it is MOST important to verify that the owner has accountability for:
A hospital recently implemented a new technology to allow virtual patient appointments. Which of the following should be the risk practitioner ' s FIRST course of action?
Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?
Which of the following is the GREATEST risk associated with the misclassification of data?
Which of the following should be of MOST concern to a risk practitioner reviewing the system development life cycle (SDLC)?
Which of the following key risk indicators (KRIs) is MOST effective for monitoring risk related to a bring your own device (BYOD) program?
The BEST key performance indicator (KPI) to measure the effectiveness of a vendor risk management program is the percentage of:
Management has noticed storage costs have increased exponentially over the last 10 years because most users do not delete their emails. Which of the following can BEST alleviate this issue while not sacrificing security?
What should a risk practitioner do FIRST when an assessment reveals a control is not operating as intended?
Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?
Which of the following BEST enables risk-based decision making in support of a business continuity plan (BCP)?
From a business perspective, which of the following is the MOST important objective of a disaster recovery test?
Which of the following would offer the MOST insight with regard to an organization ' s risk culture?
When establishing an enterprise IT risk management program, it is MOST important to:
Which of the following will BEST help mitigate the risk associated with malicious functionality in outsourced application development?
Which of the following provides The MOST useful information when determining a risk management program ' s maturity level?
When creating a separate IT risk register for a large organization, which of the following is MOST important to consider with regard to the existing corporate risk ' register?
Which of the following is the MOST important benefit of reporting risk assessment results to senior management?
A key performance indicator (KPI) has been established to monitor the number of software changes that fail and must be re-implemented. An increase in the KPI indicates an ineffective:
The use of multi-factor authentication (MFA) when applied to an FTP connection is an example of which type of control category?
An IT operations team implements disaster recovery controls based on decisions from application owners regarding the level of resiliency needed. Who is the risk owner in this scenario?
Where is the FIRST place a risk practitioner should look to identify accountability for a specific risk?
Before selecting a final risk response option for a given risk scenario, management should FIRST:
Which of the following BEST enables a proactive approach to minimizing the potential impact of unauthorized data disclosure?
Which of the following should be determined FIRST when a new security vulnerability is made public?
A service provider is managing a client’s servers. During an audit of the service, a noncompliant control is discovered that will not be resolved before the next audit because the client cannot afford the downtime required to correct the issue. The service provider’s MOST appropriate action would be to:
When a risk practitioner is building a key risk indicator (KRI) from aggregated data, it is CRITICAL that the data is derived from:
An organization has recently been experiencing frequent data corruption incidents. Implementing a file corruption detection tool as a risk response strategy will help to:
In which of the following system development life cycle (SDLC) phases should controls be incorporated into system specifications?
The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:
Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?
Who is responsible for IT security controls that are outsourced to an external service provider?
In a public company, which group is PRIMARILY accountable for ensuring sufficient attention and resources are applied to the risk management process?
A risk practitioner has just learned about new malware that has severely impacted industry peers worldwide data loss?
Which of the following roles would provide the MOST important input when identifying IT risk scenarios?
Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators (KRIs)?
To effectively address ethical risk within an organization, who MUST ensure the ethics policy is enforced and equally applied to all levels of authority ' ?
Which of the following would BEST indicate to senior management that IT processes are improving?
A global organization is considering the acquisition of a competitor. Senior management has requested a review of the overall risk profile from the targeted organization. Which of the following components of this review would provide the MOST useful information?
Which of the following is the BEST control for a large organization to implement to effectively mitigate risk related to fraudulent transactions?
Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?
A risk practitioner is defining metrics for security threats that were not identified by antivirus software. Which type of metric is being developed?
Which of the following is the MOST significant risk related to an organization ' s use of AI technology?
A risk practitioner is reviewing the status of an action plan to mitigate an emerging IT risk and finds the risk level has increased. The BEST course of action would be to:
Which of the following BEST enables a risk practitioner to understand management ' s approach to organizational risk?
Which of the following is the BEST approach for determining whether a risk action plan is effective?
During a risk assessment, what should an assessor do after identifying threats to organizational assets?
To mitigate the risk of using a spreadsheet to analyze financial data, IT has engaged a third-party vendor to deploy a standard application to automate the process. Which of the following parties should own the risk associated with calculation errors?
An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST.
In order to efficiently execute a risk response action plan, it is MOST important for the emergency response team members to understand:
A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?
Which of the following is the MOST important foundational element of an effective three lines of defense model for an organization?
Which of the following is a business asset for an organization that runs only in a Software as a Service (SaaS) cloud computing environment?
An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack. Which of the following is the MOST effective control to support this policy?
Which of the following is the BEST metric to demonstrate the effectiveness of an organization ' s patch management process?
An organization is revising its IT security policy. Which of the following should be done FIRST to help ensure the policy is followed?
To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:
An organization is considering allowing users to access company data from their personal devices. Which of the following is the MOST important factor when assessing the risk?
Which of the following should be the PRIMARY consideration when identifying and assigning ownership of IT-related risk?
The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:
Which of the following is MOST important when discussing risk within an organization?
A review of an organization s controls has determined its data loss prevention {DLP) system is currently failing to detect outgoing emails containing credit card data. Which of the following would be MOST impacted?
To enable effective integration of IT risk scenarios and ERM, it is MOST important to have a consistent approach to reporting:
Which of the following is the PRIMARY risk management responsibility of the second line of defense?
When developing a risk awareness training program, which of the following training topics would BEST facilitate a thorough understanding of risk scenarios?
