100 Free CRISC Practice Questions and Answers
100 questions for the CRISC exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Risk appetite is fundamentally a business decision that reflects what level of risk an organization is willing to accept to achieve its objectives. This is primarily driven by stakeholder requirements, which include board members, executives, and key business leaders who determine the organization's tolerance for risk. While legal/regulatory requirements, BIA, and security architecture inform risk decisions, they are constraints or inputs to risk appetite rather than its primary driver.
Not this one. Try another answer.
Why B is wrong
Security architecture roadmap is a tool to implement risk management, not the primary driver of risk appetite.
Not this one. Try another answer.
Why C is wrong
BIA identifies business impacts but does not determine the organization's willingness to accept risk.
Not this one. Try another answer.
Why D is wrong
Legal and regulatory requirements are compliance constraints, not the primary driver of risk appetite itself.
Question 2 Play from 01:47
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Changes in IT risk tolerance have the greatest impact on organizational strategy because risk tolerance defines the organization's willingness to pursue opportunities and shapes strategic decision-making at the highest level. Risk tolerance directly influences which initiatives are approved, how resources are allocated, and the overall strategic direction of the enterprise.
Not this one. Try another answer.
Why B is wrong
Risk identification methodology affects execution quality but not the strategic direction or fundamental business priorities.
Not this one. Try another answer.
Why C is wrong
Recovery plan complexity relates to operational resilience but does not drive or shape organizational strategy.
Not this one. Try another answer.
Why D is wrong
IT architecture complexity is a technical consideration that influences capabilities but is secondary to risk tolerance in determining strategy.
Question 3 Play from 03:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk identification is an activity within the assessment process, not the output.
Not this one. Try another answer.
Why B is wrong
Identification of appropriate controls is part of risk treatment planning, which comes after assessment.
Not this one. Try another answer.
Why C is wrong
Mitigated risk occurs after controls are implemented, not as an output of the assessment itself.
Right, D is the answer.
Why D is right
The risk assessment process produces identification of risks, their analysis, and evaluation, which results in residual risk, the risk remaining after controls are considered. While risk identification and control identification are activities within the process, and mitigated risk is a state that occurs after implementation, residual risk is the actual output that the enterprise is left with after assessment and is the key deliverable showing what risk remains.
Question 4 Play from 05:22
Which of the following should be done NEXT to determine the risk exposure?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Gap assessment examines the difference between current and desired states but doesn't determine risk exposure from identified vulnerabilities.
Not this one. Try another answer.
Why B is wrong
BIA analyzes impact of disruptions but comes after understanding what risks actually exist and can be exploited.
Not this one. Try another answer.
Why C is wrong
Code review is a control activity but doesn't directly demonstrate risk exposure or exploitability in the live environment.
Right, D is the answer.
Why D is right
After identifying vulnerabilities through assessment, a penetration test is the next logical step to determine actual risk exposure. A penetration test validates whether vulnerabilities can be exploited in practice and measures the real-world impact, thereby establishing true risk exposure. This active testing demonstrates exploitability and business impact more effectively than theoretical assessments.
Question 5 Play from 07:09
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Considering relevant business activities should be done first when developing initial risk scenarios. Understanding the organization's actual business processes, operations, and activities provides the context necessary to identify realistic and meaningful risk scenarios. This business-centric foundation ensures scenarios are relevant and actionable.
Not this one. Try another answer.
Why B is wrong
A top-down approach is valid but comes after understanding the business activities being assessed.
Not this one. Try another answer.
Why C is wrong
A bottom-up approach is also valid but requires first knowing what business activities exist to build up from.
Not this one. Try another answer.
Why D is wrong
Industry standard scenarios are useful reference points but should not be the starting point; scenarios must be tailored to the organization's specific business context.
Question 6 Play from 08:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Determining risk appetite and tolerance is a senior management and board responsibility, not individual risk owners.
Not this one. Try another answer.
Why B is wrong
Developing control procedures is typically the responsibility of control owners and operational management, not the risk owner.
Right, C is the answer.
Why C is right
The risk owner is the individual accountable for a specific risk and holds the primary responsibility for deciding how to respond to that risk, whether to avoid, mitigate, transfer, or accept it. The risk owner makes the critical judgment about which response strategy is appropriate given their business knowledge and risk tolerance. They may delegate implementation, but the decision about response belongs to the owner.
Not this one. Try another answer.
Why D is wrong
Implementing risk action plans is often delegated to operations or control owners; the risk owner's role is deciding the response, not necessarily executing it.
Question 7 Play from 10:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Automated data feeds are necessary for efficiency but cannot be effectively implemented without predetermined thresholds.
Not this one. Try another answer.
Why B is wrong
Controls monitoring addresses control effectiveness but is separate from KRI monitoring implementation.
Not this one. Try another answer.
Why C is wrong
Escalation procedures are necessary but should be triggered based on threshold definitions, making thresholds the prerequisite.
Right, D is the answer.
Why D is right
Threshold definition needs to be in place first because it establishes what levels of KRIs constitute acceptable versus unacceptable risk, providing the baseline for determining when escalation is needed and what constitutes a meaningful change. All other monitoring elements depend on having defined thresholds.
Question 8 Play from 12:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A data protection officer advises on data protection practices but does not hold accountability for classification of all information assets.
Not this one. Try another answer.
Why B is wrong
A CIO sets enterprise policy and strategy but does not directly own each individual information asset's classification.
Not this one. Try another answer.
Why C is wrong
An information asset custodian implements and maintains controls but is responsible to the owner, not accountable for the classification decision.
Right, D is the answer.
Why D is right
The information asset owner holds primary accountability for ensuring that information assets under their purview are appropriately classified. This is a foundational responsibility of asset ownership - to understand what assets exist, determine their value and sensitivity, and establish appropriate classification levels. While a data protection officer may advise on classification standards and a CIO may set organizational policy, and a custodian may implement controls, the owner is ultimately accountable for the classification decision itself.
Question 9 Play from 14:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IDS rules are detection tools but don't provide evidence of actual malicious behavior that occurred.
Not this one. Try another answer.
Why B is wrong
Penetration test reports show what could be exploited, not what was actually exploited in current activity.
Not this one. Try another answer.
Why C is wrong
Vulnerability assessments identify potential weaknesses but don't validate whether suspicious activity is malicious.
Right, D is the answer.
Why D is right
Logs and system events provide the actual forensic evidence of what occurred on the network and systems during suspicious activity. By examining detailed logs and event records, a risk practitioner can trace the activity, understand its behavior, impact, and intent, directly validating whether the activity is actually malicious. IDS rules, penetration tests, and vulnerability assessments provide detection mechanisms or potential attack vectors but do not directly validate what actually happened in real-time.
Question 10 Play from 16:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Establishing risk appetite is a governance decision made before detailed scenario analysis, not the main reason for conducting the analysis itself.
Not this one. Try another answer.
Why B is wrong
Identifying additional risk scenarios may be a byproduct of thorough analysis, but it is not the primary purpose of analyzing specific scenarios.
Not this one. Try another answer.
Why C is wrong
Updating the heat map is a documentation step that follows risk analysis rather than being the main reason for conducting the analysis.
Right, D is the answer.
Why D is right
The main reason for analyzing risk scenarios is to assess loss expectancy, understanding the potential financial or operational impact of identified risks. This quantitative or qualitative assessment of expected losses helps organizations prioritize risks and make informed decisions about resource allocation and mitigation strategies. While risk scenario analysis may contribute to other activities, assessing loss expectancy is the fundamental objective that drives the analysis process.
Show all 100 questionsShow fewer questions
Question 11 Play from 18:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The CRO (Chief Risk Officer) manages risks but does not initiate projects.
Right, B is the answer.
Why B is right
The project sponsor is the key role that initiates a project during the initiation phase. The sponsor is a senior stakeholder or executive who authorizes and champions the project, provides necessary resources, and establishes the project charter. The sponsor's approval and authorization signal the formal beginning of the project.
Not this one. Try another answer.
Why C is wrong
Business management supports the project but the specific role of sponsor is the formal initiator.
Not this one. Try another answer.
Why D is wrong
The CIO (Chief Information Officer) may be involved in IT projects but is not necessarily the initiator role.
Question 12 Play from 19:32
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Risk communication is the most crucial part of the risk management process because identified and analyzed risks have no value unless effectively communicated to relevant stakeholders who can act on them. Without clear communication, even well-executed risk identification and analysis fail to drive appropriate risk responses and organizational decisions. Auditing (B) and monitoring (C) are important but are activities applied after communication enables action, and mitigation (D) depends on stakeholders understanding risks through proper communication.
Not this one. Try another answer.
Why B is wrong
Auditing validates controls but does not drive the understanding and decision-making that communication enables.
Not this one. Try another answer.
Why C is wrong
Monitoring tracks risks over time but cannot occur effectively without initial proper communication of risks identified.
Not this one. Try another answer.
Why D is wrong
Mitigation decisions depend on stakeholders first understanding risks through effective communication of analysis results.
Question 13 Play from 21:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk mitigation refers to actions taken to reduce risk, not the statement of acceptable risk levels.
Not this one. Try another answer.
Why B is wrong
Risk appetite is the broader, general willingness to take on risk; risk tolerance is the more specific, measurable threshold.
Not this one. Try another answer.
Why C is wrong
Risk evaluation refers to analyzing and assessing risks, not establishing acceptable risk thresholds.
Right, D is the answer.
Why D is right
Risk tolerance is the specific, quantifiable level of risk that an organization is willing to accept in the pursuit of its objectives. The statement that the organization will not accept availability below 98.5% is a precise tolerance level, defining the minimum acceptable threshold for this specific risk metric, which is the definition of risk tolerance.
Question 14 Play from 22:57
What will be the number of communication channel s for the project?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
20 channels is far too low and does not apply the correct formula.
Not this one. Try another answer.
Why B is wrong
100 channels would result from a smaller stakeholder population or incorrect calculation.
Not this one. Try another answer.
Why C is wrong
50 channels does not align with the standard communication channel formula for 25 stakeholders.
Right, D is the answer.
Why D is right
The number of communication channels in a project is calculated using the formula: n(n-1)/2, where n is the number of stakeholders. With 25 stakeholders, the calculation is 25 × 24 ÷ 2 = 300 communication channels. This represents all potential two-way communication paths between any pair of stakeholders, which is the standard method for determining project communication complexity.
Question 15 Play from 24:39
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A third-party audit provides the MOST objective assessment because external auditors operate independently without internal biases, political pressures, or conflicts of interest. They apply consistent external standards and have professional credibility and liability, creating the highest level of objectivity and credibility in evaluating whether controls are actually effective.
Not this one. Try another answer.
Why B is wrong
Internal penetration testing, while valuable, is conducted by employees who may have internal relationships and pressures affecting objectivity.
Not this one. Try another answer.
Why C is wrong
A security operations center review is an internal function subject to operational pressures and existing perspectives.
Not this one. Try another answer.
Why D is wrong
Internal audits, though professional, lack the independence and external perspective of third-party assessments.
Question 16 Play from 26:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Quantitative analysis of historical data focuses on past events and may miss emerging or novel scenarios.
Right, B is the answer.
Why B is right
Brainstorming sessions with key stakeholders facilitate relevant risk scenario development because participants bring diverse perspectives, operational knowledge, and creativity to identify plausible loss scenarios. This collaborative approach generates scenarios grounded in organizational reality and stakeholder insights that purely analytical methods cannot achieve.
Not this one. Try another answer.
Why C is wrong
Qualitative assessment is useful but is a method for evaluating scenarios, not developing them.
Not this one. Try another answer.
Why D is wrong
Industry frameworks provide structure and reference points but do not directly generate organization-specific relevant scenarios.
Question 17 Play from 28:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The primary focus of an IT risk awareness program should be to cultivate long-term behavioral change in how employees handle IT risks and security. Awareness programs aim to embed security-conscious practices into organizational culture and individual habits, creating sustained improvements in security behavior beyond the training event itself.
Not this one. Try another answer.
Why B is wrong
Demonstrating regulatory compliance is a business benefit but not the primary focus; compliance results from effective awareness, not the reverse.
Not this one. Try another answer.
Why C is wrong
Ensuring policy compliance is important but narrower than the broader goal of fostering long-term behavioral change.
Not this one. Try another answer.
Why D is wrong
Communicating policy is a tactical component of awareness, not the primary focus; changing actual behavior is the ultimate goal.
Question 18 Play from 29:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Gathering scenarios only from senior management may miss important perspectives and risks known to operational or technical staff.
Not this one. Try another answer.
Why B is wrong
Deriving scenarios from policies and standards alone may not capture all relevant risks or emerging threats comprehensively.
Not this one. Try another answer.
Why C is wrong
Benchmarking against peers provides useful comparisons but may not account for organization-specific risks or unique threat landscapes.
Right, D is the answer.
Why D is right
Mapping scenarios to a recognized risk management framework provides the most comprehensive and structured approach because it ensures that scenarios are systematically developed, aligned with best practices, and cover the full spectrum of IT risks in an organized manner. A framework provides structure, completeness, and consistency. Senior management input, policy derivation, and benchmarking are useful inputs but lack the comprehensiveness and systematic rigor of a framework-based approach.
Question 19 Play from 31:55
Which one of the following will NOT help Wendy to perform this project management activity?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk Management Plan provides the methodology, definitions, and context for the analysis.
Not this one. Try another answer.
Why B is wrong
Project Scope Statement provides project boundaries, constraints, and assumptions critical to analyzing risk impact.
Not this one. Try another answer.
Why C is wrong
Risk Register contains the identified risks that are the primary input for qualitative analysis.
Right, D is the answer.
Why D is right
The Stakeholder Register identifies who the stakeholders are but does not directly support the qualitative risk analysis process. Qualitative risk analysis requires the Risk Management Plan (processes and tools), Project Scope Statement (constraints and assumptions), and Risk Register (identified risks to analyze). The Stakeholder Register is useful for other processes but not essential for performing qualitative analysis.
Question 20 Play from 33:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Audit findings communication is important but reactive; open risk reporting is proactive and culturally transformative.
Right, B is the answer.
Why B is right
Open communication of risk reporting is most important for promoting a risk-aware culture because it demonstrates transparency, encourages accountability, and signals that risk conversations are valued and expected throughout the organization. When risks are openly discussed without fear of punitive consequences, employees at all levels become more engaged in identifying and addressing risks. This creates the psychological and organizational foundation for risk awareness.
Not this one. Try another answer.
Why C is wrong
Security monitoring procedures are technical controls but do not directly promote cultural awareness of risk.
Not this one. Try another answer.
Why D is wrong
Testing controls validates their effectiveness but does not engage staff in the culture of risk awareness.
Question 21 Play from 35:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Quantitative Risk Analysis focuses on numerical analysis of risks, not assigning response owners.
Not this one. Try another answer.
Why B is wrong
Identify Risks is the discovery process, not the assignment of response owners.
Right, C is the answer.
Why C is right
Planning Risk Response is the process where specific risk responses are developed, owners are assigned to each agreed-upon and funded risk response, and accountability is established. This process involves determining how to handle identified risks through mitigation, avoidance, acceptance, or escalation strategies, and designating a responsible owner for each response action.
Not this one. Try another answer.
Why D is wrong
Qualitative Risk Analysis assesses probability and impact subjectively, not assigns response owners.
Question 22 Play from 37:14
Each correct answer represents a complete solution. (Choose three.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The phases of risk identification and evaluation include: Maintaining a Risk Profile (A) to track identified risks, Collecting Data (B) through interviews and analysis, and Analyzing Risk (C) to understand probability and impact. Applying Controls (D) is part of risk response and treatment, which occurs after identification and evaluation, making it part of a separate phase.
Right, B is one of the answers.
Why B is right
The phases of risk identification and evaluation include: Maintaining a Risk Profile (A) to track identified risks, Collecting Data (B) through interviews and analysis, and Analyzing Risk (C) to understand probability and impact. Applying Controls (D) is part of risk response and treatment, which occurs after identification and evaluation, making it part of a separate phase.
Right, C is one of the answers.
Why C is right
The phases of risk identification and evaluation include: Maintaining a Risk Profile (A) to track identified risks, Collecting Data (B) through interviews and analysis, and Analyzing Risk (C) to understand probability and impact. Applying Controls (D) is part of risk response and treatment, which occurs after identification and evaluation, making it part of a separate phase.
Not this one. Try another answer.
Why D is wrong
Applying controls is part of risk response and treatment, not identification and evaluation phases.
Question 23 Play from 38:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Rejecting a high-risk project is risk avoidance, not risk sharing.
Right, B is the answer.
Why B is right
Risk sharing involves distributing or transferring risk to another party. Outsourcing the hosting of a critical system shares the risk with the external hosting provider, who assumes responsibility for infrastructure and availability risks. This is a classic example of risk sharing as opposed to risk acceptance, mitigation, or avoidance.
Not this one. Try another answer.
Why C is wrong
Investing in fault-tolerant technology is risk mitigation, reducing the impact or likelihood of risk.
Not this one. Try another answer.
Why D is wrong
A code escrow agreement is a risk mitigation control that protects against vendor failure but does not share the risk with another party.
Question 24 Play from 40:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Legal and regulatory risk for Internet business is driven by the laws and regulations of each individual country because the Internet operates globally, and organizations must comply with the regulatory requirements of every jurisdiction where they conduct business or have customers. There is no single uniform international law governing Internet commerce; instead, businesses must navigate a complex patchwork of national and regional regulations.
Not this one. Try another answer.
Why B is wrong
The principal headquarters location is only one jurisdiction; organizations must comply with regulations in all countries where they operate.
Not this one. Try another answer.
Why C is wrong
There is no uniform set of international laws for Internet business; regulations vary significantly by jurisdiction.
Not this one. Try another answer.
Why D is wrong
While standard-setting bodies provide recommendations, actual legal and regulatory risk is driven by national laws, not voluntary standards.
Question 25 Play from 42:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Password policies protect access to systems but do not prevent fraudulent transactions once access is gained.
Not this one. Try another answer.
Why B is wrong
Monetary approval limits reduce exposure but can be bypassed through collusion or by splitting transactions.
Not this one. Try another answer.
Why C is wrong
Clear roles and responsibilities establish accountability but do not inherently prevent fraud without additional compensating controls.
Right, D is the answer.
Why D is right
Segregation of duties is the most effective control to prevent fraudulent transactions in large organizations. It ensures that no single individual can complete a transaction independently, requiring multiple people to be involved in critical processes. This creates checks and balances that make it significantly harder for fraudulent activities to occur. While the other options contribute to security, none is as directly effective at preventing the specific risk of fraudulent transactions as segregation of duties.
Question 26 Play from 44:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A risk dashboard displays current risk status but does not inherently show the connection between IT risk outcomes and organizational objectives.
Not this one. Try another answer.
Why B is wrong
A RACI chart clarifies roles and responsibilities but does not map risk outcomes to strategic business objectives.
Not this one. Try another answer.
Why C is wrong
An information security risk map shows security risks but is narrower in scope than organizational objectives and doesn't address the full range of IT risks.
Right, D is the answer.
Why D is right
A strategic business plan defines the organization's objectives and priorities, making it the essential reference point for mapping IT risk management outcomes to business goals. Without understanding the strategic plan, it is impossible to determine which risks matter most or how IT risk management should be prioritized relative to organizational objectives. The business plan provides the framework that gives context and meaning to all risk management activities.
Question 27 Play from 46:00
Each correct answer represents a part of the solution. (Choose two.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Qualitative risk assessment evaluates risks using descriptive terms related to Impact (severity of consequences) and Probability (likelihood of occurrence). These two factors are combined in qualitative analysis, often using matrices that rate risks as high, medium, or low based on these dimensions.
Not this one. Try another answer.
Why B is wrong
Annual rate of occurrence is a quantitative metric used in quantitative risk assessment with numerical values, not qualitative assessment.
Right, C is one of the answers.
Why C is right
Qualitative risk assessment evaluates risks using descriptive terms related to Impact (severity of consequences) and Probability (likelihood of occurrence). These two factors are combined in qualitative analysis, often using matrices that rate risks as high, medium, or low based on these dimensions.
Not this one. Try another answer.
Why D is wrong
Single loss expectancy is a quantitative calculation combining monetary values, not a qualitative assessment term.
Question 28 Play from 47:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Control design documentation shows intent but does not prove the control actually functions as designed.
Not this one. Try another answer.
Why B is wrong
Length of operation time is irrelevant to effectiveness; a long-standing control may still be ineffective.
Right, C is the answer.
Why C is right
Evidence of operation is most important when substantiating control effectiveness. Demonstrating that a control actually operates as designed, through logs, records, testing results, and other operational evidence, proves its effectiveness. Design documentation alone does not prove a control works; time in operation is irrelevant if ineffective; and assessor certification is not evidence of actual control performance.
Not this one. Try another answer.
Why D is wrong
An assessor's certification is a conclusion based on evidence, not itself substantiation of effectiveness.
Question 29 Play from 49:17
Which risk response option has been decided?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Transfer would mean shifting the risk to a third party through insurance or contractual terms, not implementing compensating controls.
Not this one. Try another answer.
Why B is wrong
Avoidance would mean eliminating the vendor relationship entirely, not auditing and implementing compensating controls.
Not this one. Try another answer.
Why C is wrong
Acceptance would mean acknowledging the risk without implementing additional controls to reduce it.
Right, D is the answer.
Why D is right
The organization has decided on mitigation as the risk response option. By commissioning an audit of the vendor's control framework and implementing compensating controls, the organization is actively reducing the risk associated with the vendor relationship rather than eliminating it (avoidance), shifting responsibility (transfer), or accepting it as-is. Mitigation involves implementing controls to lower the likelihood or impact of identified risks.
Question 30 Play from 50:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vulnerability assessment comes later in the planning process, after critical processes are identified.
Not this one. Try another answer.
Why B is wrong
Selecting an alternate site requires knowing which processes must be recovered and their time requirements first.
Not this one. Try another answer.
Why C is wrong
Recovery time objectives (RTOs) cannot be set without first knowing which critical processes require recovery.
Right, D is the answer.
Why D is right
Identifying critical business processes is the foundational first step in disaster recovery planning. Until the organization understands which processes are essential to survival, it cannot determine recovery priorities, time objectives, resource requirements, or alternate site needs. All subsequent DR planning decisions flow from this identification.
Question 31 Play from 52:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk escalation and communication processes address governance but do not measure actual risk exposure.
Not this one. Try another answer.
Why B is wrong
Strategic planning integration shows alignment but does not provide specific exposure metrics.
Right, C is the answer.
Why C is right
Risk limits, thresholds, and indicators provide the most useful information to determine risk exposure following control implementations. These metrics establish baselines and targets, allowing comparison of actual risk levels against acceptable tolerances to measure whether implemented controls have effectively reduced exposure. Escalation processes, strategic planning, and policies provide context and governance but do not directly measure the actual risk exposure levels achieved.
Not this one. Try another answer.
Why D is wrong
Policies and procedures establish requirements but do not measure whether risk exposure has actually been reduced.
Question 32 Play from 54:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Analyzing historical data is a supporting activity but not the primary objective of periodic analyses.
Right, B is the answer.
Why B is right
The primary objective of collecting information and reviewing documentation during periodic risk analyses is to identify new or emerging risk issues that may have developed since the last assessment. This proactive identification allows organizations to respond to evolving threats and changing business conditions. While historical analysis, threat understanding, and audit compliance are activities within the process, identification of new/emerging risks is the core purpose.
Not this one. Try another answer.
Why C is wrong
Understanding threat agents is important context but secondary to identifying what new risks currently exist.
Not this one. Try another answer.
Why D is wrong
Satisfying audit requirements is a compliance outcome, not the primary operational objective.
Question 33 Play from 56:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
KPIs must be aligned to management reports because they serve as the metrics management uses to evaluate organizational performance and make strategic decisions. Alignment ensures that KPIs are meaningful, actionable, and directly support management's ability to govern and oversee operations. Without alignment to management reports, KPIs may measure irrelevant factors that do not inform decision- making.
Not this one. Try another answer.
Why B is wrong
While KPIs should support risk responses, alignment to management reporting is more fundamental to KPI effectiveness.
Not this one. Try another answer.
Why C is wrong
Alerts for threshold breaches are a feature of KPI monitoring but not the most important consideration during development.
Not this one. Try another answer.
Why D is wrong
Trend identification is a benefit of KPIs but secondary to ensuring alignment with what management needs to report.
Question 34 Play from 57:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Accountable role belongs to senior management or incident owner, not the risk practitioner.
Not this one. Try another answer.
Why B is wrong
Informed is passive; the risk practitioner actively contributes analysis, making them Consulted.
Not this one. Try another answer.
Why C is wrong
Responsible typically falls to the incident response team executing the response, not the risk practitioner.
Right, D is the answer.
Why D is right
During a data loss incident, the risk practitioner would be Consulted. The risk practitioner provides expertise, analysis, and guidance on risk implications and mitigation during incident response, but is not the primary responsible party (that's incident response team) or accountable party (that's management). The practitioner's role is advisory and informative to support decision-making.
Question 35 Play from 59:32
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Before assigning sensitivity levels to information, an organization must first define the information classification policy. This policy establishes the framework, criteria, and governance for classifying data. Without a defined policy, sensitivity level assignments would lack consistency, criteria, and organizational alignment. The policy provides the foundation upon which all subsequent classification activities depend.
Not this one. Try another answer.
Why B is wrong
Sensitivity analysis is conducted after the policy is defined to determine appropriate sensitivity levels.
Not this one. Try another answer.
Why C is wrong
Identifying custodians happens during implementation but requires a policy framework to be established first.
Not this one. Try another answer.
Why D is wrong
RTOs relate to business continuity and recovery, not to the classification policy itself.
Question 36 Play from 1:01:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Gap analysis identifies deviations but does not ensure ongoing consistent maintenance of controls.
Right, B is the answer.
Why B is right
Conducting annual control assessments provides the most comprehensive and systematic way to verify that controls are being executed consistently across the environment. Assessments evaluate whether controls are operating as designed throughout the organization. While gap analysis, KRI monitoring, and training are helpful tools, only regular formal assessments directly measure and verify consistent control execution across all locations and functions.
Not this one. Try another answer.
Why C is wrong
KRIs monitor outcomes but do not directly verify consistent control execution and design.
Not this one. Try another answer.
Why D is wrong
Training improves awareness but does not measure or verify actual consistent control execution.
Question 37 Play from 1:03:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Satisfying audits is a compliance activity, not the primary purpose of KRI review.
Not this one. Try another answer.
Why B is wrong
Compliance is a requirement, but KRIs serve the broader purpose of active risk management.
Right, C is the answer.
Why C is right
The most important reason to periodically review KRIs is to identify deviations from organizational tolerance levels. KRIs are leading indicators designed to signal when risk is trending toward or exceeding the organization's established tolerance thresholds, enabling early intervention before problems become critical. This real-time risk monitoring and correction is the core purpose of KRI review, whereas audit satisfaction, regulatory compliance, and benchmarking are secondary or derivative benefits.
Not this one. Try another answer.
Why D is wrong
Benchmarking is useful context but does not address whether risks are within tolerance.
Question 38 Play from 1:05:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cost of mitigation is relevant to risk response selection but not to validating whether appetite itself is appropriate.
Not this one. Try another answer.
Why B is wrong
While risk culture maturity affects implementation capability, capacity to withstand loss is the fundamental measure of appropriate appetite.
Right, C is the answer.
Why C is right
Risk appetite must align with the organization's actual financial and operational capacity to absorb losses without jeopardizing viability. Validating appetite requires assessing whether the organization can withstand the potential impact of risks at the stated tolerance level. This ensures risk appetite is realistic and sustainable rather than aspirational.
Not this one. Try another answer.
Why D is wrong
Regulatory comparison ensures compliance but doesn't validate whether the organization can actually tolerate its stated appetite level.
Question 39 Play from 1:06:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Acquisition phase is when the organization is evaluating and selecting systems, and identified risks will most directly lead to architecture and design trade-offs. During acquisition, decisions about which system to purchase, how to configure it, and what requirements it must meet are made based on risk considerations. These decisions fundamentally shape the system's architecture and design. In later phases like implementation and operation, the system architecture is largely set, and trade-offs are more limited.
Not this one. Try another answer.
Why B is wrong
Implementation phase involves deploying the selected system; major architecture and design decisions have already been made during acquisition.
Not this one. Try another answer.
Why C is wrong
Initiation phase precedes acquisition and focuses on business need and feasibility; detailed architecture and design trade-offs occur later.
Not this one. Try another answer.
Why D is wrong
Operation and maintenance phase works with an already-deployed system; architecture changes are costly and infrequent at this stage.
Question 40 Play from 1:08:37
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Without complete process documentation, it becomes impossible to definitively identify who owns each process and bears responsibility for managing its risks. The risk owner is critical to effective risk management because they drive mitigation actions and accountability. Without identifying risk owners, risk management efforts lack clear accountability and cannot be effectively executed.
Not this one. Try another answer.
Why B is wrong
Process experts can often be identified through organizational structure and conversations, even with incomplete documentation.
Not this one. Try another answer.
Why C is wrong
Resource allocation challenges can be worked around through interviews and project management; it is not the greatest concern.
Not this one. Try another answer.
Why D is wrong
The risk register can be completed through discussions and analysis; incomplete documentation makes it harder but not impossible.
Question 41 Play from 1:10:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Assigning ownership of risk scenarios is an administrative function separate from using KRIs for trend communication.
Not this one. Try another answer.
Why B is wrong
Identifying threats to emerging technologies is a separate risk identification activity, not the primary use of KRIs.
Right, C is the answer.
Why C is right
Using key risk indicators to illustrate changes in the risk profile primarily helps to communicate risk trends to stakeholders. KRIs are designed as forward-looking metrics that show movement in risk levels over time, making them ideal for demonstrating whether risks are improving, deteriorating, or remaining stable. This trend communication enables stakeholders to understand the organization's current risk trajectory and the effectiveness of risk responses.
Not this one. Try another answer.
Why D is wrong
Highlighting noncompliance with the risk policy is a compliance monitoring function; KRIs are used for trend analysis rather than policy compliance.
Question 42 Play from 1:12:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk sharing strategies reflect how risks are distributed but not the underlying tolerance level.
Not this one. Try another answer.
Why B is wrong
Risk assessments identify and measure existing risks but do not define the organization's willingness to accept risk.
Not this one. Try another answer.
Why C is wrong
Risk transfer agreements show specific mitigation actions but do not reveal the organization's overall risk tolerance.
Right, D is the answer.
Why D is right
Risk policies are the BEST indication of an organization's risk tolerance because they explicitly document the organization's appetite for, and thresholds regarding, different types of risk. Policies establish approved ranges for risk-taking and define the organization's philosophical stance on what risks are acceptable, making them the most direct reflection of risk tolerance.
Question 43 Play from 1:13:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Compensating controls are alternative controls used when primary controls cannot be implemented; a background check is primary, not compensating.
Right, B is the answer.
Why B is right
A background check performed before hiring is a preventive control. Preventive controls are designed to stop undesirable events from occurring in the first place. By screening candidates before employment, the organization prevents potentially problematic individuals from being hired, thereby preventing future risk events rather than detecting or correcting them after they occur.
Not this one. Try another answer.
Why C is wrong
Detective controls identify that an undesirable event has occurred; background checks operate before employment, not during or after.
Not this one. Try another answer.
Why D is wrong
Corrective controls address problems after they have already occurred; background checks act before risk materializes.
Question 44 Play from 1:15:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Standards-based policies are an output of EA rather than its greatest benefit.
Right, B is the answer.
Why B is right
Efficient operations represent the greatest overarching benefit of a mature enterprise architecture, as EA provides standardization, integration, and optimization that directly reduce operational costs and complexity. While standards-based policies, regulatory compliance, and audit readiness are benefits of EA, they are either byproducts or more specific outcomes rather than the primary strategic benefit of the architecture framework itself.
Not this one. Try another answer.
Why C is wrong
Regulatory compliance is a benefit but more reactive than the proactive operational efficiency gain.
Not this one. Try another answer.
Why D is wrong
Audit readiness is a secondary benefit rather than the primary strategic advantage.
Question 45 Play from 1:17:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Transaction limits would reduce revenue and customer satisfaction rather than mitigate the actual risk of handling volume.
Right, B is the answer.
Why B is right
Scalable infrastructure directly addresses the risk of increased transaction volume by ensuring the system can handle growing demand without performance degradation, service outages, or security vulnerabilities. Transaction limits would restrict business, a hot backup site addresses disaster recovery rather than transaction volume risk, and monitoring only detects issues without preventing them.
Not this one. Try another answer.
Why C is wrong
A hot backup site addresses continuity and disaster recovery, not the specific risk of increased transaction volume.
Not this one. Try another answer.
Why D is wrong
Monitoring detects problems but does not actively reduce the risk of system failure under high load.
Question 46 Play from 1:18:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Aggregated views are helpful but not the primary consideration if they lack relevance to business objectives.
Not this one. Try another answer.
Why B is wrong
KRI data is a tool to support risk communication but is less important than ensuring strategic relevance.
Right, C is the answer.
Why C is right
When communicating risk updates to executive management, the MOST important consideration is ensuring the information is relevant to organizational goals. Executives make strategic decisions based on how risks impact business objectives, so framing risk updates in terms of organizational goals ensures they can understand implications and make informed decisions. While aggregated views, KRI data, and trend analysis are all valuable risk management practices, they are secondary to ensuring the message addresses what matters most to the organization's strategic direction.
Not this one. Try another answer.
Why D is wrong
Trend analysis provides useful context but is not more important than connecting risks to organizational goals.
Question 47 Play from 1:20:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Scenario analysis explores potential future situations but does not specifically use predictive/diagnostic analytical tools for exposing risk factors.
Not this one. Try another answer.
Why B is wrong
Sensitivity analysis examines how changes in variables affect outcomes but is not primarily a predictive/diagnostic tool for exposing risk factors.
Right, C is the answer.
Why C is right
Fault tree analysis is a deductive analytical method that uses predictive or diagnostic tools to expose risk factors by working backward from an undesired outcome to identify potential causes and contributing factors. It systematically maps how combinations of failures could lead to a system failure, making it an effective tool for exposing the underlying risk factors that could cause problems.
Not this one. Try another answer.
Why D is wrong
Cause and effect analysis (fishbone diagram) is descriptive and qualitative, not a quantitative predictive or diagnostic analytical tool.
Question 48 Play from 1:22:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk appetite is important but describes tolerance for risk-taking, not the foundational business context needed for communication.
Not this one. Try another answer.
Why B is wrong
Compliance objectives are specific constraints but do not serve as the primary framework for translating IT risk into business terms.
Right, C is the answer.
Why C is right
To communicate IT risk in business terms, organizational objectives MUST be defined first. Business objectives provide the context and framework for understanding how IT risks could impact the organization's strategic goals. Without clear organizational objectives, it is impossible to translate technical risks into meaningful business consequences that stakeholders can understand and act upon.
Not this one. Try another answer.
Why D is wrong
Inherent and residual risk are quantitative measures of existing risk, not the foundational element needed to contextualize risk communication.
Question 49 Play from 1:24:19
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Once risk mitigation action plans have been verified as completed, the risk rating is most important to update. The risk rating reflects the residual risk remaining after controls and mitigation actions have been implemented. Updating the rating documents the effectiveness of the mitigation efforts and provides current information for risk monitoring and reporting.
Not this one. Try another answer.
Why B is wrong
Control inventory may be updated but is separate from assessing the effectiveness of completed mitigation actions.
Not this one. Try another answer.
Why C is wrong
Risk impact itself typically remains unchanged; what changes is the residual risk rating after mitigation is applied.
Not this one. Try another answer.
Why D is wrong
Control ownership is an attribute that may have been established when controls were implemented but is not the primary post-completion update.
Question 50 Play from 1:26:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A comprehensive methodology is important but is typically one component within a broader framework, not necessarily an indicator of overall maturity.
Not this one. Try another answer.
Why B is wrong
Policy alignment with culture is valuable but may exist without systematic implementation, making it insufficient as a maturity indicator.
Not this one. Try another answer.
Why C is wrong
Insurance coverage addresses financial risk transfer but does not indicate that risk management processes or governance are mature.
Right, D is the answer.