An IT department has organized training sessions to improve user awareness of organizational information security policies. Which of the following is the BEST key performance indicator (KPI) to reflect effectiveness of the training?
After conducting a risk assessment for regulatory compliance, an organization has identified only one possible mitigating control. The cost of the control has been determined to be higher than the penalty of noncompliance. Which of the following would be the risk practitioner ' s BEST recommendation?
A trusted third-party service provider has determined that the risk of a client ' s systems being hacked is low. Which of the following would be the client ' s BEST course of action?
An organization plans to provide specific cloud security training for the IT team to help manage risks associated with cloud technology. This response is considered risk:
A risk practitioner is asked to present the results of the most recent technology risk assessment to executive management in a concise manner. Which of the following is MOST important to include in the presentation?
Which of the following would be a risk practitioner’s GREATEST concern related to the monitoring of key risk indicators (KRIs)?
An organization has restructured its business processes, and the business continuity plan (BCP) needs to be revised accordingly. Which of the following should be identified FIRST?
Which of the following would BEST facilitate the implementation of data classification requirements?
Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?
Who is accountable for the process when an IT stakeholder operates a key control to address a risk scenario?
Following the implementation of an Internet of Things (loT) solution, a risk practitioner identifies new risk factors with impact to existing controls. Which of the following is MOST important to include in a report to stakeholders?
To define the risk management strategy which of the following MUST be set by the board of directors?
Which of the following is the BEST indication that key risk indicators (KRls) should be revised?
Management has determined that it will take significant time to remediate exposures in the current IT control environment. Which of the following is the BEST course of action?
The analysis of which of the following will BEST help validate whether suspicious network activity is malicious?
An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would be based on:
Which of the following is the BEST approach to mitigate the risk associated with outsourcing network management to an external vendor who will have access to sensitive information assets?
Which of the following practices would be MOST effective in protecting personality identifiable information (Ptl) from unauthorized access m a cloud environment?
An internally developed payroll application leverages Platform as a Service (PaaS) infrastructure from the cloud. Who owns the related data confidentiality risk?
A control process has been implemented in response to a new regulatory requirement, but has significantly reduced productivity. Which of the following is the BEST way to resolve this concern?
Which of the following would be MOST beneficial as a key risk indicator (KRI)?
Which of the following is the MOST effective way to evaluate control implementation processes?
An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability management process?
When a high-risk security breach occurs, which of the following would be MOST important to the person responsible for managing the incident?
Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?
Which of the following should be a risk practitioner’s MOST important consideration when developing IT risk scenarios?
Which of the following controls would BEST reduce the risk of account compromise?
Which of the following will BEST help ensure that risk factors identified during an information systems review are addressed?
Which of the following risk scenarios would be the GREATEST concern as a result of a single sign-on implementation?
Reviewing which of the following BEST helps an organization gam insight into its overall risk profile ' '
Which of the following risk activities is BEST facilitated by enterprise architecture (EA)?
An organization plans to implement a new Software as a Service (SaaS) speech-to-text solution Which of the following is MOST important to mitigate risk associated with data privacy?
An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk practitioner do FIRST?
Which of the following provides the MOST useful information when assessing whether an organization has appropriately managed its level of risk compared to its established risk appetite?
When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?
Which of the following is the MOST comprehensive resource for prioritizing the implementation of information systems controls?
Who should be accountable for authorizing information system access to internal users?
A business unit is implementing a data analytics platform to enhance its customer relationship management (CRM) system primarily to process data that has been provided by its customers. Which of the following presents the GREATEST risk to the organization ' s reputation?
Which of the following is the PRIMARY advantage of having a single integrated business continuity plan (BCP) rather than each business unit developing its own BCP?
Which of the following is the MOST important information to be communicated during security awareness training?
Which of the following is the BEST approach when a risk practitioner has been asked by a business unit manager to exclude an in-scope system from a risk assessment?
When of the following 15 MOST important when developing a business case for a proposed security investment?
An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following should be the risk practitioner ' s NEXT course of action?
when developing IT risk scenarios associated with a new line of business, which of the following would be MOST helpful to review?
An organization with a large number of applications wants to establish a security risk assessment program. Which of the following would provide the MOST useful information when determining the frequency of risk assessments?
An organization is adopting block chain for a new financial system. Which of the following should be the GREATEST concern for a risk practitioner evaluating the system ' s production readiness?
Which of the following is the PRIMARY objective of maintaining an information asset inventory?
A risk practitioner is organizing risk awareness training for senior management. Which of the following is the MOST important topic to cover in the training session?
Which of the following should be the PRIMARY consideration when assessing the automation of control monitoring?
A risk practitioner can use an organization ' s problem management process to anticipate potential risk within IT systems by:
Calculation of the recovery time objective (RTO) is necessary to determine the:
An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. Which risk treatment was adopted by the organization?
A risk practitioner is reviewing a vendor contract and finds there is no clause to control privileged access to the organization ' s systems by vendor employees. Which of the following is the risk practitioner ' s BEST course of action?
Owners of technical controls should be PRIMARILY accountable for ensuring the controls are:
Which of the following observations would be GREATEST concern to a risk practitioner reviewing the implementation status of management action plans?
An IT risk practitioner is evaluating an organization ' s change management controls over the last six months. The GREATEST concern would be an increase in:
Which of the following would BEST provide early warning of a high-risk condition?
Which of the following would provide the MOST comprehensive information for updating an organization ' s risk register?
Which of the following is the MOST important data attribute of key risk indicators (KRIs)?