Why D is right
The presence of a risk management framework is the best indication of risk management maturity because it demonstrates a structured, systematic, and repeatable approach to managing risk across the organization. A mature framework encompasses governance, processes, methodologies, and integration with business objectives. While other elements may be components within a framework, the framework itself represents the organizational commitment and infrastructure necessary for consistent, enterprise-wide risk management.
Question 51 Play from 1:27:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hardware failures relate to availability and maintenance, not security configuration.
Not this one. Try another answer.
Why B is wrong
Exceeding availability thresholds indicates performance issues, not security posture.
Not this one. Try another answer.
Why C is wrong
Exceeding current patching standards indicates inadequate patching, which is a security deficiency rather than a measure of security achievement.
Right, D is the answer.
Why D is right
The total number of servers meeting the baseline for hardening is the most direct and relevant metric for demonstrating secure configuration. Hardening baselines include security controls such as patch levels, disabled unnecessary services, configuration standards, and access controls, all core elements of secure server configuration.
Question 52 Play from 1:29:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Interviewing administrators relies on subjective statements and may not reveal actual configuration accuracy.
Not this one. Try another answer.
Why B is wrong
Reviewing procedures documents what should happen, not necessarily what is configured.
Not this one. Try another answer.
Why C is wrong
Reviewing log files shows attack history but does not verify that current configurations comply with security policies.
Right, D is the answer.
Why D is right
Reviewing the actual parameter settings on the firewall device provides direct, technical evidence of whether configurations align with security policy requirements. This is the most definitive way to verify compliance as it shows what the system is actually doing, not what people say it does.
Question 53 Play from 1:31:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Risk appetite (the amount of risk an organization is willing to accept) prudently should not exceed risk capacity (the amount of risk the organization can actually absorb without failing). An organization cannot sustain risk exposure beyond what its financial, operational, and strategic resources can withstand. Exceeding capacity jeopardizes the organization's viability, making this the critical constraint on appetite.
Not this one. Try another answer.
Why B is wrong
Inherent risk is the baseline risk before controls; appetite and capacity are forward-looking decisions, not constrained by inherent risk.
Not this one. Try another answer.
Why C is wrong
Risk tolerance and risk appetite are closely related concepts; tolerance is more about specific thresholds, but capacity is the ultimate limiting factor.
Not this one. Try another answer.
Why D is wrong
Residual risk (risk after controls) is what should be within appetite, but appetite itself is constrained by the organization's capacity to bear loss.
Question 54 Play from 1:32:54
Each correct answer represents a complete solution. (Choose three.)
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Mortality tables are based on probabilities (B), which are derived from normal distributions (A) of life expectancy data, and use sampling (D) of population data to calculate actuarial values. These mathematical foundations allow insurers and actuaries to determine death rates and life expectancies. While impact analysis is important in risk management, mortality tables specifically focus on probability calculations based on statistical distributions and sampling methods.
Right, B is one of the answers.
Why B is right
Mortality tables are based on probabilities (B), which are derived from normal distributions (A) of life expectancy data, and use sampling (D) of population data to calculate actuarial values. These mathematical foundations allow insurers and actuaries to determine death rates and life expectancies. While impact analysis is important in risk management, mortality tables specifically focus on probability calculations based on statistical distributions and sampling methods.
Not this one. Try another answer.
Why C is wrong
Impact is not a mathematical foundation of mortality tables; probability and statistical distributions are the core mathematical basis.
Right, D is one of the answers.
Why D is right
Mortality tables are based on probabilities (B), which are derived from normal distributions (A) of life expectancy data, and use sampling (D) of population data to calculate actuarial values. These mathematical foundations allow insurers and actuaries to determine death rates and life expectancies. While impact analysis is important in risk management, mortality tables specifically focus on probability calculations based on statistical distributions and sampling methods.
Question 55 Play from 1:34:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Assessing levels of risk is primarily a risk manager's responsibility, not the control owner's.
Not this one. Try another answer.
Why B is wrong
Identifying trends in risk profile is a risk function responsibility, typically performed by risk management rather than individual control owners.
Right, C is the answer.
Why C is right
A control owner's primary responsibility is to select and design controls that mitigate identified risks. The control owner is accountable for implementing effective controls aligned with the organization's risk tolerance. This is the foundational ownership duty; monitoring, assessing, and identifying trends are ongoing responsibilities but derivative from having selected appropriate controls in the first place.
Not this one. Try another answer.
Why D is wrong
While control owners do monitor their controls, the primary responsibility is establishing the controls themselves; monitoring is an ongoing operational duty.
Question 56 Play from 1:36:18
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Accountability for control operation is the primary consideration because it ensures clear responsibility for day-to-day execution of risk mitigation. Risk owners must be able to direct and manage the controls, making operational accountability the most fundamental criterion.
Not this one. Try another answer.
Why B is wrong
While important, accountability for losses is secondary to accountability for control operation.
Not this one. Try another answer.
Why C is wrong
Ability to design controls is valuable but less critical than accountability for ongoing operational execution.
Not this one. Try another answer.
Why D is wrong
Organizational position matters less than actual accountability for control operation.
Question 57 Play from 1:37:57
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A penetration test is the best way to validate vulnerability assessment results because it actively exploits identified vulnerabilities in a controlled manner to confirm they are real, exploitable, and present a genuine risk. This provides practical validation that assessment findings are accurate and actionable.
Not this one. Try another answer.
Why B is wrong
Root cause analysis explains why vulnerabilities exist but doesn't validate whether the assessment findings are correct.
Not this one. Try another answer.
Why C is wrong
Threat analysis examines potential threats but doesn't specifically validate the accuracy of vulnerability assessment results.
Not this one. Try another answer.
Why D is wrong
Security logs show what has occurred but cannot effectively validate whether the identified vulnerabilities in the assessment are real and exploitable.
Question 58 Play from 1:39:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Licensing information ensures compliance but does not directly enable vulnerability identification.
Right, B is the answer.
Why B is right
Software version is the critical inventory component that enables vulnerability identification and mitigation. Vulnerability databases and security tools cross-reference specific software versions against known CVEs and security advisories. Without accurate version information, organizations cannot determine whether they are affected by published vulnerabilities or apply appropriate patches and updates.
Not this one. Try another answer.
Why C is wrong
Support contract expiration indicates when vendor support ends but is not the primary enabler of vulnerability identification.
Not this one. Try another answer.
Why D is wrong
Assigned manager facilitates accountability but does not technically enable vulnerability identification.
Question 59 Play from 1:41:25
Which of the following should be of GREATEST concern to the risk practitioner?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data redundancy relates to availability and disaster recovery, not to the reliability of analytical results.
Not this one. Try another answer.
Why B is wrong
Maintenance costs are operational considerations but secondary to ensuring data quality for critical decisions.
Right, C is the answer.
Why C is right
Data quality is the greatest concern for an application supporting important investment decisions. Poor data quality directly compromises the accuracy and reliability of the analysis, leading to flawed investment decisions and financial losses. When data is used as the foundation for critical business decisions, quality is paramount.
Not this one. Try another answer.
Why D is wrong
System integration is a technical concern but less critical than the quality of the data being analyzed for decision-making.
Question 60 Play from 1:43:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Buying insurance is a risk financing strategy, not a mitigation procedure.
Not this one. Try another answer.
Why B is wrong
Acceptance of exposures is a risk response decision, not a mitigation procedure.
Right, C is the answer.
Why C is right
Risk mitigation procedures should focus on the deployment of countermeasures, the actual controls and measures implemented to reduce or eliminate risk exposure. Countermeasures are the substantive actions taken to mitigate risk. Insurance policies are a financing mechanism, acceptance of exposures is a response strategy rather than a mitigation procedure, and enterprise architecture implementation is too broad and not specific to mitigation procedures.
Not this one. Try another answer.
Why D is wrong
Enterprise architecture implementation is strategic infrastructure work, not a core mitigation procedure.
Question 61 Play from 1:44:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The threat landscape describes external threats and vulnerabilities but does not directly indicate how the organization is managing its specific risks.
Not this one. Try another answer.
Why B is wrong
Risk metrics are individual measurements that support risk management but do not themselves provide the comprehensive view that the risk register does.
Not this one. Try another answer.
Why C is wrong
Risk appetite defines tolerance for risk but does not provide insight into the actual risks the organization faces or their current status.
Right, D is the answer.
Why D is right
The risk register provides a comprehensive view of identified, assessed, and prioritized risks across the organization, directly reflecting the overall risk profile. It documents all significant risks, their owners, mitigation status, and residual levels, making it the primary tool for understanding organizational risk posture. The risk register aggregates risk information and shows how risks are being managed, providing the most complete insight into overall risk profile.
Question 62 Play from 1:46:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Detection risk relates to audit effectiveness, not management's risk response decisions.
Right, B is the answer.
Why B is right
Risk appetite defines the organization's tolerance for risk and directly shapes which risks management is willing to accept, mitigate, avoid, or transfer. It is the primary driver of risk response decisions because it establishes the threshold and boundaries within which all response strategies are evaluated and chosen.
Not this one. Try another answer.
Why C is wrong
Audit risk is a concept in audit planning and does not influence management's operational risk response choices.
Not this one. Try another answer.
Why D is wrong
Residual risk is an outcome of risk response decisions, not a driver of them.
Question 63 Play from 1:47:57
Which of the following would add the MOST value to the new risk scenarios?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Audit findings from historical operations may not apply to a new line of business with different risk profiles.
Not this one. Try another answer.
Why B is wrong
Expected losses are an output of risk analysis, not an input that drives scenario development.
Not this one. Try another answer.
Why C is wrong
Cost-benefit analysis is a financial evaluation tool that comes after scenarios are developed to assess mitigation options.
Right, D is the answer.
Why D is right
Organizational threats add the most value to new risk scenarios because they represent the actual adversarial landscape and attack vectors specific to the new line of business. Understanding what threats the organization faces enables risk scenarios that are both realistic and actionable. Threat intelligence ensures the scenarios reflect genuine risks rather than theoretical possibilities, making them more valuable for strategic decision- making around the acquisition.
Question 64 Play from 1:49:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Acceptance is a permanent decision to retain risk; postponement implies future action, not permanent acceptance.
Not this one. Try another answer.
Why B is wrong
Mitigation requires active control implementation, not postponement.
Right, C is the answer.
Why C is right
When an organization postpones assessment and treatment of risks due to unavailable stakeholders, this represents deferral, the intentional delay of risk response decisions to a future date. Deferral is distinct from acceptance (knowingly retaining risk) because the organization intends to address the risks once stakeholders are available, rather than deciding to permanently retain them.
Not this one. Try another answer.
Why D is wrong
Transfer involves shifting risk to a third party; postponement does neither transfer nor mitigate.
Question 65 Play from 1:51:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Incident reduction is a lagging indicator and does not directly communicate the ongoing risk posture after the initiative is implemented.
Not this one. Try another answer.
Why B is wrong
Inherent risk reduction is theoretical and does not reflect the actual protection the initiative will provide; management cares about residual, not inherent, risk.
Right, C is the answer.
Why C is right
Senior management is most influenced by reduction in residual risk because it demonstrates the practical, measurable outcome of the security investment after controls are implemented. Residual risk shows what threats actually remain to the organization following the mitigation effort, making it the most tangible and decision-relevant metric for budget allocation. Management cares about what risk the organization will face after spending the money, not theoretical reductions in inherent risk or vulnerability counts.
Not this one. Try another answer.
Why D is wrong
The number of known vulnerabilities is a technical metric that does not directly correlate with business risk or the value of risk reduction to senior management.
Question 66 Play from 1:53:21
Who is responsible for ensuring the risk register is updated accordingly?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The control owner is responsible for implementing and maintaining controls, not for updating the risk register with audit findings.
Not this one. Try another answer.
Why B is wrong
The audit manager oversees the audit process but does not hold responsibility for maintaining the risk register.
Right, C is the answer.
Why C is right
The risk practitioner is responsible for maintaining and updating the risk register based on audit findings and control assessments. When an audit identifies a failed control and its resulting risk, the risk practitioner must document and update the risk register to reflect this new information. The risk practitioner owns the process of risk identification, analysis, and documentation across the organization, making them the appropriate party to ensure the risk register accurately reflects audit findings.
Not this one. Try another answer.
Why D is wrong
The risk owner is accountable for managing a specific risk once identified, but the risk practitioner is responsible for the initial identification and register documentation.
Question 67 Play from 1:55:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Corporate culture alignment would result in proportionate control spending, not excessive spending.
Right, B is the answer.
Why B is right
When an organization accepts control costs that exceed risk exposure, this demonstrates corporate culture misalignment. A well-aligned risk culture would implement controls proportionate to the risk level, spending more on controls than the potential loss represents is wasteful and indicates the organization's culture does not properly align cost- benefit analysis with risk management principles. This is not about risk tolerance but about prudent resource allocation.
Not this one. Try another answer.
Why C is wrong
Low risk tolerance would justify higher control spending, but the issue here is misalignment of how much to spend.
Not this one. Try another answer.
Why D is wrong
High risk tolerance would suggest lower control spending, not higher spending than risk exposure.
Question 68 Play from 1:56:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Threat analysis identifies potential threats but doesn't measure the actual impact of existing control deficiencies.
Not this one. Try another answer.
Why B is wrong
Peer benchmarks provide comparative context but don't measure the actual magnitude of impact specific to the organization's identified deficiencies.
Right, C is the answer.
Why C is right
Business Impact Analysis (BIA) results provide the most useful information to assess the magnitude of identified deficiencies because BIA quantifies the potential business consequences, financial impact, and operational disruption resulting from control failures. This directly measures the severity and materiality of deficiencies in terms the organization understands.
Not this one. Try another answer.
Why D is wrong
Internal audit reports may identify deficiencies but don't inherently quantify their business impact or magnitude.
Question 69 Play from 1:58:49
Which of the following controls MOST likely failed?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Background checks assess the trustworthiness of individuals but do not prevent the physical act of removing files.
Not this one. Try another answer.
Why B is wrong
Awareness training educates employees but cannot technically prevent the action if controls are not enforced through technical or physical means.
Right, C is the answer.
Why C is right
User access controls would regulate which employees can access and remove sensitive data from the premises. When an employee was able to inadvertently remove a file in violation of policy, this indicates that access controls, such as data loss prevention tools, file restrictions, or physical controls on removable media, failed to prevent the unauthorized removal.
Not this one. Try another answer.
Why D is wrong
Policy management establishes the rule but does not enforce it; control failure refers to the enforcement mechanism, not the policy itself.
Question 70 Play from 2:00:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Design phase reviews catch architectural issues but miss implementation-specific vulnerabilities that emerge during coding.
Not this one. Try another answer.
Why B is wrong
Pre-production testing occurs too late to catch many issues early and limits opportunities for cost-effective remediation.
Right, C is the answer.
Why C is right
Automated code reviews are most effective when performed throughout development because this enables continuous identification and remediation of vulnerabilities as code is written, preventing defects from accumulating and becoming more expensive to fix. Early and continuous detection is far more efficient than point-in-time reviews at later phases.
Not this one. Try another answer.
Why D is wrong
Production environment reviews are reactive and defeat the purpose of risk mitigation; production exposure is unacceptable.
Question 71 Play from 2:02:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Best practices provide guidance but may not suit an organization's specific context, risk tolerance, or resource constraints.
Not this one. Try another answer.
Why B is wrong
Relevance to the business process is necessary but doesn't ensure the control is cost-effective or the best choice among alternatives.
Not this one. Try another answer.
Why C is wrong
Regulatory requirements are mandatory but do not guide the selection of additional controls beyond minimum compliance needs.
Right, D is the answer.
Why D is right
Cost-benefit analysis is the most important factor because it ensures that the resources invested in a control produce value proportional to the risk reduction achieved. While best practices, business relevance, and regulatory compliance are all important considerations, the cost-benefit analysis determines whether the control is economically justifiable and efficient. A control that meets all other criteria but costs more than the risk it prevents is not a sound business decision.
Question 72 Play from 2:04:01
Which of the following controls will BEST help reduce the risk of fraudulent internal transactions?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Segregation of duties is the most effective preventive control against fraudulent internal transactions because it ensures no single individual can execute a complete fraudulent transaction without detection or collusion. It requires multiple people to be involved in key processes, making unauthorized or fraudulent activities much harder to accomplish. While audits, log monitoring, and privilege reviews are detective or monitoring controls that identify fraud after it occurs, segregation of duties prevents it from happening in the first place.
Not this one. Try another answer.
Why B is wrong
Periodic internal audits are detective controls that identify fraud after it has occurred, not preventive controls that reduce the likelihood of fraud.
Not this one. Try another answer.
Why C is wrong
Log monitoring is a detective control that identifies suspicious activity but does not prevent fraudulent transactions from being initiated.
Not this one. Try another answer.
Why D is wrong
Privilege reviews help manage access but do not inherently prevent a single authorized user from committing fraud within their approved scope.
Question 73 Play from 2:06:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Inconsistent rating application is possible but manageable with proper governance; accountability clarity is more fundamental.
Right, B is the answer.
Why B is right
When multiple risk owners are assigned to a single risk, the most critical concern is ensuring accountability is clearly defined. Without clear delineation of responsibilities, confusion arises about who is ultimately accountable for risk mitigation, monitoring, and reporting. This ambiguity can lead to gaps in oversight, delayed decisions, and ineffective risk management.
Not this one. Try another answer.
Why C is wrong
Different taxonomies are an organizational process issue, not a direct consequence of multiple risk owners.
Not this one. Try another answer.
Why D is wrong
Duplication can occur but is secondary to the primary concern of unclear accountability.
Question 74 Play from 2:07:46
Who is accountable for ensuring the vulnerabilities are mitigated?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
System administrators execute the remediation but lack the authority and accountability for overall system security decisions.
Not this one. Try another answer.
Why B is wrong
Data owners are responsible for the data itself, not the systems on which it resides.
Right, C is the answer.
Why C is right
System owners are ultimately accountable for ensuring vulnerabilities identified on systems they own are mitigated. While system administrators may perform the technical remediation work and information security managers may coordinate vulnerability management programs, the system owner bears the responsibility for the security posture of their systems and must ensure identified vulnerabilities are addressed within acceptable timeframes.
Not this one. Try another answer.
Why D is wrong
Information security managers oversee the program and policy but do not own individual systems.
Question 75 Play from 2:09:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Number of steps relates to control efficiency and complexity, not effectiveness.
Not this one. Try another answer.