Which of the following is the PRIMARY role of the second line when an IT risk management framework is adopted?
Which of the following BEST enables detection of ethical violations committed by employees?
A failed IT system upgrade project has resulted in the corruption of an organization ' s asset inventory database. Which of the following controls BEST mitigates the impact of this incident?
Which type of indicators should be developed to measure the effectiveness of an organization ' s firewall rule set?
An organization is implementing encryption for data at rest to reduce the risk associated with unauthorized access. Which of the following MUST be considered to assess the residual risk?
Which of the following BEST supports the integration of IT risk management into an organization ' s strategic planning?
An organization ' s HR department has implemented a policy requiring staff members to take a minimum of five consecutive days leave per year to mitigate the risk of malicious insideractivities. Which of the following is the BEST key performance indicator (KPI) of the effectiveness of this policy?
An organization has outsourced its backup and recovery procedures to a cloud service provider. The provider ' s controls are inadequate for the organization ' s level of risk tolerance. As a result, the organization has internally implemented additional backup and recovery controls. Which risk response has been adopted?
Which of the following is MOST important to review when determining whether a potential IT service provider’s control environment is effective?
Senior management has requested more information regarding the risk associated with introducing a new application into the environment. Which of the following should be done FIRST?
Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?
When a high number of approved exceptions are observed during a review of a control procedure, an organization should FIRST initiate a review of the:
Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?
In an organization with a mature risk management program, which of the following would provide the BEST evidence that the IT risk profile is up to date?
A risk practitioner is concerned with potential data loss in the event of a breach at a hosted third-party provider. Which of the following is the BEST way to mitigate this risk?
An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses. What should be done NEXT in response to this report?
Which of the following has the GREATEST impact on backup policies for a system supporting a critical process?
Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?
From an IT risk perspective, which of the following has the GREATEST impact on organizational strategy?
An organization is making significant changes to an application. At what point should the application risk profile be updated?
Which of the following conditions presents the GREATEST risk to an application?
An IT risk practitioner ' s report includes a treatment plan and projected risk ratings if recommendations are implemented. Once corrective actions are taken by the system owner, which of the following types of risk will the projected risk become?
Reviewing which of the following would provide the MOST useful information when preparing to evaluate the effectiveness of existing controls?
Which of the following is the MOST important component in a risk treatment plan?
Which of the following is the BEST indicator of the effectiveness of a control?
An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of risk is MOST likely to materialize?
The GREATEST benefit of introducing continuous monitoring to an IT control environment is that it:
Which of the following deficiencies identified during a review of an organization ' s cybersecurity policy should be of MOST concern?
An organization delegates its data processing to the internal IT team to manage information through its applications. Which of the following is the role of the internal IT team in this situation?
The effectiveness of a control has decreased. What is the MOST likely effect on the associated risk?
Which of the following will BEST quantify the risk associated with malicious users in an organization?
Which of the following is a risk practitioner ' s BEST recommendation regarding disaster recovery management (DRM) for Software as a Service (SaaS) providers?
Which of the following describes the relationship between Key risk indicators (KRIs) and key control indicators (KCIS)?
Which of the following controls would BEST reduce the likelihood of a successful network attack through social engineering?
Which of the following should be the starting point when performing a risk analysis for an asset?
Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?
Which of the following would be a weakness in procedures for controlling the migration of changes to production libraries?
One of an organization ' s key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner ' s BEST recommendation?
Several vulnerabilities have been identified in an organization’s core financial systems. Which of the following would be the risk practitioner’s BEST course of action?
Which of the following is the GREATEST risk associated with the use of data analytics?
Which of the following is the MOST important information to cover in a business continuity awareness training program for all employees of the organization?
An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?
Which of the following would MOST likely require a risk practitioner to update the risk register?
Which of the following is MOST helpful in reducing the likelihood of inaccurate risk assessment results?
Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?
A business manager wants to leverage an existing approved vendor solution from another area within the organization. Which of the following is the risk practitioner ' s BEST course of action?
Which of the following would be the BEST senior management action to influence a strong risk-aware culture within an organization?
Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?
Which of the following will BEST help to ensure implementation of corrective action plans?
Which of the following would be the result of a significant increase in the motivation of a malicious threat actor?
Which of the following BEST indicates that an organizations risk management program is effective?
An organization plans to migrate sensitive information to a public cloud infrastructure. Which of the following is the GREATEST security risk in this scenario?
The BEST way for an organization to ensure that servers are compliant to security policy is
to review:
Which of the following BEST indicates that an organization has implemented IT performance requirements?
Which of the following is MOST important to understand when developing key risk indicators (KRIs)?
Which of the following should be the GREATEST concern for an organization that uses open source software applications?
An identified high probability risk scenario involving a critical, proprietary business function has an annualized cost of control higher than the annual loss expectancy. Which of the following is the BEST risk response?
Which of the following controls will BEST detect unauthorized modification of data by a database administrator?
A multinational organization is considering implementing standard background checks to ' all new employees A KEY concern regarding this approach
An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system. The risk practitioner is documenting the risk in the risk register. The risk should be owned by the:
Which of the following should be the FIRST consideration when establishing a new risk governance program?
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of IT policies? The number of:
A vendor ' s planned maintenance schedule will cause a critical application to temporarily lose failover capabilities. Of the following, who should approve this proposed schedule?
Which of the following roles is BEST suited to help a risk practitioner understand the impact of IT-related events on business objectives?
An organization has identified that terminated employee accounts are not disabled or deleted within the time required by corporate policy. Unsure of the reason, the organization has decided to monitor the situation for three months to obtain more information. As a result of this decision, the risk has been:
Which of the following is MOST important for a risk practitioner to update when a software upgrade renders an existing key control ineffective?
An organization has decided to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable. As a result of this decision, the risk associated with these new entries has been;
A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?
Which of the following would be the BEST key performance indicator (KPI) for monitoring the effectiveness of the IT asset management process?
Which of the following is the BEST approach for a risk practitioner to use for identifying the level of technical debt in an organization?
Which of the following is the GREATEST benefit of reviewing security trends reported by a log monitoring system?
When asking risk owners to participate in a risk assessment based on generic scenarios, it would be MOST helpful to:
An organization ' s chief information officer (CIO) has proposed investing in a new. untested technology to take advantage of being first to market Senior management has concerns about the success of the project and has set a limit for expenditures before final approval. This conditional approval indicates the organization ' s risk:
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor ' s control environment?
A vendor ' s planned maintenance schedule will cause a critical application to temporarily lose failover capabilities. Of the following, who should approve this proposed schedule?
Which of the following actions should a risk practitioner do NEXT when an increased industry trend of external cyber attacks is identified?
Which of the following issues should be of GREATEST concern when evaluating existing controls during a risk assessment?
Which of the following problems is BEST solved by a cloud access security broker (CASB)?
Which of the following risk management practices BEST facilitates the incorporation of IT risk scenarios into the enterprise-wide risk register?
A risk practitioner has identified that the organization ' s secondary data center does not provide redundancy for a critical application. Who should have the authority to accept the associated risk?
Which of the following is the MOST relevant information to include in a risk management strategy?
Changes in which of the following would MOST likely cause a risk practitioner to adjust the risk impact rating in the risk register?
Which of the following is the MOST common concern associated with outsourcing to a service provider?
When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?
An organization is considering outsourcing user administration controls tor a critical system. The potential vendor has offered to perform quarterly sett-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to me risk practitioner?
An organization mandates the escalation of a service ticket when a key application is offline for 5 minutes or more due to potential risk exposure. The risk practitioner has been asked by management to prepare a report of application offline times using both 3- and 5-minute thresholds. What does the 3-minute threshold represent?
Which of the following is MOST helpful in identifying gaps between the current and desired state of the IT risk environment?
Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable information (PII)?
A risk practitioner is developing a set of bottom-up IT risk scenarios. The MOST important time to involve business stakeholders is when:
Which of the following would BEST facilitate the maintenance of data classification requirements?
Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?
Which organizational role should be accountable for ensuring information assets are appropriately classified?
Which of the following would MOST likely result in agreement on accountability for risk scenarios?
Which of the following is MOST important to include when reporting the effectiveness of risk management to senior management?
An organization is conducting a review of emerging risk. Which of the following is the BEST input for this exercise?
Which of the following is the PRIMARY reason to perform ongoing risk assessments?
An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following is the risk practitioner s BEST course of action?
An organization discovers significant vulnerabilities in a recently purchased commercial off-the-shelf software product which will not be corrected until the next release. Which of the following is the risk manager ' s BEST course of action?
After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:
Which of the following is the PRIMARY purpose of periodically reviewing an organization ' s risk profile?
A user has contacted the risk practitioner regarding malware spreading laterally across the organization ' s corporate network. Which of the following is the risk practitioner’s BEST course of action?
Which of the following is the BEST way to support communication of emerging risk?
Which of the following is the MOST important objective of an enterprise risk management (ERM) program?
Which of the following indicates an organization follows IT risk management best practice?
Which of the following sources is MOST relevant to reference when updating security awareness training materials?
An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes. Which of the following would be the BEST metric to determine if the program is performing as expected?
Which of the following BEST facilitates the mitigation of identified gaps between current and desired risk environment states?
The risk to an organization ' s reputation due to a recent cybersecurity breach is PRIMARILY considered to be:
Which of the following is a risk practitioner ' s BEST course of action upon learning that a control under internal review may no longer be necessary?
Which of the following is the GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs?
A financial institution has identified high risk of fraud in several business applications. Which of the following controls will BEST help reduce the risk of fraudulent internal transactions?
To minimize the risk of a potential acquisition being exposed externally, an organization has selected a few key employees to be engaged in the due diligence process. A member of the due diligence team realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired. What is the BEST course of action for this team member?
Which of the following can be affected by the cost of risk mitigation alternatives?
Of the following, who is responsible for approval when a change in an application system is ready for release to production?
Which of the following BEST reduces the likelihood of fraudulent activity that occurs through use of a digital wallet?
A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which ot the following is the risk practitioner ' s BEST course of action?
Which of the following will BEST ensure that controls adequately support business goals and objectives?
Which of the following is MOST important to ensure when reviewing an organization ' s risk register?
Which of the following is the BEST indicator of the effectiveness of a control monitoring program?
An organization is concerned that its employees may be unintentionally disclosing data through the use of social media sites. Which of the following will MOST effectively mitigate tins risk?
Which of the following is PRIMARILY a risk management responsibly of the first line of defense?
Which of the following is the BEST way to maintain a current list of organizational risk scenarios?
Which of the following is the GREATEST risk to an organization when using a public AI system to process credit card transactions?
The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:
Which of the following should be a risk practitioner ' s NEXT action after identifying a high probability of data loss in a system?
A bank wants to send a critical payment order via email to one of its offshore branches. Which of the following is the BEST way to ensure the message reaches the intended recipient without alteration?