Why B is wrong
Scope of coverage indicates range but not how well the control actually operates.
Right, C is the answer.
Why C is right
The number of control deviations detected directly measures how well a control is functioning in practice. Deviations indicate failures to operate as designed, and fewer deviations demonstrate greater effectiveness. The number of steps (A) relates to efficiency, not effectiveness. Scope of coverage (B) shows breadth but not quality of operation. Exceptions granted (D) reflect control flexibility but not operational performance.
Not this one. Try another answer.
Why D is wrong
Exceptions reflect management's discretion but not the control's actual performance against its design.
Question 76 Play from 2:11:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Changing auditors is an administrative change that does not alter the organization's actual risk exposure.
Not this one. Try another answer.
Why B is wrong
Changing assessment methods measures risk differently but does not change the underlying risk factors themselves.
Not this one. Try another answer.
Why C is wrong
Risk appetite and tolerance are organizational preferences for managing known risks, not changes to the risk environment itself.
Right, D is the answer.
Why D is right
Changes in internal and external risk factors directly reshape the organization's exposure landscape. External factors like regulatory changes, economic shifts, or emerging threats, combined with internal factors like business model changes or resource availability, fundamentally alter what risks the organization faces. Changes in auditors (A) involve personnel but not risk factors; assessment methodologies (B) are tools that measure risk but don't change actual risk; risk appetite/tolerance (C) affects how risk is managed but not the underlying risk profile itself.
Question 77 Play from 2:13:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encrypting data in the cloud database still allows cloud administrators access to keys if key management is handled by the provider.
Not this one. Try another answer.
Why B is wrong
An encrypted tunnel only protects data in transit, not at rest, and does not prevent administrators with database access from viewing decrypted data.
Right, C is the answer.
Why C is right
Encrypting data before it leaves the organization (client-side encryption) is the best protection against unauthorized access by cloud administrators because the encryption keys remain under the organization's control. The data is encrypted at the source before transmission, ensuring that even cloud administrators and infrastructure personnel cannot access the plaintext data. This approach protects against insider threats and provides defense in depth.
Not this one. Try another answer.
Why D is wrong
Encrypting physical hard drives does not prevent logical access by administrators who have credentials to decrypt and access the data.
Question 78 Play from 2:15:16
Which of the following is the BEST course of action?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Periodic reassessment acknowledges the problem but doesn't address the current risk exposure.
Not this one. Try another answer.
Why B is wrong
Improving project management may help with the remediation timeline but doesn't reduce current risk.
Not this one. Try another answer.
Why C is wrong
Control monitoring tracks what exists but doesn't reduce the risk posed by the current exposures.
Right, D is the answer.
Why D is right
When remediation will take significant time, compensating controls should be implemented to mitigate the risk in the interim. Compensating controls provide alternative protection while the organization works toward remediating the underlying exposures. This is a proactive risk management response rather than simply monitoring or reassessing existing gaps.
Question 79 Play from 2:16:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A threat event is the occurrence of a threat, but a realized risk requires the threat to exploit a vulnerability and cause actual impact.
Not this one. Try another answer.
Why B is wrong
A technical event is not standard risk management terminology for describing the outcome of realized risks.
Right, C is the answer.
Why C is right
A loss event is the realized outcome when a risk scenario actually occurs. It represents the tangible impact or consequence that materializes when a threat exploits a vulnerability. A realized risk scenario by definition results in an actual loss or negative impact, which is precisely what a loss event represents in risk management terminology.
Not this one. Try another answer.
Why D is wrong
A vulnerability event is not a standard term; vulnerabilities are conditions, not events, and a realized risk results in a loss, not merely a vulnerability exposure.
Question 80 Play from 2:18:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk registers document existing scenarios but are not the primary basis for developing new ones.
Not this one. Try another answer.
Why B is wrong
IT objectives provide context for impact assessment but do not generate the threat-vulnerability combinations that define scenarios.
Not this one. Try another answer.
Why C is wrong
Risk owner input is valuable for scenario validation and refinement but is not the primary basis for initial scenario identification.
Right, D is the answer.
Why D is right
IT threats and vulnerabilities form the primary basis for developing risk scenarios because a scenario must describe how a threat exploits a vulnerability to impact the organization. This threat-vulnerability pairing is the foundational element that makes a scenario realistic and relevant, whereas other inputs are secondary refinements.
Question 81 Play from 2:20:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Banners are preventive, not detective controls; they do not enable discovery of insider threats.
Right, B is the answer.
Why B is right
An acceptable use banner serves as a preventive control by making users aware of expectations and consequences before they log in, thereby reducing the likelihood of insider threats. While it cannot eliminate threats entirely or enable discovery of threats already occurring, its primary purpose is deterrence, influencing user behavior by establishing clear boundaries and demonstrating that the organization is monitoring compliance.
Not this one. Try another answer.
Why C is wrong
No control can eliminate the possibility of insider threat; this is unrealistic language that overstates the banner's capability.
Not this one. Try another answer.
Why D is wrong
Reducing impact is a secondary benefit; the primary purpose is prevention through awareness and behavioral modification.
Question 82 Play from 2:21:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Inherent risk is the baseline risk before controls; mitigation does not optimize inherent risk but rather transforms it into residual risk.
Right, B is the answer.
Why B is right
Risk mitigation is most effective when residual risk is optimized (minimized to an acceptable level). Residual risk is the risk that remains after controls are implemented. The goal of mitigation is to reduce inherent risk through controls until the residual risk falls within the organization's risk tolerance. Therefore, optimizing residual risk is the direct measure of mitigation effectiveness.
Not this one. Try another answer.
Why C is wrong
Operational risk is a category of risk but not the specific metric that determines mitigation effectiveness.
Not this one. Try another answer.
Why D is wrong
Regulatory risk is a type of risk but is not the specific optimization target for assessing mitigation effectiveness.
Question 83 Play from 2:23:31
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The primary reason to perform ongoing risk assessments is that the risk environment is constantly subject to change, new threats emerge, systems evolve, business objectives shift, and vulnerabilities are discovered. Ongoing assessments ensure that risk management remains current and relevant. While budget justification, emerging risk reporting, and vulnerability discovery are related benefits, they all stem from the fundamental fact that risks change over time and must be continuously re-evaluated.
Not this one. Try another answer.
Why B is wrong
Budget justification, while important, is a secondary benefit derived from risk assessments, not the primary reason for conducting them.
Not this one. Try another answer.
Why C is wrong
Continuous reporting of emerging risks is a consequence of ongoing assessment, not the primary driver for conducting assessments.
Not this one. Try another answer.
Why D is wrong
While vulnerabilities do emerge frequently, this is only one aspect of the changing risk environment; risks change due to many factors beyond just technical vulnerabilities.
Question 84 Play from 2:25:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Moderate risk would not represent a noticeable failure threatening success; it would be less severe.
Right, B is the answer.
Why B is right
A risk that represents a noticeable failure threatening the success of certain goals of the enterprise is classified as a high risk. The description indicates a significant threat to enterprise objectives with a notable impact, which aligns with the definition of high-risk level, risks that could substantially compromise project or enterprise success if they occur.
Not this one. Try another answer.
Why C is wrong
Extremely high risk would suggest an existential threat to the entire enterprise, not just certain goals.
Not this one. Try another answer.
Why D is wrong
Low risk would not threaten the success of goals in any noticeable way.
Question 85 Play from 2:27:07
What term is given to this newly created risk event?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Residual risk refers to the risk remaining after implementing a response strategy, not a new risk created by the response.
Right, B is the answer.
Why B is right
A secondary risk is a new risk that emerges as a direct result of implementing a risk response to an original risk. When Marie implements a mitigation response to address an identified risk, that response action itself can create or introduce new risks. These newly created risks are classified as secondary risks and must be identified, analyzed, and managed through the same risk management processes as the original risks. This is a standard concept in risk management where solutions can inadvertently create new problems.
Not this one. Try another answer.
Why C is wrong
Infinitive risk is not a recognized term in standard risk management terminology.
Not this one. Try another answer.
Why D is wrong
Populated risk is not a recognized risk management term.
Question 86 Play from 2:28:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Interviews are subjective and not the best method for determining ongoing efficiency; they provide anecdotal rather than systematic data.
Not this one. Try another answer.
Why B is wrong
Risk registers document identified risks but do not measure control process efficiency metrics.
Not this one. Try another answer.
Why C is wrong
Annual risk assessments are periodic reviews, not continuous monitoring of control process efficiency.
Right, D is the answer.
Why D is right
Analyzing Key Performance Indicators (KPIs) is the BEST way to determine ongoing control process efficiency because KPIs are specifically designed metrics that measure performance against objectives. They provide quantifiable, data-driven evidence of how well controls are functioning over time. Interviews (A) are subjective, risk registers (B) document risks rather than control efficiency, and annual risk assessments (C) are periodic snapshots rather than ongoing measurement tools.
Question 87 Play from 2:30:48
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the risk assessment results. The risk assessment process systematically identifies, analyzes, and evaluates risks across the organization. These documented results are the comprehensive source of all identified risks and should drive the risk register's contents, ensuring completeness and accuracy.
Not this one. Try another answer.
Why B is wrong
Cost-benefit analysis is used for mitigation decisions, not for identifying what risks exist.
Not this one. Try another answer.
Why C is wrong
Vulnerability assessments identify technical weaknesses but represent only one category of risk and miss business, operational, and strategic risks.
Not this one. Try another answer.
Why D is wrong
The mitigation approach addresses how to handle identified risks, not what risks should be included in the register.
Question 88 Play from 2:32:34
Which of the following should be of GREATEST concern to the risk practitioner?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Purpose limitation is important but assumes the data collection itself is justified.
Right, B is the answer.
Why B is right
Data minimization is the greatest concern because the organization should only collect and use the minimum amount of personal data necessary for the specific campaign purpose. Using data analytics to target customers based on extensive customer data raises data privacy risks that should be evaluated against the principle of collecting only what is needed. Purpose limitation, accuracy, and accountability are important, but data minimization directly addresses whether the organization is justifying the collection of personal data in the first place.
Not this one. Try another answer.
Why C is wrong
Accuracy of targeting data is secondary to whether such extensive data should be collected at all.
Not this one. Try another answer.
Why D is wrong
Accountability mechanisms address governance but don't address whether data minimization principles are followed.
Question 89 Play from 2:34:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Likelihood alone does not capture the full risk; impact severity must also be considered.
Not this one. Try another answer.
Why B is wrong
Impact alone does not capture the full risk; the probability of occurrence must also be considered.
Right, C is the answer.
Why C is right
Inherent risk (the risk before controls are applied) is expressed as a function of the likelihood and impact. This is the fundamental risk equation: Risk = Likelihood × Impact. Both the probability that a threat will occur and the severity of consequences must be considered together to understand the true risk exposure before any controls mitigate it.
Not this one. Try another answer.
Why D is wrong
Control costs and effectiveness are applied after inherent risk is determined; they calculate residual risk, not inherent risk.
Question 90 Play from 2:36:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The risk owner has accountability for the risk but not necessarily the methodological expertise to determine appropriate scenario stakeholders.
Not this one. Try another answer.
Why B is wrong
Control owners focus on specific control effectiveness, not the broader stakeholder identification for scenario development.
Not this one. Try another answer.
Why C is wrong
Compliance managers represent one stakeholder perspective but should not unilaterally determine all scenario participant needs.
Right, D is the answer.
Why D is right
The risk practitioner should determine which stakeholders are needed for risk scenario development. Risk practitioners have the expertise in risk methodology and scenario analysis to identify all relevant perspectives (operational, business, technical, compliance) needed for comprehensive scenarios. They coordinate stakeholder involvement across the organization.
Question 91 Play from 2:37:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Quantitative analysis comes after qualitative analysis and only for risks deemed significant enough to warrant detailed quantification.
Not this one. Try another answer.
Why B is wrong
Determining acceptance or response strategies occurs after analysis, not immediately after identification.
Not this one. Try another answer.
Why C is wrong
Qualitative risk analysis follows documentation in the risk register, not before it.
Right, D is the answer.
Why D is right
After identifying new risk events, the immediate next step is to formally document them in the risk register. This creates an official record and baseline for all subsequent risk management activities. Recording the scenarios is the foundational step that must occur before analysis, response planning, or acceptance decisions can be properly made and tracked.
Question 92 Play from 2:39:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While comprehensive log collection is important, KRIs can be effectively monitored from a targeted set of relevant systems rather than requiring logs from every system.
Right, B is the answer.
Why B is right
Providing accurate logs in a timely manner is the most critical requirement because KRI monitoring depends on reliable, current data to detect emerging risks. Without accurate and timely logs, the entire monitoring system becomes ineffective, false positives waste resources while missed indicators fail to warn of actual risks. Accuracy and timeliness are foundational to any effective KRI monitoring program.
Not this one. Try another answer.
Why C is wrong
An automated tool is helpful for efficiency but is not strictly required if manual log analysis provides accurate and timely results.
Not this one. Try another answer.
Why D is wrong
Readable format aids human interpretation but automated KRI monitoring can work with any structured log format, making this secondary to accuracy and timeliness.
Question 93 Play from 2:41:41
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The business owner is best suited to own IT risk scenarios because they are responsible for the business processes and outcomes that depend on IT systems. While the IT manager understands the technical aspects and the application business analyst knows the system details, the business owner has accountability for the business impact if the application fails. In this case, the business owner must manage the risk of having only one person who knows how to maintain a critical application by implementing cross-training, documentation, or redundancy measures.
Not this one. Try another answer.
Why B is wrong
IT managers handle IT operations but lack ultimate business accountability for the risk's impact.
Not this one. Try another answer.
Why C is wrong
Application business analysts understand requirements but do not own overall business risk accountability.
Not this one. Try another answer.
Why D is wrong
Risk managers facilitate and coordinate risk management but do not own individual business risks.
Question 94 Play from 2:43:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Risk velocity measures how quickly risk is changing but does not indicate whether current risk levels match organizational appetite.
Right, B is the answer.
Why B is right
Residual risk is the risk remaining after controls and mitigation strategies have been applied. It directly measures whether an organization's actual risk exposure aligns with its established risk appetite. By comparing residual risk to risk appetite, management can assess if the organization has appropriately managed its risk position. Inherent risk shows pre-control exposure, risk velocity measures speed of change, and risk trend shows direction, none directly answer whether risk is aligned with appetite.
Not this one. Try another answer.
Why C is wrong
Inherent risk reflects risk before controls are applied and does not account for the organization's mitigation efforts or risk appetite alignment.
Not this one. Try another answer.
Why D is wrong
Risk trend shows the direction of risk movement but does not directly measure whether the organization's risk position matches its established appetite.
Question 95 Play from 2:45:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access reviews focus specifically on user access rights and do not comprehensively identify changes to the broader risk landscape.
Not this one. Try another answer.
Why B is wrong
Root cause analysis examines what happened in past incidents but is reactive, not proactive in identifying emerging risk landscape changes.
Not this one. Try another answer.
Why C is wrong
Internal audit reports document findings about current state but do not systematically model future threats and landscape changes.
Right, D is the answer.
Why D is right
Threat modeling is the best method for identifying changes to the risk landscape because it systematically and comprehensively identifies potential new threats, vulnerabilities, and attack vectors by analyzing systems, assets, and threat actors. It provides a structured, forward-looking approach that can uncover emerging risks. Access reviews identify access-related issues, root cause analysis addresses past incidents, and audit reports document current-state findings, but none of these proactively identify emerging changes in the risk landscape as effectively as threat modeling.
Question 96 Play from 2:47:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Balanced scorecards measure organizational performance metrics but don't specifically assure internal control effectiveness.
Not this one. Try another answer.
Why B is wrong
Control self-assessments rely on process owners' subjective evaluations and lack the objectivity and continuity of monitoring.
Not this one. Try another answer.
Why C is wrong
Compliance training metrics measure training completion but don't directly assess whether resulting controls operate effectively.
Right, D is the answer.
Why D is right
Continuous monitoring provides real-time, ongoing assessment of whether controls are operating as designed across changing business conditions and threats. This approach detects control breakdowns and ineffectiveness promptly, providing the best assurance of sustained control effectiveness. While control self-assessments, compliance training, and balanced scorecards contribute to control environments, continuous monitoring is the only mechanism that provides persistent, objective evidence of whether controls actually function effectively over time.
Question 97 Play from 2:49:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
System architecture knowledge is important for technical execution but does not directly enable efficient plan execution.
Not this one. Try another answer.
Why B is wrong
Business objectives provide strategic context but do not ensure operational efficiency of response actions.
Right, C is the answer.
Why C is right
Clearly defined roles and responsibilities ensure coordinated, efficient response execution because team members understand their specific duties and decision authorities without confusion or overlap. This prevents delays, duplication of effort, and gaps in response execution, which are critical for efficient plan implementation under pressure.
Not this one. Try another answer.
Why D is wrong
IT policies and procedures are reference materials but less critical than understanding one's own role and responsibility in the response.
Question 98 Play from 2:50:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Audit trails detect unauthorized changes but do not prevent inaccurate data entry or calculation errors.
Not this one. Try another answer.
Why B is wrong
Encryption protects data confidentiality and integrity in transit/storage but does not prevent inaccurate values.
Not this one. Try another answer.
Why C is wrong
Source data links enable traceability and reconciliation but do not validate that data values themselves are correct.
Right, D is the answer.
Why D is right
Inaccurate data results from errors in data entry, processing, or storage. Check totals (hash totals, record counts) and field-level validations directly detect and prevent inaccurate data by verifying completeness and correctness at the point of entry or processing. Audit trails (A) record what happened but do not prevent inaccuracy. Encrypted storage (B) protects data confidentiality but does not ensure accuracy. Links to source data (C) enable traceability but do not validate whether data itself is accurate.
Question 99 Play from 2:52:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Strategic initiatives are tools to manage risk, not the definition of optimization.
Not this one. Try another answer.
Why B is wrong
Resource availability is a constraint on how much risk can be reduced, not the optimization objective.
Not this one. Try another answer.
Why C is wrong
Reducing risk below appetite is wasteful; optimization targets meeting appetite, not exceeding it.
Right, D is the answer.
Why D is right
Optimized risk management aligns actual risk levels with the organization's risk appetite, the level of risk the organization is willing to accept. Risk should be reduced to meet (not below) this appetite, as reducing risk beyond appetite wastes resources. Strategic initiatives (A) and resource availability (B) are constraints or methods, not the optimization goal. Risk appetite is the target, not a floor to go beneath.
Question 100 Play from 2:54:30
What will be the Single Loss Expectancy of this project?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This result appears to add the exposure factor value rather than multiply it, which is not the correct SLE formula.
Right, B is the answer.
Why B is right
Single Loss Expectancy (SLE) is calculated using the formula: SLE = Asset Value × Exposure Factor. In this case: SLE = $125,000 × 0.25 = $31,250. The exposure factor of 25% represents the percentage of the asset value that would be lost in a single loss event, resulting in a SLE of $31,250.
Not this one. Try another answer.
Why C is wrong
This calculation is incorrect and does not reflect the proper application of the SLE formula.
Not this one. Try another answer.
Why D is wrong
This result incorrectly multiplies the asset value by 25,000 instead of applying the 25% exposure factor correctly.
Transcript
Play from 00:00 Question 1. Risk appetite should be PRIMARILY driven by which of the following? Here are the options. Option A. Stakeholder requirements. Option B. Enterprise security architecture roadmap. Option C. Business impact analysis (BIA). Option D. Legal and regulatory requirements. Pause the video now if you want time to think about the answer.
The correct answer is A. Stakeholder requirements. Risk appetite is fundamentally a business decision that reflects what level of risk an organization is willing to accept to achieve its objectives. This is primarily driven by stakeholder requirements, which include board members, executives, and key business leaders who determine the organization's tolerance for risk. While legal/regulatory requirements, BIA, and security architecture inform risk decisions, they are constraints or inputs to risk appetite rather than its primary driver. Now, why are the other options incorrect? Option B is incorrect. Security architecture roadmap is a tool to implement risk management, not the primary driver of risk appetite. Option C is incorrect. BIA identifies business impacts but does not determine the organization's willingness to accept risk. Option D is incorrect. Legal and regulatory requirements are compliance constraints, not the primary driver of risk appetite itself. Therefore, A, Stakeholder requirements, is the correct answer.
Play from 01:47 Question 2. From an IT risk perspective, which of the following has the GREATEST impact on organizational strategy? Here are the options. Option A. Changes in IT risk tolerance. Option B. Methodology for IT risk identification. Option C. Complexity of recovery plans. Option D. Complexity of IT architecture. Pause the video now if you want time to think about the answer.
The correct answer is A. Changes in IT risk tolerance. Changes in IT risk tolerance have the greatest impact on organizational strategy because risk tolerance defines the organization's willingness to pursue opportunities and shapes strategic decision-making at the highest level. Risk tolerance directly influences which initiatives are approved, how resources are allocated, and the overall strategic direction of the enterprise. Now, why are the other options incorrect? Option B is incorrect. Risk identification methodology affects execution quality but not the strategic direction or fundamental business priorities. Option C is incorrect. Recovery plan complexity relates to operational resilience but does not drive or shape organizational strategy. Option D is incorrect. IT architecture complexity is a technical consideration that influences capabilities but is secondary to risk tolerance in determining strategy. Therefore, A, Changes in IT risk tolerance, is the correct answer.
Play from 03:39 Question 3. Which of the following is an output of risk assessment process? Here are the options. Option A. Identification of risk. Option B. Identification of appropriate controls. Option C. Mitigated risk. Option D. Enterprise left with residual risk. Pause the video now if you want time to think about the answer.
The correct answer is D. Enterprise left with residual risk. The risk assessment process produces identification of risks, their analysis, and evaluation, which results in residual risk, the risk remaining after controls are considered. While risk identification and control identification are activities within the process, and mitigated risk is a state that occurs after implementation, residual risk is the actual output that the enterprise is left with after assessment and is the key deliverable showing what risk remains. Now, why are the other options incorrect? Option A is incorrect. Risk identification is an activity within the assessment process, not the output. Option B is incorrect. Identification of appropriate controls is part of risk treatment planning, which comes after assessment. Option C is incorrect. Mitigated risk occurs after controls are implemented, not as an output of the assessment itself. Therefore, D, Enterprise left with residual risk, is the correct answer.
Show full transcriptShow less
Play from 05:22 Question 4. A recent vulnerability assessment of a web-facing application revealed several weaknesses. Which of the following should be done NEXT to determine the risk exposure? Here are the options. Option A. Gap assessment. Option B. Business impact analysis (BIA). Option C. Code review. Option D. Penetration test. Pause the video now if you want time to think about the answer.
The correct answer is D. Penetration test. After identifying vulnerabilities through assessment, a penetration test is the next logical step to determine actual risk exposure. A penetration test validates whether vulnerabilities can be exploited in practice and measures the real-world impact, thereby establishing true risk exposure. This active testing demonstrates exploitability and business impact more effectively than theoretical assessments. Now, why are the other options incorrect? Option A is incorrect. Gap assessment examines the difference between current and desired states but doesn't determine risk exposure from identified vulnerabilities. Option B is incorrect. BIA analyzes impact of disruptions but comes after understanding what risks actually exist and can be exploited. Option C is incorrect. Code review is a control activity but doesn't directly demonstrate risk exposure or exploitability in the live environment. Therefore, D, Penetration test, is the correct answer.
Play from 07:09 Question 5. Which of the following should be done FIRST when developing an initial set of risk scenarios for an organization? Here are the options. Option A. Consider relevant business activities. Option B. Use a top-down approach. Option C. Use a bottom-up approach. Option D. Refer to industry standard scenarios. Pause the video now if you want time to think about the answer.
The correct answer is A. Consider relevant business activities. Considering relevant business activities should be done first when developing initial risk scenarios. Understanding the organization's actual business processes, operations, and activities provides the context necessary to identify realistic and meaningful risk scenarios. This business-centric foundation ensures scenarios are relevant and actionable. Now, why are the other options incorrect? Option B is incorrect. A top-down approach is valid but comes after understanding the business activities being assessed. Option C is incorrect. A bottom-up approach is also valid but requires first knowing what business activities exist to build up from. Option D is incorrect. Industry standard scenarios are useful reference points but should not be the starting point; scenarios must be tailored to the organization's specific business context. Therefore, A, Consider relevant business activities, is the correct answer.
Play from 08:55 Question 6. Which of the following is the PRIMARY responsibility of a risk owner? Here are the options. Option A. Determining risk appetite and tolerance. Option B. Developing relevant control procedures. Option C. Deciding responses to identified risk. Option D. Implementing risk action plans. Pause the video now if you want time to think about the answer.
The correct answer is C. Deciding responses to identified risk. The risk owner is the individual accountable for a specific risk and holds the primary responsibility for deciding how to respond to that risk, whether to avoid, mitigate, transfer, or accept it. The risk owner makes the critical judgment about which response strategy is appropriate given their business knowledge and risk tolerance. They may delegate implementation, but the decision about response belongs to the owner. Now, why are the other options incorrect? Option A is incorrect. Determining risk appetite and tolerance is a senior management and board responsibility, not individual risk owners. Option B is incorrect. Developing control procedures is typically the responsibility of control owners and operational management, not the risk owner. Option D is incorrect. Implementing risk action plans is often delegated to operations or control owners; the risk owner's role is deciding the response, not necessarily executing it. Therefore, C, Deciding responses to identified risk, is the correct answer.
Play from 10:43 Question 7. To implement the MOST effective monitoring of key risk indicators (KRIs), which of the following needs to be in place? Here are the options. Option A. Automated data feed. Option B. Controls monitoring. Option C. Escalation procedures. Option D. Threshold definition. Pause the video now if you want time to think about the answer.
The correct answer is D. Threshold definition. Threshold definition needs to be in place first because it establishes what levels of KRIs constitute acceptable versus unacceptable risk, providing the baseline for determining when escalation is needed and what constitutes a meaningful change. All other monitoring elements depend on having defined thresholds. Now, why are the other options incorrect? Option A is incorrect. Automated data feeds are necessary for efficiency but cannot be effectively implemented without predetermined thresholds. Option B is incorrect. Controls monitoring addresses control effectiveness but is separate from KRI monitoring implementation. Option C is incorrect. Escalation procedures are necessary but should be triggered based on threshold definitions, making thresholds the prerequisite. Therefore, D, Threshold definition, is the correct answer.
Play from 12:23 Question 8. Which organizational role should be accountable for ensuring information assets are appropriately classified? Here are the options. Option A. Data protection officer. Option B. Chief information officer (CIO). Option C. Information asset custodian. Option D. Information asset owner. Pause the video now if you want time to think about the answer.
The correct answer is D. Information asset owner. The information asset owner holds primary accountability for ensuring that information assets under their purview are appropriately classified. This is a foundational responsibility of asset ownership - to understand what assets exist, determine their value and sensitivity, and establish appropriate classification levels. While a data protection officer may advise on classification standards and a CIO may set organizational policy, and a custodian may implement controls, the owner is ultimately accountable for the classification decision itself. Now, why are the other options incorrect? Option A is incorrect. A data protection officer advises on data protection practices but does not hold accountability for classification of all information assets. Option B is incorrect. A CIO sets enterprise policy and strategy but does not directly own each individual information asset's classification. Option C is incorrect. An information asset custodian implements and maintains controls but is responsible to the owner, not accountable for the classification decision. Therefore, D, Information asset owner, is the correct answer.
Play from 14:18 Question 9. The analysis of which of the following will BEST help validate whether suspicious network activity is malicious? Here are the options. Option A. Intrusion detection system (IDS) rules. Option B. Penetration test reports. Option C. Vulnerability assessment reports. Option D. Logs and system events. Pause the video now if you want time to think about the answer.
The correct answer is D. Logs and system events. Logs and system events provide the actual forensic evidence of what occurred on the network and systems during suspicious activity. By examining detailed logs and event records, a risk practitioner can trace the activity, understand its behavior, impact, and intent, directly validating whether the activity is actually malicious. IDS rules, penetration tests, and vulnerability assessments provide detection mechanisms or potential attack vectors but do not directly validate what actually happened in real-time. Now, why are the other options incorrect? Option A is incorrect. IDS rules are detection tools but don't provide evidence of actual malicious behavior that occurred. Option B is incorrect. Penetration test reports show what could be exploited, not what was actually exploited in current activity. Option C is incorrect. Vulnerability assessments identify potential weaknesses but don't validate whether suspicious activity is malicious. Therefore, D, Logs and system events, is the correct answer.
Play from 16:08 Question 10. Which of the following is the MAIN reason for analyzing risk scenarios? Here are the options. Option A. Establishing a risk appetite. Option B. Identifying additional risk scenarios. Option C. Updating the heat map. Option D. Assessing loss expectancy. Pause the video now if you want time to think about the answer.
The correct answer is D. Assessing loss expectancy. The main reason for analyzing risk scenarios is to assess loss expectancy, understanding the potential financial or operational impact of identified risks. This quantitative or qualitative assessment of expected losses helps organizations prioritize risks and make informed decisions about resource allocation and mitigation strategies. While risk scenario analysis may contribute to other activities, assessing loss expectancy is the fundamental objective that drives the analysis process. Now, why are the other options incorrect? Option A is incorrect. Establishing risk appetite is a governance decision made before detailed scenario analysis, not the main reason for conducting the analysis itself. Option B is incorrect. Identifying additional risk scenarios may be a byproduct of thorough analysis, but it is not the primary purpose of analyzing specific scenarios. Option C is incorrect. Updating the heat map is a documentation step that follows risk analysis rather than being the main reason for conducting the analysis. Therefore, D, Assessing loss expectancy, is the correct answer.
Play from 18:02 Question 11. In the project initiation phase of System Development Life Cycle, there is information on project initiated by which of the following role carriers? Here are the options. Option A. CRO. Option B. Sponsor. Option C. Business management. Option D. CIO. Pause the video now if you want time to think about the answer.
The correct answer is B. Sponsor. The project sponsor is the key role that initiates a project during the initiation phase. The sponsor is a senior stakeholder or executive who authorizes and champions the project, provides necessary resources, and establishes the project charter. The sponsor's approval and authorization signal the formal beginning of the project. Now, why are the other options incorrect? Option A is incorrect. The CRO (Chief Risk Officer) manages risks but does not initiate projects. Option C is incorrect. Business management supports the project but the specific role of sponsor is the formal initiator. Option D is incorrect. The CIO (Chief Information Officer) may be involved in IT projects but is not necessarily the initiator role. Therefore, B, Sponsor, is the correct answer.
Play from 19:32 Question 12. Which among the following is the MOST crucial part of risk management process? Here are the options. Option A. Risk communication. Option B. Auditing. Option C. Risk monitoring. Option D. Risk mitigation. Pause the video now if you want time to think about the answer.
The correct answer is A. Risk communication. Risk communication is the most crucial part of the risk management process because identified and analyzed risks have no value unless effectively communicated to relevant stakeholders who can act on them. Without clear communication, even well-executed risk identification and analysis fail to drive appropriate risk responses and organizational decisions. Auditing (B) and monitoring (C) are important but are activities applied after communication enables action, and mitigation (D) depends on stakeholders understanding risks through proper communication. Now, why are the other options incorrect? Option B is incorrect. Auditing validates controls but does not drive the understanding and decision-making that communication enables. Option C is incorrect. Monitoring tracks risks over time but cannot occur effectively without initial proper communication of risks identified. Option D is incorrect. Mitigation decisions depend on stakeholders first understanding risks through effective communication of analysis results. Therefore, A, Risk communication, is the correct answer.
Play from 21:16 Question 13. An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of: Here are the options. Option A. risk mitigation. Option B. risk appetite. Option C. risk evaluation. Option D. risk tolerance. Pause the video now if you want time to think about the answer.
The correct answer is D. risk tolerance. Risk tolerance is the specific, quantifiable level of risk that an organization is willing to accept in the pursuit of its objectives. The statement that the organization will not accept availability below 98.5% is a precise tolerance level, defining the minimum acceptable threshold for this specific risk metric, which is the definition of risk tolerance. Now, why are the other options incorrect? Option A is incorrect. Risk mitigation refers to actions taken to reduce risk, not the statement of acceptable risk levels. Option B is incorrect. Risk appetite is the broader, general willingness to take on risk; risk tolerance is the more specific, measurable threshold. Option C is incorrect. Risk evaluation refers to analyzing and assessing risks, not establishing acceptable risk thresholds. Therefore, D, risk tolerance, is the correct answer.
Play from 22:57 Question 14. You are the project manager for Bluewell Inc. You are studying the documentation of project plan. The documentation states that there are twenty-five stakeholders with the project. What will be the number of communication channel s for the project? Here are the options. Option A. 20. Option B. 100. Option C. 50. Option D. 300. Pause the video now if you want time to think about the answer.
The correct answer is D. 300. The number of communication channels in a project is calculated using the formula: n(n-1)/2, where n is the number of stakeholders. With 25 stakeholders, the calculation is 25 × 24 ÷ 2 = 300 communication channels. This represents all potential two-way communication paths between any pair of stakeholders, which is the standard method for determining project communication complexity. Now, why are the other options incorrect? Option A is incorrect. 20 channels is far too low and does not apply the correct formula. Option B is incorrect. 100 channels would result from a smaller stakeholder population or incorrect calculation. Option C is incorrect. 50 channels does not align with the standard communication channel formula for 25 stakeholders. Therefore, D, 300, is the correct answer.
Play from 24:39 Question 15. Which of the following would provide the MOST objective assessment of the effectiveness of an organization's security controls? Here are the options. Option A. A third-party audit. Option B. Internal penetration testing. Option C. Security operations center review. Option D. An internal audit. Pause the video now if you want time to think about the answer.
The correct answer is A. A third-party audit. A third-party audit provides the MOST objective assessment because external auditors operate independently without internal biases, political pressures, or conflicts of interest. They apply consistent external standards and have professional credibility and liability, creating the highest level of objectivity and credibility in evaluating whether controls are actually effective. Now, why are the other options incorrect? Option B is incorrect. Internal penetration testing, while valuable, is conducted by employees who may have internal relationships and pressures affecting objectivity. Option C is incorrect. A security operations center review is an internal function subject to operational pressures and existing perspectives. Option D is incorrect. Internal audits, though professional, lack the independence and external perspective of third-party assessments. Therefore, A, A third-party audit, is the correct answer.
Play from 26:21 Question 16. Which of the following BEST facilitates the development of relevant risk scenarios? Here are the options. Option A. Perform quantitative risk analysis of historical data. Option B. Conduct brainstorming sessions with key stakeholders. Option C. Use qualitative risk assessment methodologies. Option D. Adopt an industry-recognized risk framework. Pause the video now if you want time to think about the answer.
The correct answer is B. Conduct brainstorming sessions with key stakeholders. Brainstorming sessions with key stakeholders facilitate relevant risk scenario development because participants bring diverse perspectives, operational knowledge, and creativity to identify plausible loss scenarios. This collaborative approach generates scenarios grounded in organizational reality and stakeholder insights that purely analytical methods cannot achieve. Now, why are the other options incorrect? Option A is incorrect. Quantitative analysis of historical data focuses on past events and may miss emerging or novel scenarios. Option C is incorrect. Qualitative assessment is useful but is a method for evaluating scenarios, not developing them. Option D is incorrect. Industry frameworks provide structure and reference points but do not directly generate organization-specific relevant scenarios. Therefore, B, Conduct brainstorming sessions with key stakeholders, is the correct answer.
Play from 28:04 Question 17. Which of the following should be the PRIMARY focus of an IT risk awareness program? Here are the options. Option A. Cultivate long-term behavioral change. Option B. Demonstrate regulatory compliance. Option C. Ensure compliance with the organization's internal policies. Option D. Communicate IT risk policy to the participants. Pause the video now if you want time to think about the answer.
The correct answer is A. Cultivate long-term behavioral change. The primary focus of an IT risk awareness program should be to cultivate long-term behavioral change in how employees handle IT risks and security. Awareness programs aim to embed security-conscious practices into organizational culture and individual habits, creating sustained improvements in security behavior beyond the training event itself. Now, why are the other options incorrect? Option B is incorrect. Demonstrating regulatory compliance is a business benefit but not the primary focus; compliance results from effective awareness, not the reverse. Option C is incorrect. Ensuring policy compliance is important but narrower than the broader goal of fostering long-term behavioral change. Option D is incorrect. Communicating policy is a tactical component of awareness, not the primary focus; changing actual behavior is the ultimate goal. Therefore, A, Cultivate long-term behavioral change, is the correct answer.