Which of The following is the MOST comprehensive input to the risk assessment process specific to the effects of system downtime?
Which of the following is the BEST indication of a mature organizational risk culture?
What is the MOST important consideration when selecting key performance indicators (KPIs) for control monitoring?
Which of the following is the GREATEST benefit to an organization when updates to the risk register are made promptly after the completion of a risk assessment?
Which of the following is MOST important to the effectiveness of a senior oversight committee for risk monitoring?
Which of the following would BEST facilitate the implementation of data classification requirements?
An organization recently configured a new business division Which of the following is MOST likely to be affected?
Which of the following provides the BEST evidence of the effectiveness of an organization ' s account provisioning process?
Which of the following is MOST important when identifying an organization ' s risk exposure associated with Internet of Things (loT) devices?
Which of the following scenarios is MOST likely to cause a risk practitioner to request a formal risk acceptance sign-off?
Which of the following is the MOST important factor affecting risk management in an organization?
Which of the following will be MOST effective in helping to ensure control failures are appropriately managed?
An organization is implementing robotic process automation (RPA) to streamline business processes. Given that implementation of this technology is expected to impact existing controls, which of the following is the risk practitioner ' s BEST course of action?
Which of the following is the BEST source for identifying key control indicators (KCIs)?
An IT risk practitioner has been tasked to engage key stakeholders to assess risk for key IT risk scenarios. Which of the following is the PRIMARY benefit of this activity?
A risk practitioner has learned that the number of emergency change management tickets without subsequent approval has doubled from the same period of the previous year. Which of the following is the MOST important action for the risk practitioner to take?
Which of the following is MOST important for a project steering committee to consider when deciding to release a new system into production?
A risk practitioner has recently become aware of unauthorized use of confidential personal information within the organization. Which of the following should the risk practitioner do FIRST?
Which of the following is MOST important to ensure before using risk reports in decision making?
Malware has recently affected an organization. The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:
A control owner has completed a year-long project To strengthen existing controls. It is MOST important for the risk practitioner to:
Which of the following should be a risk practitioner ' s NEXT step upon learning the impact of an organization ' s noncompliance with a specific legal regulation?
Which of the following presents the GREATEST challenge for an IT risk practitioner who wants to report on trends in historical IT risk levels?
Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?
An organization uses a biometric access control system for authentication and access to its server room. Which control type has been implemented?
Which of the following analyses is MOST useful for prioritizing risk scenarios associated with loss of IT assets?
It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:
Changes in which of the following are MOST likely to trigger the need to reassess inherent risk?
What is the MOST effective approach to promote ethical decision-making in a global organization?
Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?
Which of the following is the MOST important input when developing risk scenarios?
Which of the following will BEST help in communicating strategic risk priorities?
Following an acquisition, the acquiring company ' s risk practitioner has been asked to update the organization ' s IT risk profile What is the MOST important information to review from the acquired company to facilitate this task?
Which of the following is MOST important to consider when determining risk appetite?
Which of the following is the MOST effective way to incorporate stakeholder concerns when developing risk scenarios?
Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?
Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization ' s risk appetite?
Which of the following should be the PRIMARY input to determine risk tolerance?
Which of the following is the PRIMARY reason to ensure software engineers test patches before release to the production environment?
Which of the following BEST indicates that security requirements have been incorporated into the system development life cycle (SDLC)?
The MOST important measure of the effectiveness of risk management in project implementation is the percentage of projects:
Participants in a risk workshop have become focused on the financial cost to mitigate risk rather than choosing the most appropriate response. Which of the following is the BEST way to address this type of issue in the long term?
Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?
A risk practitioner is conducting a risk assessment after discovering the use of unauthorized cloud software on personal devices to accomplish work-related tasks. Which of the following is the risk practitioner ' s BEST course of action?
When assessing the maturity level of an organization ' s risk management framework, which of the following deficiencies should be of GREATEST concern to a risk practitioner?
Which of the following is the BEST way for an organization to enable risk treatment decisions?
Which of the following is the GREATEST benefit of incorporating IT risk scenarios into the corporate risk register?
A risk practitioner notices that a particular key risk indicator (KRI) has remained below its established trigger point for an extended period of time. Which of the following should be done FIRST?
A technology company is developing a strategic artificial intelligence (Al)-driven application that has high potential business value. At what point should the enterprise risk profile be updated?
The PRIMARY advantage of involving end users in continuity planning is that they:
Which of the following should be the PRIMARY focus of an independent review of a risk management process?
Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization ' s risk register?
Which of the following BEST facilities the alignment of IT risk management with enterprise risk management (ERM)?
Which of the following risk register updates is MOST important for senior management to review?
The BEST way for management to validate whether risk response activities have been completed is to review:
Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented. Which risk treatment has been selected?
An organization ' s finance team is proposing the adoption of a blockchain technology to provide a secure method for moving funds. Which of the following should the risk practitioner do FIRST?
Which of the following is the PRIMARY objective of establishing an organization ' s risk tolerance and appetite?
Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management ' s action plan?
Which of the following is the MAIN reason to continuously monitor IT-related risk?
After the implementation of a blockchain solution, a risk practitioner discovers noncompliance with new industry regulations. Which of the following is the MOST important course of actionpriorto informing senior management?
Which of the following would MOST effectively enable a business operations manager to identify events exceeding risk thresholds?
Which of the following is the BEST method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system?
Which of the following BEST facilitates the development of relevant risk scenarios?