Play from 29:54 Question 18. Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios? Here are the options. Option A. Gather scenarios from senior management. Option B. Derive scenarios from IT risk policies and standards. Option C. Benchmark scenarios against industry peers. Option D. Map scenarios to a recognized risk management framework. Pause the video now if you want time to think about the answer.
The correct answer is D. Map scenarios to a recognized risk management framework. Mapping scenarios to a recognized risk management framework provides the most comprehensive and structured approach because it ensures that scenarios are systematically developed, aligned with best practices, and cover the full spectrum of IT risks in an organized manner. A framework provides structure, completeness, and consistency. Senior management input, policy derivation, and benchmarking are useful inputs but lack the comprehensiveness and systematic rigor of a framework-based approach. Now, why are the other options incorrect? Option A is incorrect. Gathering scenarios only from senior management may miss important perspectives and risks known to operational or technical staff. Option B is incorrect. Deriving scenarios from policies and standards alone may not capture all relevant risks or emerging threats comprehensively. Option C is incorrect. Benchmarking against peers provides useful comparisons but may not account for organization-specific risks or unique threat landscapes. Therefore, D, Map scenarios to a recognized risk management framework, is the correct answer.
Play from 31:55 Question 19. Wendy is about to perform qualitative risk analysis on the identified risks within her project. Which one of the following will NOT help Wendy to perform this project management activity? Here are the options. Option A. Risk management plan. Option B. Project scope statement. Option C. Risk register. Option D. Stakeholder register. Pause the video now if you want time to think about the answer.
The correct answer is D. Stakeholder register. The Stakeholder Register identifies who the stakeholders are but does not directly support the qualitative risk analysis process. Qualitative risk analysis requires the Risk Management Plan (processes and tools), Project Scope Statement (constraints and assumptions), and Risk Register (identified risks to analyze). The Stakeholder Register is useful for other processes but not essential for performing qualitative analysis. Now, why are the other options incorrect? Option A is incorrect. Risk Management Plan provides the methodology, definitions, and context for the analysis. Option B is incorrect. Project Scope Statement provides project boundaries, constraints, and assumptions critical to analyzing risk impact. Option C is incorrect. Risk Register contains the identified risks that are the primary input for qualitative analysis. Therefore, D, Stakeholder register, is the correct answer.
Play from 33:36 Question 20. Which of the following is MOST important to promoting a risk-aware culture? Here are the options. Option A. Communication of audit findings. Option B. Open communication of risk reporting. Option C. Procedures for security monitoring. Option D. Regular testing of risk controls. Pause the video now if you want time to think about the answer.
The correct answer is B. Open communication of risk reporting. Open communication of risk reporting is most important for promoting a risk-aware culture because it demonstrates transparency, encourages accountability, and signals that risk conversations are valued and expected throughout the organization. When risks are openly discussed without fear of punitive consequences, employees at all levels become more engaged in identifying and addressing risks. This creates the psychological and organizational foundation for risk awareness. Now, why are the other options incorrect? Option A is incorrect. Audit findings communication is important but reactive; open risk reporting is proactive and culturally transformative. Option C is incorrect. Security monitoring procedures are technical controls but do not directly promote cultural awareness of risk. Option D is incorrect. Testing controls validates their effectiveness but does not engage staff in the culture of risk awareness. Therefore, B, Open communication of risk reporting, is the correct answer.
Play from 35:28 Question 21. You work as a Project Manager for Company Inc. You are incorporating a risk response owner to take the job for each agreed-to and funded risk response. On which of the following processes are you working? Here are the options. Option A. Quantitative Risk Analysis. Option B. Identify Risks. Option C. Plan risk response. Option D. Qualitative Risk Analysis. Pause the video now if you want time to think about the answer.
The correct answer is C. Plan risk response. Planning Risk Response is the process where specific risk responses are developed, owners are assigned to each agreed-upon and funded risk response, and accountability is established. This process involves determining how to handle identified risks through mitigation, avoidance, acceptance, or escalation strategies, and designating a responsible owner for each response action. Now, why are the other options incorrect? Option A is incorrect. Quantitative Risk Analysis focuses on numerical analysis of risks, not assigning response owners. Option B is incorrect. Identify Risks is the discovery process, not the assignment of response owners. Option D is incorrect. Qualitative Risk Analysis assesses probability and impact subjectively, not assigns response owners. Therefore, C, Plan risk response, is the correct answer.
Play from 37:14 Question 22. Which of the following come under the phases of risk identification and evaluation? Each correct answer represents a complete solution. (Choose three.) Here are the options. Option A. Maintain a risk profile. Option B. Collecting data. Option C. Analyzing risk. Option D. Applying controls. Pause the video now if you want time to think about the answer.
The correct answers are A. Maintain a risk profile, and B. Collecting data, and C. Analyzing risk. The phases of risk identification and evaluation include: Maintaining a Risk Profile (A) to track identified risks, Collecting Data (B) through interviews and analysis, and Analyzing Risk (C) to understand probability and impact. Applying Controls (D) is part of risk response and treatment, which occurs after identification and evaluation, making it part of a separate phase. Now, why are the other options incorrect? Option D is incorrect. Applying controls is part of risk response and treatment, not identification and evaluation phases. Therefore, A and B and C are the correct answers.
Play from 38:46 Question 23. Which of the following is an example of risk sharing? Here are the options. Option A. Rejecting a high-risk project. Option B. Outsourcing the hosting of a critical system. Option C. Investing in fault-tolerant technology. Option D. Engaging in a code escrow agreement. Pause the video now if you want time to think about the answer.
The correct answer is B. Outsourcing the hosting of a critical system. Risk sharing involves distributing or transferring risk to another party. Outsourcing the hosting of a critical system shares the risk with the external hosting provider, who assumes responsibility for infrastructure and availability risks. This is a classic example of risk sharing as opposed to risk acceptance, mitigation, or avoidance. Now, why are the other options incorrect? Option A is incorrect. Rejecting a high-risk project is risk avoidance, not risk sharing. Option C is incorrect. Investing in fault-tolerant technology is risk mitigation, reducing the impact or likelihood of risk. Option D is incorrect. A code escrow agreement is a risk mitigation control that protects against vendor failure but does not share the risk with another party. Therefore, B, Outsourcing the hosting of a critical system, is the correct answer.
Play from 40:27 Question 24. Legal and regulatory risk associated with business conducted over the Internet is driven by: Here are the options. Option A. the laws and regulations of each individual country. Option B. the jurisdiction in which an organization has its principal headquarters. Option C. international law and a uniform set of regulations. Option D. international standard-setting bodies. Pause the video now if you want time to think about the answer.
The correct answer is A. the laws and regulations of each individual country. Legal and regulatory risk for Internet business is driven by the laws and regulations of each individual country because the Internet operates globally, and organizations must comply with the regulatory requirements of every jurisdiction where they conduct business or have customers. There is no single uniform international law governing Internet commerce; instead, businesses must navigate a complex patchwork of national and regional regulations. Now, why are the other options incorrect? Option B is incorrect. The principal headquarters location is only one jurisdiction; organizations must comply with regulations in all countries where they operate. Option C is incorrect. There is no uniform set of international laws for Internet business; regulations vary significantly by jurisdiction. Option D is incorrect. While standard-setting bodies provide recommendations, actual legal and regulatory risk is driven by national laws, not voluntary standards. Therefore, A, the laws and regulations of each individual country, is the correct answer.
Play from 42:18 Question 25. Which of the following is the BEST control for a large organization to implement to effectively mitigate risk related to fraudulent transactions? Here are the options. Option A. Password policies. Option B. Monetary approval limits. Option C. Clear roles and responsibilities. Option D. Segregation of duties. Pause the video now if you want time to think about the answer.
The correct answer is D. Segregation of duties. Segregation of duties is the most effective control to prevent fraudulent transactions in large organizations. It ensures that no single individual can complete a transaction independently, requiring multiple people to be involved in critical processes. This creates checks and balances that make it significantly harder for fraudulent activities to occur. While the other options contribute to security, none is as directly effective at preventing the specific risk of fraudulent transactions as segregation of duties. Now, why are the other options incorrect? Option A is incorrect. Password policies protect access to systems but do not prevent fraudulent transactions once access is gained. Option B is incorrect. Monetary approval limits reduce exposure but can be bypassed through collusion or by splitting transactions. Option C is incorrect. Clear roles and responsibilities establish accountability but do not inherently prevent fraud without additional compensating controls. Therefore, D, Segregation of duties, is the correct answer.
Play from 44:08 Question 26. Which of the following tools is MOST helpful when mapping IT risk management outcomes to organizational objectives? Here are the options. Option A. Risk dashboard. Option B. RACI chart. Option C. Information security risk map. Option D. Strategic business plan. Pause the video now if you want time to think about the answer.
The correct answer is D. Strategic business plan. A strategic business plan defines the organization's objectives and priorities, making it the essential reference point for mapping IT risk management outcomes to business goals. Without understanding the strategic plan, it is impossible to determine which risks matter most or how IT risk management should be prioritized relative to organizational objectives. The business plan provides the framework that gives context and meaning to all risk management activities. Now, why are the other options incorrect? Option A is incorrect. A risk dashboard displays current risk status but does not inherently show the connection between IT risk outcomes and organizational objectives. Option B is incorrect. A RACI chart clarifies roles and responsibilities but does not map risk outcomes to strategic business objectives. Option C is incorrect. An information security risk map shows security risks but is narrower in scope than organizational objectives and doesn't address the full range of IT risks. Therefore, D, Strategic business plan, is the correct answer.
Play from 46:00 Question 27. Qualitative risk assessment uses which of the following terms for evaluating risk level? Each correct answer represents a part of the solution. (Choose two.) Here are the options. Option A. Impact. Option B. Annual rate of occurrence. Option C. Probability. Option D. Single loss expectancy. Pause the video now if you want time to think about the answer.
The correct answers are A. Impact, and C. Probability. Qualitative risk assessment evaluates risks using descriptive terms related to Impact (severity of consequences) and Probability (likelihood of occurrence). These two factors are combined in qualitative analysis, often using matrices that rate risks as high, medium, or low based on these dimensions. Now, why are the other options incorrect? Option B is incorrect. Annual rate of occurrence is a quantitative metric used in quantitative risk assessment with numerical values, not qualitative assessment. Option D is incorrect. Single loss expectancy is a quantitative calculation combining monetary values, not a qualitative assessment term. Therefore, A and C are the correct answers.
Play from 47:31 Question 28. Which of the following is MOST important when substantiating control effectiveness? Here are the options. Option A. Control design documentation. Option B. Length of time the control has been in operation. Option C. Evidence of operation. Option D. Certification by the risk assessor. Pause the video now if you want time to think about the answer.
The correct answer is C. Evidence of operation. Evidence of operation is most important when substantiating control effectiveness. Demonstrating that a control actually operates as designed, through logs, records, testing results, and other operational evidence, proves its effectiveness. Design documentation alone does not prove a control works; time in operation is irrelevant if ineffective; and assessor certification is not evidence of actual control performance. Now, why are the other options incorrect? Option A is incorrect. Control design documentation shows intent but does not prove the control actually functions as designed. Option B is incorrect. Length of operation time is irrelevant to effectiveness; a long-standing control may still be ineffective. Option D is incorrect. An assessor's certification is a conclusion based on evidence, not itself substantiation of effectiveness. Therefore, C, Evidence of operation, is the correct answer.
Play from 49:17 Question 29. As part of its vendor management program, an organization has commissioned an audit of a vendor's control framework for the purpose of implementing compensating controls into its environment. Which risk response option has been decided? Here are the options. Option A. Transfer. Option B. Avoidance. Option C. Acceptance. Option D. Mitigation. Pause the video now if you want time to think about the answer.
The correct answer is D. Mitigation. The organization has decided on mitigation as the risk response option. By commissioning an audit of the vendor's control framework and implementing compensating controls, the organization is actively reducing the risk associated with the vendor relationship rather than eliminating it (avoidance), shifting responsibility (transfer), or accepting it as-is. Mitigation involves implementing controls to lower the likelihood or impact of identified risks. Now, why are the other options incorrect? Option A is incorrect. Transfer would mean shifting the risk to a third party through insurance or contractual terms, not implementing compensating controls. Option B is incorrect. Avoidance would mean eliminating the vendor relationship entirely, not auditing and implementing compensating controls. Option C is incorrect. Acceptance would mean acknowledging the risk without implementing additional controls to reduce it. Therefore, D, Mitigation, is the correct answer.
Play from 50:59 Question 30. The FIRST step for a startup company when developing a disaster recovery plan should be to identify: Here are the options. Option A. current vulnerabilities. Option B. a suitable alternate site. Option C. recovery time objectives. Option D. critical business processes. Pause the video now if you want time to think about the answer.
The correct answer is D. critical business processes. Identifying critical business processes is the foundational first step in disaster recovery planning. Until the organization understands which processes are essential to survival, it cannot determine recovery priorities, time objectives, resource requirements, or alternate site needs. All subsequent DR planning decisions flow from this identification. Now, why are the other options incorrect? Option A is incorrect. Vulnerability assessment comes later in the planning process, after critical processes are identified. Option B is incorrect. Selecting an alternate site requires knowing which processes must be recovered and their time requirements first. Option C is incorrect. Recovery time objectives (RTOs) cannot be set without first knowing which critical processes require recovery. Therefore, D, critical business processes, is the correct answer.
Play from 52:36 Question 31. Which of the following provides the MOST useful information to determine risk exposure following control implementations? Here are the options. Option A. Risk escalation and process for communication. Option B. Strategic plan and risk management integration. Option C. Risk limits, thresholds, and indicators. Option D. Policies, standards, and procedures. Pause the video now if you want time to think about the answer.
The correct answer is C. Risk limits, thresholds, and indicators. Risk limits, thresholds, and indicators provide the most useful information to determine risk exposure following control implementations. These metrics establish baselines and targets, allowing comparison of actual risk levels against acceptable tolerances to measure whether implemented controls have effectively reduced exposure. Escalation processes, strategic planning, and policies provide context and governance but do not directly measure the actual risk exposure levels achieved. Now, why are the other options incorrect? Option A is incorrect. Risk escalation and communication processes address governance but do not measure actual risk exposure. Option B is incorrect. Strategic planning integration shows alignment but does not provide specific exposure metrics. Option D is incorrect. Policies and procedures establish requirements but do not measure whether risk exposure has actually been reduced. Therefore, C, Risk limits, thresholds, and indicators, is the correct answer.
Play from 54:26 Question 32. The PRIMARY objective of collecting information and reviewing documentation when performing periodic risk analyses should be to: Here are the options. Option A. survey and analyze historical risk data. Option B. identify new or emerging risk issues. Option C. understand internal and external threat agents. Option D. satisfy audit requirements. Pause the video now if you want time to think about the answer.
The correct answer is B. identify new or emerging risk issues. The primary objective of collecting information and reviewing documentation during periodic risk analyses is to identify new or emerging risk issues that may have developed since the last assessment. This proactive identification allows organizations to respond to evolving threats and changing business conditions. While historical analysis, threat understanding, and audit compliance are activities within the process, identification of new/emerging risks is the core purpose. Now, why are the other options incorrect? Option A is incorrect. Analyzing historical data is a supporting activity but not the primary objective of periodic analyses. Option C is incorrect. Understanding threat agents is important context but secondary to identifying what new risks currently exist. Option D is incorrect. Satisfying audit requirements is a compliance outcome, not the primary operational objective. Therefore, B, identify new or emerging risk issues, is the correct answer.
Play from 56:14 Question 33. Which of the following is MOST important when developing key performance indicators (KPIs)? Here are the options. Option A. Alignment to management reports. Option B. Alignment to risk responses. Option C. Alerts when risk thresholds are reached. Option D. Identification of trends. Pause the video now if you want time to think about the answer.
The correct answer is A. Alignment to management reports. KPIs must be aligned to management reports because they serve as the metrics management uses to evaluate organizational performance and make strategic decisions. Alignment ensures that KPIs are meaningful, actionable, and directly support management's ability to govern and oversee operations. Without alignment to management reports, KPIs may measure irrelevant factors that do not inform decision- making. Now, why are the other options incorrect? Option B is incorrect. While KPIs should support risk responses, alignment to management reporting is more fundamental to KPI effectiveness. Option C is incorrect. Alerts for threshold breaches are a feature of KPI monitoring but not the most important consideration during development. Option D is incorrect. Trend identification is a benefit of KPIs but secondary to ensuring alignment with what management needs to report. Therefore, A, Alignment to management reports, is the correct answer.
Play from 57:57 Question 34. During a data loss incident, which role in the RACI chart would be aligned to the risk practitioner? Here are the options. Option A. Accountable. Option B. Informed. Option C. Responsible. Option D. Consulted. Pause the video now if you want time to think about the answer.
The correct answer is D. Consulted. During a data loss incident, the risk practitioner would be Consulted. The risk practitioner provides expertise, analysis, and guidance on risk implications and mitigation during incident response, but is not the primary responsible party (that's incident response team) or accountable party (that's management). The practitioner's role is advisory and informative to support decision-making. Now, why are the other options incorrect? Option A is incorrect. Accountable role belongs to senior management or incident owner, not the risk practitioner. Option B is incorrect. Informed is passive; the risk practitioner actively contributes analysis, making them Consulted. Option C is incorrect. Responsible typically falls to the incident response team executing the response, not the risk practitioner. Therefore, D, Consulted, is the correct answer.
Play from 59:32 Question 35. Before assigning sensitivity levels to information, it is MOST important to: Here are the options. Option A. define the information classification policy. Option B. conduct a sensitivity analysis. Option C. identify information custodians. Option D. define recovery time objectives (RTOs). Pause the video now if you want time to think about the answer.
The correct answer is A. define the information classification policy. Before assigning sensitivity levels to information, an organization must first define the information classification policy. This policy establishes the framework, criteria, and governance for classifying data. Without a defined policy, sensitivity level assignments would lack consistency, criteria, and organizational alignment. The policy provides the foundation upon which all subsequent classification activities depend. Now, why are the other options incorrect? Option B is incorrect. Sensitivity analysis is conducted after the policy is defined to determine appropriate sensitivity levels. Option C is incorrect. Identifying custodians happens during implementation but requires a policy framework to be established first. Option D is incorrect. RTOs relate to business continuity and recovery, not to the classification policy itself. Therefore, A, define the information classification policy, is the correct answer.
Play from 1:01:19 Question 36. Which of the following is the BEST way to ensure controls are maintained consistently across the environment? Here are the options. Option A. Performing a gap analysis on process deviations. Option B. Conducting annual control assessments. Option C. Monitoring key risk indicators (KRIs). Option D. Training operational staff on risk control procedures. Pause the video now if you want time to think about the answer.
The correct answer is B. Conducting annual control assessments. Conducting annual control assessments provides the most comprehensive and systematic way to verify that controls are being executed consistently across the environment. Assessments evaluate whether controls are operating as designed throughout the organization. While gap analysis, KRI monitoring, and training are helpful tools, only regular formal assessments directly measure and verify consistent control execution across all locations and functions. Now, why are the other options incorrect? Option A is incorrect. Gap analysis identifies deviations but does not ensure ongoing consistent maintenance of controls. Option C is incorrect. KRIs monitor outcomes but do not directly verify consistent control execution and design. Option D is incorrect. Training improves awareness but does not measure or verify actual consistent control execution. Therefore, B, Conducting annual control assessments, is the correct answer.
Play from 1:03:12 Question 37. The MOST important reason to periodically review key risk indicators (KRIs) is to: Here are the options. Option A. satisfy audit requirements. Option B. comply with risk-related laws and regulations. Option C. identify deviations from organizational tolerance. Option D. align with industry benchmarks. Pause the video now if you want time to think about the answer.
The correct answer is C. identify deviations from organizational tolerance. The most important reason to periodically review KRIs is to identify deviations from organizational tolerance levels. KRIs are leading indicators designed to signal when risk is trending toward or exceeding the organization's established tolerance thresholds, enabling early intervention before problems become critical. This real-time risk monitoring and correction is the core purpose of KRI review, whereas audit satisfaction, regulatory compliance, and benchmarking are secondary or derivative benefits. Now, why are the other options incorrect? Option A is incorrect. Satisfying audits is a compliance activity, not the primary purpose of KRI review. Option B is incorrect. Compliance is a requirement, but KRIs serve the broader purpose of active risk management. Option D is incorrect. Benchmarking is useful context but does not address whether risks are within tolerance. Therefore, C, identify deviations from organizational tolerance, is the correct answer.
Play from 1:05:03 Question 38. Which of the following should be the MAIN consideration when validating an organization's risk appetite? Here are the options. Option A. Cost of risk mitigation options. Option B. Maturity of the risk culture. Option C. Capacity to withstand loss. Option D. Comparison against regulations. Pause the video now if you want time to think about the answer.
The correct answer is C. Capacity to withstand loss. Risk appetite must align with the organization's actual financial and operational capacity to absorb losses without jeopardizing viability. Validating appetite requires assessing whether the organization can withstand the potential impact of risks at the stated tolerance level. This ensures risk appetite is realistic and sustainable rather than aspirational. Now, why are the other options incorrect? Option A is incorrect. Cost of mitigation is relevant to risk response selection but not to validating whether appetite itself is appropriate. Option B is incorrect. While risk culture maturity affects implementation capability, capacity to withstand loss is the fundamental measure of appropriate appetite. Option D is incorrect. Regulatory comparison ensures compliance but doesn't validate whether the organization can actually tolerate its stated appetite level. Therefore, C, Capacity to withstand loss, is the correct answer.
Play from 1:06:43 Question 39. An organization has made a decision to purchase a new IT system. During which phase of the system development life cycle (SDLC) will identified risk MOST likely lead to architecture and design trade-offs? Here are the options. Option A. Acquisition. Option B. Implementation. Option C. Initiation. Option D. Operation and maintenance. Pause the video now if you want time to think about the answer.
The correct answer is A. Acquisition. The Acquisition phase is when the organization is evaluating and selecting systems, and identified risks will most directly lead to architecture and design trade-offs. During acquisition, decisions about which system to purchase, how to configure it, and what requirements it must meet are made based on risk considerations. These decisions fundamentally shape the system's architecture and design. In later phases like implementation and operation, the system architecture is largely set, and trade-offs are more limited. Now, why are the other options incorrect? Option B is incorrect. Implementation phase involves deploying the selected system; major architecture and design decisions have already been made during acquisition. Option C is incorrect. Initiation phase precedes acquisition and focuses on business need and feasibility; detailed architecture and design trade-offs occur later. Option D is incorrect. Operation and maintenance phase works with an already-deployed system; architecture changes are costly and infrequent at this stage. Therefore, A, Acquisition, is the correct answer.
Play from 1:08:37 Question 40. Which of the following should be the GREATEST concern to a risk practitioner when process documentation is incomplete? Here are the options. Option A. Inability to identify the risk owner. Option B. Inability to identify process experts. Option C. Inability to allocate resources efficiently. Option D. Inability to complete the risk register. Pause the video now if you want time to think about the answer.
The correct answer is A. Inability to identify the risk owner. Without complete process documentation, it becomes impossible to definitively identify who owns each process and bears responsibility for managing its risks. The risk owner is critical to effective risk management because they drive mitigation actions and accountability. Without identifying risk owners, risk management efforts lack clear accountability and cannot be effectively executed. Now, why are the other options incorrect? Option B is incorrect. Process experts can often be identified through organizational structure and conversations, even with incomplete documentation. Option C is incorrect. Resource allocation challenges can be worked around through interviews and project management; it is not the greatest concern. Option D is incorrect. The risk register can be completed through discussions and analysis; incomplete documentation makes it harder but not impossible. Therefore, A, Inability to identify the risk owner, is the correct answer.
Play from 1:10:25 Question 41. Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to: Here are the options. Option A. assign ownership of emerging risk scenarios. Option B. identify threats to emerging technologies. Option C. communicate risk trends to stakeholders. Option D. highlight noncompliance with the risk policy. Pause the video now if you want time to think about the answer.
The correct answer is C. communicate risk trends to stakeholders. Using key risk indicators to illustrate changes in the risk profile primarily helps to communicate risk trends to stakeholders. KRIs are designed as forward-looking metrics that show movement in risk levels over time, making them ideal for demonstrating whether risks are improving, deteriorating, or remaining stable. This trend communication enables stakeholders to understand the organization's current risk trajectory and the effectiveness of risk responses. Now, why are the other options incorrect? Option A is incorrect. Assigning ownership of risk scenarios is an administrative function separate from using KRIs for trend communication. Option B is incorrect. Identifying threats to emerging technologies is a separate risk identification activity, not the primary use of KRIs. Option D is incorrect. Highlighting noncompliance with the risk policy is a compliance monitoring function; KRIs are used for trend analysis rather than policy compliance. Therefore, C, communicate risk trends to stakeholders, is the correct answer.
Play from 1:12:18 Question 42. Reviewing which of the following provides the BEST indication of an organization's risk tolerance? Here are the options. Option A. Risk sharing strategy. Option B. Risk assessments. Option C. Risk transfer agreements. Option D. Risk policies. Pause the video now if you want time to think about the answer.
The correct answer is D. Risk policies. Risk policies are the BEST indication of an organization's risk tolerance because they explicitly document the organization's appetite for, and thresholds regarding, different types of risk. Policies establish approved ranges for risk-taking and define the organization's philosophical stance on what risks are acceptable, making them the most direct reflection of risk tolerance. Now, why are the other options incorrect? Option A is incorrect. Risk sharing strategies reflect how risks are distributed but not the underlying tolerance level. Option B is incorrect. Risk assessments identify and measure existing risks but do not define the organization's willingness to accept risk. Option C is incorrect. Risk transfer agreements show specific mitigation actions but do not reveal the organization's overall risk tolerance. Therefore, D, Risk policies, is the correct answer.
Play from 1:13:52 Question 43. Performing a background check on a new employee candidate before hiring is an example of what type of control? Here are the options. Option A. Compensating. Option B. Preventive. Option C. Detective. Option D. Corrective. Pause the video now if you want time to think about the answer.
The correct answer is B. Preventive. A background check performed before hiring is a preventive control. Preventive controls are designed to stop undesirable events from occurring in the first place. By screening candidates before employment, the organization prevents potentially problematic individuals from being hired, thereby preventing future risk events rather than detecting or correcting them after they occur. Now, why are the other options incorrect? Option A is incorrect. Compensating controls are alternative controls used when primary controls cannot be implemented; a background check is primary, not compensating. Option C is incorrect. Detective controls identify that an undesirable event has occurred; background checks operate before employment, not during or after. Option D is incorrect. Corrective controls address problems after they have already occurred; background checks act before risk materializes. Therefore, B, Preventive, is the correct answer.
Play from 1:15:22 Question 44. Which of the following is the GREATEST benefit of having a mature enterprise architecture (EA) in place? Here are the options. Option A. Standards-based policies. Option B. Efficient operations. Option C. Regulatory compliance. Option D. Audit readiness. Pause the video now if you want time to think about the answer.
The correct answer is B. Efficient operations. Efficient operations represent the greatest overarching benefit of a mature enterprise architecture, as EA provides standardization, integration, and optimization that directly reduce operational costs and complexity. While standards-based policies, regulatory compliance, and audit readiness are benefits of EA, they are either byproducts or more specific outcomes rather than the primary strategic benefit of the architecture framework itself. Now, why are the other options incorrect? Option A is incorrect. Standards-based policies are an output of EA rather than its greatest benefit. Option C is incorrect. Regulatory compliance is a benefit but more reactive than the proactive operational efficiency gain. Option D is incorrect. Audit readiness is a secondary benefit rather than the primary strategic advantage. Therefore, B, Efficient operations, is the correct answer.
Play from 1:17:01 Question 45. Which of the following would MOST electively reduce risk associated with an increased volume of online transactions on a retailer website? Here are the options. Option A. Transaction limits. Option B. Scalable infrastructure. Option C. A hot backup site. Option D. Website activity monitoring. Pause the video now if you want time to think about the answer.
The correct answer is B. Scalable infrastructure. Scalable infrastructure directly addresses the risk of increased transaction volume by ensuring the system can handle growing demand without performance degradation, service outages, or security vulnerabilities. Transaction limits would restrict business, a hot backup site addresses disaster recovery rather than transaction volume risk, and monitoring only detects issues without preventing them. Now, why are the other options incorrect? Option A is incorrect. Transaction limits would reduce revenue and customer satisfaction rather than mitigate the actual risk of handling volume. Option C is incorrect. A hot backup site addresses continuity and disaster recovery, not the specific risk of increased transaction volume. Option D is incorrect. Monitoring detects problems but does not actively reduce the risk of system failure under high load. Therefore, B, Scalable infrastructure, is the correct answer.
Play from 1:18:40 Question 46. Which of the following is the MOST important consideration when sharing risk management updates with executive management? Here are the options. Option A. Using an aggregated view of organizational risk. Option B. Relying on key risk indicator (KRI) data. Option C. Ensuring relevance to organizational goals. Option D. Including trend analysis of risk metrics. Pause the video now if you want time to think about the answer.
The correct answer is C. Ensuring relevance to organizational goals. When communicating risk updates to executive management, the MOST important consideration is ensuring the information is relevant to organizational goals. Executives make strategic decisions based on how risks impact business objectives, so framing risk updates in terms of organizational goals ensures they can understand implications and make informed decisions. While aggregated views, KRI data, and trend analysis are all valuable risk management practices, they are secondary to ensuring the message addresses what matters most to the organization's strategic direction. Now, why are the other options incorrect? Option A is incorrect. Aggregated views are helpful but not the primary consideration if they lack relevance to business objectives. Option B is incorrect. KRI data is a tool to support risk communication but is less important than ensuring strategic relevance. Option D is incorrect. Trend analysis provides useful context but is not more important than connecting risks to organizational goals. Therefore, C, Ensuring relevance to organizational goals, is the correct answer.
Play from 1:20:42 Question 47. Which of the following methods involves the use of predictive or diagnostic analytical tool for exposing risk factors? Here are the options. Option A. Scenario analysis. Option B. Sensitivity analysis. Option C. Fault tree analysis. Option D. Cause and effect analysis. Pause the video now if you want time to think about the answer.
The correct answer is C. Fault tree analysis. Fault tree analysis is a deductive analytical method that uses predictive or diagnostic tools to expose risk factors by working backward from an undesired outcome to identify potential causes and contributing factors. It systematically maps how combinations of failures could lead to a system failure, making it an effective tool for exposing the underlying risk factors that could cause problems. Now, why are the other options incorrect? Option A is incorrect. Scenario analysis explores potential future situations but does not specifically use predictive/diagnostic analytical tools for exposing risk factors. Option B is incorrect. Sensitivity analysis examines how changes in variables affect outcomes but is not primarily a predictive/diagnostic tool for exposing risk factors. Option D is incorrect. Cause and effect analysis (fishbone diagram) is descriptive and qualitative, not a quantitative predictive or diagnostic analytical tool. Therefore, C, Fault tree analysis, is the correct answer.
Play from 1:22:32 Question 48. To communicate the risk associated with IT in business terms, which of the following MUST be defined? Here are the options. Option A. Risk appetite of the organization. Option B. Compliance objectives. Option C. Organizational objectives. Option D. Inherent and residual risk. Pause the video now if you want time to think about the answer.
The correct answer is C. Organizational objectives. To communicate IT risk in business terms, organizational objectives MUST be defined first. Business objectives provide the context and framework for understanding how IT risks could impact the organization's strategic goals. Without clear organizational objectives, it is impossible to translate technical risks into meaningful business consequences that stakeholders can understand and act upon. Now, why are the other options incorrect? Option A is incorrect. Risk appetite is important but describes tolerance for risk-taking, not the foundational business context needed for communication. Option B is incorrect. Compliance objectives are specific constraints but do not serve as the primary framework for translating IT risk into business terms. Option D is incorrect. Inherent and residual risk are quantitative measures of existing risk, not the foundational element needed to contextualize risk communication. Therefore, C, Organizational objectives, is the correct answer.
Play from 1:24:19 Question 49. Which of the following is MOST important for an IT risk practitioner to update once risk mitigation action plans have been verified as completed? Here are the options. Option A. Risk rating. Option B. Control inventory. Option C. Risk impact. Option D. Control ownership. Pause the video now if you want time to think about the answer.
The correct answer is A. Risk rating. Once risk mitigation action plans have been verified as completed, the risk rating is most important to update. The risk rating reflects the residual risk remaining after controls and mitigation actions have been implemented. Updating the rating documents the effectiveness of the mitigation efforts and provides current information for risk monitoring and reporting. Now, why are the other options incorrect? Option B is incorrect. Control inventory may be updated but is separate from assessing the effectiveness of completed mitigation actions. Option C is incorrect. Risk impact itself typically remains unchanged; what changes is the residual risk rating after mitigation is applied. Option D is incorrect. Control ownership is an attribute that may have been established when controls were implemented but is not the primary post-completion update. Therefore, A, Risk rating, is the correct answer.
Play from 1:26:02 Question 50. Which of the following provides the BEST indication of risk management maturity? Here are the options. Option A. Comprehensive risk and control assessment methodology. Option B. Risk management policy alignment with corporate culture. Option C. Business continuity insurance coverage. Option D. Presence of a risk management framework. Pause the video now if you want time to think about the answer.
The correct answer is D. Presence of a risk management framework. The presence of a risk management framework is the best indication of risk management maturity because it demonstrates a structured, systematic, and repeatable approach to managing risk across the organization. A mature framework encompasses governance, processes, methodologies, and integration with business objectives. While other elements may be components within a framework, the framework itself represents the organizational commitment and infrastructure necessary for consistent, enterprise-wide risk management. Now, why are the other options incorrect? Option A is incorrect. A comprehensive methodology is important but is typically one component within a broader framework, not necessarily an indicator of overall maturity. Option B is incorrect. Policy alignment with culture is valuable but may exist without systematic implementation, making it insufficient as a maturity indicator. Option C is incorrect. Insurance coverage addresses financial risk transfer but does not indicate that risk management processes or governance are mature. Therefore, D, Presence of a risk management framework, is the correct answer.
Play from 1:27:57 Question 51. The BEST metric to demonstrate that servers are configured securely is the total number of servers: Here are the options. Option A. experiencing hardware failures. Option B. exceeding availability thresholds. Option C. exceeding current patching standards. Option D. meeting the baseline for hardening. Pause the video now if you want time to think about the answer.
The correct answer is D. meeting the baseline for hardening. The total number of servers meeting the baseline for hardening is the most direct and relevant metric for demonstrating secure configuration. Hardening baselines include security controls such as patch levels, disabled unnecessary services, configuration standards, and access controls, all core elements of secure server configuration. Now, why are the other options incorrect? Option A is incorrect. Hardware failures relate to availability and maintenance, not security configuration. Option B is incorrect. Exceeding availability thresholds indicates performance issues, not security posture. Option C is incorrect. Exceeding current patching standards indicates inadequate patching, which is a security deficiency rather than a measure of security achievement. Therefore, D, meeting the baseline for hardening, is the correct answer.
Play from 1:29:33 Question 52. Which of the following BEST ensures that a firewall is configured in compliance with an enterprise's security policy? Here are the options. Option A. Interview the firewall administrator. Option B. Review the actual procedures. Option C. Review the device's log file for recent attacks. Option D. Review the parameter settings. Pause the video now if you want time to think about the answer.
The correct answer is D. Review the parameter settings. Reviewing the actual parameter settings on the firewall device provides direct, technical evidence of whether configurations align with security policy requirements. This is the most definitive way to verify compliance as it shows what the system is actually doing, not what people say it does. Now, why are the other options incorrect? Option A is incorrect. Interviewing administrators relies on subjective statements and may not reveal actual configuration accuracy. Option B is incorrect. Reviewing procedures documents what should happen, not necessarily what is configured. Option C is incorrect. Reviewing log files shows attack history but does not verify that current configurations comply with security policies. Therefore, D, Review the parameter settings, is the correct answer.
Play from 1:31:10 Question 53. Prudent business practice requires that risk appetite not exceed: Here are the options. Option A. risk capacity. Option B. inherent risk. Option C. risk tolerance. Option D. residual risk. Pause the video now if you want time to think about the answer.