To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:
A risk practitioner is performing a risk assessment of recent external advancements in quantum computing. Which of the following would pose the GREATEST concern for the risk practitioner?
The following is the snapshot of a recently approved IT risk register maintained by an organization ' s information security department.
After implementing countermeasures listed in ‘’Risk Response Descriptions’’ for each of the Risk IDs, which of the following component of the register MUST change?
Which of the following BEST enables a risk practitioner to focus on risk factors that could potentially affect the results of an IT initiative?
Which of the following is the PRIMARY risk management responsibility of the third line of defense?
Which of the following factors will have the GREATEST impact on the implementation of a risk mitigation strategy for an organization?
For a large software development project, risk assessments are MOST effective when performed:
Which of the following is the BEST way to ensure adequate resources will be allocated to manage identified risk?
Which of the following is the PRIMARY purpose of creating and documenting control procedures?
Which of the following BEST enables a risk practitioner to enhance understanding of risk among stakeholders?
Which of the following BEST enables an organization to increase the likelihood of identifying risk associated with unethical employee behavior?
Which of the following BEST enables senior management lo compare the ratings of risk scenarios?
Which of the following BEST ensures that the data feeds used by an organization are complete and accurate?
Which of the following BEST indicates the efficiency of a process for granting access privileges?
Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure?
Which of the following is the BEST way to prevent the loss of highly sensitive data when disposing of storage media?
An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers. Which of the following should be the MOST important consideration for a risk-based review of the user requirements?
Which of the following is the BEST method of creating risk awareness in an organization?
Which of the following is the GREATEST concern if user acceptance testing (UAT) is not conducted when implementing a new application?
An organization ' s risk tolerance should be defined and approved by which of the following?
An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program. The PRIMARY goal of this program should be to:
Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?
Which of the following BEST supports the communication of risk assessment results to stakeholders?
Which risk response strategy could management apply to both positive and negative risk that has been identified?
Which of the following provides the BEST indication that existing controls are effective?
Which of the following is the MOST important objective of regularly presenting the project risk register to the project steering committee?
Which of the following is MOST important to identify when developing top-down risk scenarios?
Which of the following is MOST helpful to management when determining the resources needed to mitigate a risk?
An organization wants to transfer risk by purchasing cyber insurance. Which of the following would be MOST important for the risk practitioner to communicate to senior management for contract negotiation purposes?
Which of the following should be done FIRST upon learning that the organization will be affected by a new regulation in its industry?
A highly regulated enterprise is developing a new risk management plan to specifically address legal and regulatory risk scenarios What should be done FIRST by IT governance to support this effort?
Which of the following is the GREATEST benefit of having a mature enterprise architecture (EA) in place?
An incentive program is MOST likely implemented to manage the risk associated with loss of which organizational asset?
A new regulator/ requirement imposes severe fines for data leakage involving customers ' personally identifiable information (Pll). The risk practitioner has recommended avoiding the risk. Which of the following actions would BEST align with this recommendation?
What is the GREATEST concern with maintaining decentralized risk registers instead of a consolidated risk register?
Which of the following roles is PRIMARILY accountable for risk associated with business information protection?
In an organization that allows employee use of social media accounts for work purposes, which of the following is the BEST way to protect company sensitive information from being exposed?
Which of the following is the MOST effective way for a large and diversified organization to minimize risk associated with unauthorized software on company devices?
An organization is planning to outsource its payroll function to an external service provider Which of the following should be the MOST important consideration when selecting the provider?
Who is BEST suited to provide information to the risk practitioner about the effectiveness of a technical control associated with an application?
Which of the following events is MOST likely to trigger the need to conduct a risk assessment?
A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management. The BEST way to support risk-based decisions by senior management would be to:
Which of the following is the MOST important key performance indicator (KPI) to establish in the service level agreement (SLA) for an outsourced data center?
Which of the following is the MOST effective way to mitigate identified risk scenarios?
The PRIMARY reason for a risk practitioner to review business processes is to:
Which of the following should be considered FIRST when creating a comprehensive IT risk register?
Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?
Which of the following BEST indicates that an organization ' s disaster recovery plan (DRP) will mitigate the risk of the organization failing to recover from a major service disruption?
Which of the following is the BEST way to detect zero-day malware on an end user ' s workstation?
A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization ' s data-handling policy and local privacy regulations. Which of the following would be the BEST recommendation?
Which of the following provides the MOST helpful information in identifying risk in an organization?
Which of the following BEST contributes to the implementation of an effective risk response action plan?
An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST concern to the risk practitioner?
Which of the following is the GREATEST concern related to the monitoring of key risk indicators (KRIs)?
Which of the following provides the MOST useful information to determine risk exposure following control implementations?
Which of the following is the MOST important update for keeping the risk register current?
Which of the following is MOST important for a multinational organization to consider when developing its security policies and standards?
What are the MOST important criteria to consider when developing a data classification scheme to facilitate risk assessment and the prioritization of risk mitigation activities?
Which of the following is the MOST useful information for prioritizing risk mitigation?
Which of the following is the PRIMARY benefit of using a risk map with stakeholders?
Which of the following BEST represents a critical threshold value for a key control indicator (KCI)?
When developing risk scenario using a list of generic scenarios based on industry best practices, it is MOST imported to:
Which of the following presents the GREATEST privacy risk related to personal data processing for a global organization?
After the implementation of internal of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?
Business management is seeking assurance from the CIO that IT has a plan in place for early identification of potential issues that could impact the delivery of a new application Which of the following is the BEST way to increase the chances of a successful delivery ' ?
An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative ' s objectives?
The PRIMARY objective of the board of directors periodically reviewing the risk profile is to help ensure:
Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?
A risk practitioner notices a trend of noncompliance with an IT-related control. Which of the following would BEST assist in making a recommendation to management?
The BEST way to justify the risk mitigation actions recommended in a risk assessment would be to:
Which of the following is the BEST course of action to help reduce the probability of an incident recurring?
A bank is experiencing an increasing incidence of customer identity theft. Which of the following is the BEST way to mitigate this risk?
Which of the following is the MOST important consideration when establishing a recovery point objective (RPO)?
Prior to selecting key performance indicators (KPIs), itis MOST important to ensure:
Vulnerabilities have been detected on an organization ' s systems. Applications installed on these systems will not operate if the underlying servers are updated. Which of the following is the risk practitioner ' s BEST course of action?
Which of the following BEST indicates whether security awareness training is effective?
Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?
An organization plans to implement a new AI application, but the risk practitioner learns that IT policies do not address AI. Which of the following would be the risk practitioner ' s GREATEST concern?
A recent big data project has resulted in the creation of an application used to support important investment decisions. Which of the following should be of GREATEST concern to the risk practitioner?
Which of the following should be the MOST important consideration when performing a vendor risk assessment?
When classifying and prioritizing risk responses, the areas to address FIRST are those with:
Who should be accountable for monitoring the control environment to ensure controls are effective?
Which of the following should be an element of the risk appetite of an organization?
To drive effective risk management, it is MOST important that an organization ' s policy framework is:
Which of the following is the MOST significant indicator of the need to perform a penetration test?
Which of the following is the GREATEST concern associated with the transmission of healthcare data across the internet?
Zero Trust architecture is designed and deployed with adherence to which of the following basic tenets?
Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?
When testing the security of an IT system, il is MOST important to ensure that;
An organization outsources the processing of us payroll data A risk practitioner identifies a control weakness at the third party trial exposes the payroll data. Who should own this risk?
A poster has been displayed in a data center that reads. " Anyone caught taking photographs in the data center may be subject to disciplinary action. " Which of the following control types has been implemented?
Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?
Which of the following is the BEST Key control indicator KCO to monitor the effectiveness of patch management?
Which of the following approaches BEST identifies information systems control deficiencies?
In an organization where each division manages risk independently, which of the following would BEST enable management of risk at the enterprise level?
When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?
Which of the following is the MOST important outcome of reviewing the risk management process?
Which of the following should be the PRIMARY basis for establishing a priority sequence when restoring business processes after a disruption?
Which of the following is MOST important for senior management to review during an acquisition?
Which of the following is the PRIMARY reason to use administrative controls in conjunction with technical controls?
Which of the following would be MOST helpful when communicating roles associated with the IT risk management process?
A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss exposure. The result is that the control is:
Which of the following will BEST help to ensure key risk indicators (KRIs) provide value to risk owners?
Which of the following provides the MOST useful information when measuring the progress of risk response action plans?
A segregation of duties control was found to be ineffective because it did not account for all applicable functions when evaluating access. Who is responsible for ensuring the control is designed to effectively address risk?
Which of the following is the BEST method for assessing control effectiveness?
Which of the following would provide the BEST guidance when selecting an appropriate risk treatment plan?
Which of We following is the MOST effective control to address the risk associated with compromising data privacy within the cloud?
Which of the following changes would be reflected in an organization ' s risk profile after the failure of a critical patch implementation?
An organization has adopted an emerging technology without following proper processes. Which of the following is the risk practitioner ' s BEST course of action to address this risk?
A new risk practitioner finds that decisions for implementing risk response plans are not being made. Which of the following would MOST likely explain this situation?
Which of the following will BEST help to improve an organization ' s risk culture?
Of the following, who should be responsible for determining the inherent risk rating of an application?
Which of the following should be the FIRST course of action if the risk associated with a new technology is found to be increasing?
An organization has decided to implement a new Internet of Things (loT) solution. Which of the following should be done FIRST when addressing security concerns associated with this new technology?
Which of the following is the PRIMARY benefit when senior management periodically reviews and updates risk appetite and tolerance levels?
Which of the following is the BEST approach for an organization in a heavily regulated industry to comprehensively test application functionality?
Which of the following is the BEST way to determine whether system settings are in alignment with control baselines?
Which of the following will BEST ensure that information security risk factors are mitigated when developing in-house applications?
Which of the following is the BEST way to ensure ongoing control effectiveness?
An organization has raised the risk appetite for technology risk. The MOST likely result would be:
A risk practitioner has been made aware of a problem in an IT system that was missed during a routine risk assessment. Which of the following is the practitioner ' s BEST course of action?
Which of the following is the GREATEST concern when using artificial intelligence (AI) language models?
A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two years ago. Which of the following is the GREATEST concern with this request?
Sensitive data has been lost after an employee inadvertently removed a file from the premises, in violation of organizational policy. Which of the following controls MOST likely failed?
All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness, the BEST course of action would be to:
WhichT5f the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?
An organization recently implemented an extensive risk awareness program after a cybersecurity incident. Which of the following is MOST likely to be affected by the implementation of the program?
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:
When performing a risk assessment of a new service to support a ewe Business process. which of the following should be done FRST10 ensure continuity of operations?
Which of the following poses the GREATEST risk to an organization ' s operations during a major it transformation?
Which of the following is the PRIMARY reason for monitoring activities performed in a production database environment?
Which of the following BEST enables the identification of trends in risk levels?
A risk practitioner has been asked by executives to explain how existing risk treatment plans would affect risk posture at the end of the year. Which of the following is MOST helpful in responding to this request?
A new software package that could help mitigate risk in an organization has become available. Which of the following is the risk practitioner’s BEST course of action?
Which of the following is the BEST indication that an organization ' s risk management program has not reached the desired maturity level?
Which of the following is the MOST important enabler of effective risk management?
Which of the following is accountable for the management of IT risk within an organization?
In the context of the three lines model, which of the following is responsible for providing assurance to senior management and the governing body through independent and objective reviews?
A software developer has administrative access to a production application. Which of the following should be of GREATEST concern to a risk practitioner?
Which of the following BEST enables the selection of appropriate risk treatment in the event of a disaster?
From a risk management perspective, the PRIMARY objective of using maturity models is to enable:
Which of the following elements of a risk register is MOST likely to change as a result of change in management ' s risk appetite?
Which of the following should be of GREATEST concern to a risk practitioner reviewing an organization ' s disaster recovery plan (DRP)?
A deficient control has been identified which could result in great harm to an organization should a low frequency threat event occur. When communicating the associated risk to senior management the risk practitioner should explain:
An updated report from a trusted research organization shows that attacks have increased in the organization ' s industry segment. What should be done FIRST to integrate this data into risk assessments?
Which of the following is the MOST critical factor to consider when determining an organization ' s risk appetite?
Which of the following is a risk practitioner ' s BEST recommendation to help reduce IT risk associated with scheduling overruns when starting a new application development project?
Which of the following is the MOST important course of action to foster an ethical, risk-aware culture?
An organization has initiated a project to implement an IT risk management program for the first time. The BEST time for the risk practitioner to start populating the risk register is when:
Which of the following would have the GREATEST impact on reducing the risk associated with the implementation of a big data project?
Which of the following would provide the BEST evidence of an effective internal control environment/?
Which of the following should be the PRIMARY focus of an IT risk awareness program?
Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?
Which of the following BEST helps to identify significant events that could impact an organization?
Vulnerability analysis
An external security audit has reported multiple findings related to control noncompliance. Which of the following would be MOST important for the risk practitioner to communicate to senior management?
Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?
Which of the following trends would cause the GREATEST concern regarding the effectiveness of an organization ' s user access control processes? An increase in the:
A business delegates its application data management to the internal IT team. Which of the following is the role of the internal IT team in this situation?
Which of the following attributes of a key risk indicator (KRI) is MOST important?
A risk practitioner implemented a process to notify management of emergency changes that may not be approved. Which of the following is the BEST way to provide this information to management?
Which of the following is MOST essential for an effective change control environment?
Which of the following would provide the MOST useful information to a risk owner when reviewing the progress of risk mitigation?
Which of the following is the BEST indicator of executive management ' s support for IT risk mitigation efforts?
Which of the following is the MOST important consideration when communicating the risk associated with technology end-of-life to business owners?
Which of the following would be of GREATEST assistance when justifying investment in risk response strategies?
Which of the following is a risk practitioner ' s BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?
Of the following, who is BEST suited to assist a risk practitioner in developing a relevant set of risk scenarios?
An employee lost a personal mobile device that may contain sensitive corporate information. What should be the risk practitioner ' s recommendation?
An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?
During an organization ' s simulated phishing email campaign, which of the following is the BEST indicator of a mature security awareness program?
The PRIMARY benefit of conducting continuous monitoring of access controls is the ability to identify:
A large organization recently restructured the IT department and has decided to outsource certain functions. What action should the control owners in the IT department take?
Which of the following is the PRIMARY consideration when determining the impact to an organization after the discovery of malware on an endpoint device?
Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?
A new policy has been published to forbid copying of data onto removable media. Which type of control has been implemented?
An IT manager insists on accepting an IT risk associated with a key business process due to the limited resources available to mitigate. Which of the following is the risk practitioner ' s MOST important action?
Which of the following contributes MOST to the effective implementation of risk responses?
A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption. Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?
Which of the following approaches MOST effectively enables accountability for data protection?
Key performance indicators (KPIs) are BEST utilized to provide a high-level overview of:
An IT project risk was identified during a monthly steering committee meeting. Which of the following roles is BEST positioned to approve the risk mitigation response?
Which of the following activities is MOST likely to be assigned to the second line in the three lines model?
A global organization has implemented an application that does not address all privacy requirements across multiple jurisdictions. Which of the following risk responses has the organization adopted with regard to privacy requirements?
Which of the following would BEST help an enterprise define and communicate its risk appetite?
Which of the following is MOST helpful to ensure effective security controls for a cloud service provider?
An internal audit report reveals that not all IT application databases have encryption in place. Which of the following information would be MOST important for assessing the risk impact?
A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?
Which of the following presents the GREATEST concern associated with the
use of artificial intelligence (Al) systems?
Which of the following is a crucial component of a key risk indicator (KRI) to ensure appropriate action is taken to mitigate risk?
When developing a risk awareness training program, which of the following is the BEST way to promote a risk-aware culture?
Which of the following should a risk practitioner do NEXT after learning that Internet of Things (loT) devices installed in the production environment lack appropriate security controls for
sensitive data?
Which of the following is the PRIMARY reason to establish the root cause of an IT security incident?
Which of the following is the GREATEST benefit of analyzing logs collected from different systems?
PDF + Testing Engine
Testing Engine
PDF (Q&A)