The correct answer is A. risk capacity. Risk appetite (the amount of risk an organization is willing to accept) prudently should not exceed risk capacity (the amount of risk the organization can actually absorb without failing). An organization cannot sustain risk exposure beyond what its financial, operational, and strategic resources can withstand. Exceeding capacity jeopardizes the organization's viability, making this the critical constraint on appetite. Now, why are the other options incorrect? Option B is incorrect. Inherent risk is the baseline risk before controls; appetite and capacity are forward-looking decisions, not constrained by inherent risk. Option C is incorrect. Risk tolerance and risk appetite are closely related concepts; tolerance is more about specific thresholds, but capacity is the ultimate limiting factor. Option D is incorrect. Residual risk (risk after controls) is what should be within appetite, but appetite itself is constrained by the organization's capacity to bear loss. Therefore, A, risk capacity, is the correct answer.
Play from 1:32:54 Question 54. Mortality tables are based on what mathematical activity? Each correct answer represents a complete solution. (Choose three.) Here are the options. Option A. Normal distributions. Option B. Probabilities. Option C. Impact. Option D. Sampling. Pause the video now if you want time to think about the answer.
The correct answers are A. Normal distributions, and B. Probabilities, and D. Sampling. Mortality tables are based on probabilities (B), which are derived from normal distributions (A) of life expectancy data, and use sampling (D) of population data to calculate actuarial values. These mathematical foundations allow insurers and actuaries to determine death rates and life expectancies. While impact analysis is important in risk management, mortality tables specifically focus on probability calculations based on statistical distributions and sampling methods. Now, why are the other options incorrect? Option C is incorrect. Impact is not a mathematical foundation of mortality tables; probability and statistical distributions are the core mathematical basis. Therefore, A and B and D are the correct answers.
Play from 1:34:27 Question 55. Which of the following is a PRIMARY responsibility of a control owner? Here are the options. Option A. Assessing levels of risk. Option B. Identifying trends in the risk profile. Option C. Selecting controls to mitigate risk. Option D. Monitoring status of risk response. Pause the video now if you want time to think about the answer.
The correct answer is C. Selecting controls to mitigate risk. A control owner's primary responsibility is to select and design controls that mitigate identified risks. The control owner is accountable for implementing effective controls aligned with the organization's risk tolerance. This is the foundational ownership duty; monitoring, assessing, and identifying trends are ongoing responsibilities but derivative from having selected appropriate controls in the first place. Now, why are the other options incorrect? Option A is incorrect. Assessing levels of risk is primarily a risk manager's responsibility, not the control owner's. Option B is incorrect. Identifying trends in risk profile is a risk function responsibility, typically performed by risk management rather than individual control owners. Option D is incorrect. While control owners do monitor their controls, the primary responsibility is establishing the controls themselves; monitoring is an ongoing operational duty. Therefore, C, Selecting controls to mitigate risk, is the correct answer.
Play from 1:36:18 Question 56. Which of the following should be the PRIMARY consideration when identifying and assigning ownership of IT-related risk? Here are the options. Option A. Accountability for control operation. Option B. Accountability for losses due to impact. Option C. Ability to design controls to mitigate the risk. Option D. Span of control within the organization. Pause the video now if you want time to think about the answer.
The correct answer is A. Accountability for control operation. Accountability for control operation is the primary consideration because it ensures clear responsibility for day-to-day execution of risk mitigation. Risk owners must be able to direct and manage the controls, making operational accountability the most fundamental criterion. Now, why are the other options incorrect? Option B is incorrect. While important, accountability for losses is secondary to accountability for control operation. Option C is incorrect. Ability to design controls is valuable but less critical than accountability for ongoing operational execution. Option D is incorrect. Organizational position matters less than actual accountability for control operation. Therefore, A, Accountability for control operation, is the correct answer.
Play from 1:37:57 Question 57. Which of the following is the BEST way to validate the results of a vulnerability assessment? Here are the options. Option A. Perform a penetration test. Option B. Perform a root cause analysis. Option C. Conduct a threat analysis. Option D. Review security logs. Pause the video now if you want time to think about the answer.
The correct answer is A. Perform a penetration test. A penetration test is the best way to validate vulnerability assessment results because it actively exploits identified vulnerabilities in a controlled manner to confirm they are real, exploitable, and present a genuine risk. This provides practical validation that assessment findings are accurate and actionable. Now, why are the other options incorrect? Option B is incorrect. Root cause analysis explains why vulnerabilities exist but doesn't validate whether the assessment findings are correct. Option C is incorrect. Threat analysis examines potential threats but doesn't specifically validate the accuracy of vulnerability assessment results. Option D is incorrect. Security logs show what has occurred but cannot effectively validate whether the identified vulnerabilities in the assessment are real and exploitable. Therefore, A, Perform a penetration test, is the correct answer.
Play from 1:39:41 Question 58. Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities? Here are the options. Option A. Software licensing information. Option B. Software version. Option C. Software support contract expiration. Option D. Assigned software manager. Pause the video now if you want time to think about the answer.
The correct answer is B. Software version. Software version is the critical inventory component that enables vulnerability identification and mitigation. Vulnerability databases and security tools cross-reference specific software versions against known CVEs and security advisories. Without accurate version information, organizations cannot determine whether they are affected by published vulnerabilities or apply appropriate patches and updates. Now, why are the other options incorrect? Option A is incorrect. Licensing information ensures compliance but does not directly enable vulnerability identification. Option C is incorrect. Support contract expiration indicates when vendor support ends but is not the primary enabler of vulnerability identification. Option D is incorrect. Assigned manager facilitates accountability but does not technically enable vulnerability identification. Therefore, B, Software version, is the correct answer.
Play from 1:41:25 Question 59. A recent big data project has resulted in the creation of an application used to support important investment decisions. Which of the following should be of GREATEST concern to the risk practitioner? Here are the options. Option A. Data redundancy. Option B. Maintenance costs. Option C. Data quality. Option D. System integration. Pause the video now if you want time to think about the answer.
The correct answer is C. Data quality. Data quality is the greatest concern for an application supporting important investment decisions. Poor data quality directly compromises the accuracy and reliability of the analysis, leading to flawed investment decisions and financial losses. When data is used as the foundation for critical business decisions, quality is paramount. Now, why are the other options incorrect? Option A is incorrect. Data redundancy relates to availability and disaster recovery, not to the reliability of analytical results. Option B is incorrect. Maintenance costs are operational considerations but secondary to ensuring data quality for critical decisions. Option D is incorrect. System integration is a technical concern but less critical than the quality of the data being analyzed for decision-making. Therefore, C, Data quality, is the correct answer.
Play from 1:43:06 Question 60. Risk mitigation procedures should include: Here are the options. Option A. buying an insurance policy. Option B. acceptance of exposures. Option C. deployment of countermeasures. Option D. enterprise architecture implementation. Pause the video now if you want time to think about the answer.
The correct answer is C. deployment of countermeasures. Risk mitigation procedures should focus on the deployment of countermeasures, the actual controls and measures implemented to reduce or eliminate risk exposure. Countermeasures are the substantive actions taken to mitigate risk. Insurance policies are a financing mechanism, acceptance of exposures is a response strategy rather than a mitigation procedure, and enterprise architecture implementation is too broad and not specific to mitigation procedures. Now, why are the other options incorrect? Option A is incorrect. Buying insurance is a risk financing strategy, not a mitigation procedure. Option B is incorrect. Acceptance of exposures is a risk response decision, not a mitigation procedure. Option D is incorrect. Enterprise architecture implementation is strategic infrastructure work, not a core mitigation procedure. Therefore, C, deployment of countermeasures, is the correct answer.
Play from 1:44:44 Question 61. Reviewing which of the following BEST helps an organization gain insight into its overall risk profile? Here are the options. Option A. Threat landscape. Option B. Risk metrics. Option C. Risk appetite. Option D. Risk register. Pause the video now if you want time to think about the answer.
The correct answer is D. Risk register. The risk register provides a comprehensive view of identified, assessed, and prioritized risks across the organization, directly reflecting the overall risk profile. It documents all significant risks, their owners, mitigation status, and residual levels, making it the primary tool for understanding organizational risk posture. The risk register aggregates risk information and shows how risks are being managed, providing the most complete insight into overall risk profile. Now, why are the other options incorrect? Option A is incorrect. The threat landscape describes external threats and vulnerabilities but does not directly indicate how the organization is managing its specific risks. Option B is incorrect. Risk metrics are individual measurements that support risk management but do not themselves provide the comprehensive view that the risk register does. Option C is incorrect. Risk appetite defines tolerance for risk but does not provide insight into the actual risks the organization faces or their current status. Therefore, D, Risk register, is the correct answer.
Play from 1:46:31 Question 62. Which of the following is MOST influential when management makes risk response decisions? Here are the options. Option A. Detection risk. Option B. Risk appetite. Option C. Audit risk. Option D. Residual risk. Pause the video now if you want time to think about the answer.
The correct answer is B. Risk appetite. Risk appetite defines the organization's tolerance for risk and directly shapes which risks management is willing to accept, mitigate, avoid, or transfer. It is the primary driver of risk response decisions because it establishes the threshold and boundaries within which all response strategies are evaluated and chosen. Now, why are the other options incorrect? Option A is incorrect. Detection risk relates to audit effectiveness, not management's risk response decisions. Option C is incorrect. Audit risk is a concept in audit planning and does not influence management's operational risk response choices. Option D is incorrect. Residual risk is an outcome of risk response decisions, not a driver of them. Therefore, B, Risk appetite, is the correct answer.
Play from 1:47:57 Question 63. An organization is considering acquiring a new line of business and wants to develop new IT risk scenarios to guide its decisions. Which of the following would add the MOST value to the new risk scenarios? Here are the options. Option A. Audit findings. Option B. Expected losses. Option C. Cost-benefit analysis. Option D. Organizational threats. Pause the video now if you want time to think about the answer.
The correct answer is D. Organizational threats. Organizational threats add the most value to new risk scenarios because they represent the actual adversarial landscape and attack vectors specific to the new line of business. Understanding what threats the organization faces enables risk scenarios that are both realistic and actionable. Threat intelligence ensures the scenarios reflect genuine risks rather than theoretical possibilities, making them more valuable for strategic decision- making around the acquisition. Now, why are the other options incorrect? Option A is incorrect. Audit findings from historical operations may not apply to a new line of business with different risk profiles. Option B is incorrect. Expected losses are an output of risk analysis, not an input that drives scenario development. Option C is incorrect. Cost-benefit analysis is a financial evaluation tool that comes after scenarios are developed to assess mitigation options. Therefore, D, Organizational threats, is the correct answer.
Play from 1:49:48 Question 64. An organization has decided to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable. As a result of this decision, the risk associated with these new entries has been: Here are the options. Option A. accepted. Option B. mitigated. Option C. deferred. Option D. transferred. Pause the video now if you want time to think about the answer.
The correct answer is C. deferred. When an organization postpones assessment and treatment of risks due to unavailable stakeholders, this represents deferral, the intentional delay of risk response decisions to a future date. Deferral is distinct from acceptance (knowingly retaining risk) because the organization intends to address the risks once stakeholders are available, rather than deciding to permanently retain them. Now, why are the other options incorrect? Option A is incorrect. Acceptance is a permanent decision to retain risk; postponement implies future action, not permanent acceptance. Option B is incorrect. Mitigation requires active control implementation, not postponement. Option D is incorrect. Transfer involves shifting risk to a third party; postponement does neither transfer nor mitigate. Therefore, C, deferred, is the correct answer.
Play from 1:51:26 Question 65. Which of the following proposed benefits is MOST likely to influence senior management approval to reallocate budget for a new security initiative? Here are the options. Option A. Reduction in the number of incidents. Option B. Reduction in inherent risk. Option C. Reduction in residual risk. Option D. Reduction in the number of known vulnerabilities. Pause the video now if you want time to think about the answer.
The correct answer is C. Reduction in residual risk. Senior management is most influenced by reduction in residual risk because it demonstrates the practical, measurable outcome of the security investment after controls are implemented. Residual risk shows what threats actually remain to the organization following the mitigation effort, making it the most tangible and decision-relevant metric for budget allocation. Management cares about what risk the organization will face after spending the money, not theoretical reductions in inherent risk or vulnerability counts. Now, why are the other options incorrect? Option A is incorrect. Incident reduction is a lagging indicator and does not directly communicate the ongoing risk posture after the initiative is implemented. Option B is incorrect. Inherent risk reduction is theoretical and does not reflect the actual protection the initiative will provide; management cares about residual, not inherent, risk. Option D is incorrect. The number of known vulnerabilities is a technical metric that does not directly correlate with business risk or the value of risk reduction to senior management. Therefore, C, Reduction in residual risk, is the correct answer.
Play from 1:53:21 Question 66. An information security audit identified a risk resulting from the failure of an automated control. Who is responsible for ensuring the risk register is updated accordingly? Here are the options. Option A. The control owner. Option B. The audit manager. Option C. The risk practitioner. Option D. The risk owner. Pause the video now if you want time to think about the answer.
The correct answer is C. The risk practitioner. The risk practitioner is responsible for maintaining and updating the risk register based on audit findings and control assessments. When an audit identifies a failed control and its resulting risk, the risk practitioner must document and update the risk register to reflect this new information. The risk practitioner owns the process of risk identification, analysis, and documentation across the organization, making them the appropriate party to ensure the risk register accurately reflects audit findings. Now, why are the other options incorrect? Option A is incorrect. The control owner is responsible for implementing and maintaining controls, not for updating the risk register with audit findings. Option B is incorrect. The audit manager oversees the audit process but does not hold responsibility for maintaining the risk register. Option D is incorrect. The risk owner is accountable for managing a specific risk once identified, but the risk practitioner is responsible for the initial identification and register documentation. Therefore, C, The risk practitioner, is the correct answer.
Play from 1:55:14 Question 67. The acceptance of control costs that exceed risk exposure is MOST likely demonstrates: Here are the options. Option A. corporate culture alignment. Option B. corporate culture misalignment. Option C. low risk tolerance. Option D. high risk tolerance. Pause the video now if you want time to think about the answer.
The correct answer is B. corporate culture misalignment. When an organization accepts control costs that exceed risk exposure, this demonstrates corporate culture misalignment. A well-aligned risk culture would implement controls proportionate to the risk level, spending more on controls than the potential loss represents is wasteful and indicates the organization's culture does not properly align cost- benefit analysis with risk management principles. This is not about risk tolerance but about prudent resource allocation. Now, why are the other options incorrect? Option A is incorrect. Corporate culture alignment would result in proportionate control spending, not excessive spending. Option C is incorrect. Low risk tolerance would justify higher control spending, but the issue here is misalignment of how much to spend. Option D is incorrect. High risk tolerance would suggest lower control spending, not higher spending than risk exposure. Therefore, B, corporate culture misalignment, is the correct answer.
Play from 1:56:59 Question 68. Which of the following provides the MOST useful information to assess the magnitude of identified deficiencies in the IT control environment? Here are the options. Option A. Threat analysis results. Option B. Peer benchmarks. Option C. Business impact analysis (BIA) results. Option D. Internal audit reports. Pause the video now if you want time to think about the answer.
The correct answer is C. Business impact analysis (BIA) results. Business Impact Analysis (BIA) results provide the most useful information to assess the magnitude of identified deficiencies because BIA quantifies the potential business consequences, financial impact, and operational disruption resulting from control failures. This directly measures the severity and materiality of deficiencies in terms the organization understands. Now, why are the other options incorrect? Option A is incorrect. Threat analysis identifies potential threats but doesn't measure the actual impact of existing control deficiencies. Option B is incorrect. Peer benchmarks provide comparative context but don't measure the actual magnitude of impact specific to the organization's identified deficiencies. Option D is incorrect. Internal audit reports may identify deficiencies but don't inherently quantify their business impact or magnitude. Therefore, C, Business impact analysis (BIA) results, is the correct answer.
Play from 1:58:49 Question 69. Sensitive data has been lost after an employee inadvertently removed a file from the premises, in violation of organizational policy. Which of the following controls MOST likely failed? Here are the options. Option A. Background checks. Option B. Awareness training. Option C. User access. Option D. Policy management. Pause the video now if you want time to think about the answer.
The correct answer is C. User access. User access controls would regulate which employees can access and remove sensitive data from the premises. When an employee was able to inadvertently remove a file in violation of policy, this indicates that access controls, such as data loss prevention tools, file restrictions, or physical controls on removable media, failed to prevent the unauthorized removal. Now, why are the other options incorrect? Option A is incorrect. Background checks assess the trustworthiness of individuals but do not prevent the physical act of removing files. Option B is incorrect. Awareness training educates employees but cannot technically prevent the action if controls are not enforced through technical or physical means. Option D is incorrect. Policy management establishes the rule but does not enforce it; control failure refers to the enforcement mechanism, not the policy itself. Therefore, C, User access, is the correct answer.
Play from 2:00:30 Question 70. Automated code reviews to reduce the risk associated with web applications are MOST effective when performed: Here are the options. Option A. in the design phase. Option B. during pre-production testing. Option C. throughout development. Option D. once in the production environment. Pause the video now if you want time to think about the answer.
The correct answer is C. throughout development. Automated code reviews are most effective when performed throughout development because this enables continuous identification and remediation of vulnerabilities as code is written, preventing defects from accumulating and becoming more expensive to fix. Early and continuous detection is far more efficient than point-in-time reviews at later phases. Now, why are the other options incorrect? Option A is incorrect. Design phase reviews catch architectural issues but miss implementation-specific vulnerabilities that emerge during coding. Option B is incorrect. Pre-production testing occurs too late to catch many issues early and limits opportunities for cost-effective remediation. Option D is incorrect. Production environment reviews are reactive and defeat the purpose of risk mitigation; production exposure is unacceptable. Therefore, C, throughout development, is the correct answer.
Play from 2:02:12 Question 71. Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure? Here are the options. Option A. Comparison against best practice. Option B. Relevance to the business process. Option C. Regulatory compliance requirements. Option D. Cost-benefit analysis. Pause the video now if you want time to think about the answer.
The correct answer is D. Cost-benefit analysis. Cost-benefit analysis is the most important factor because it ensures that the resources invested in a control produce value proportional to the risk reduction achieved. While best practices, business relevance, and regulatory compliance are all important considerations, the cost-benefit analysis determines whether the control is economically justifiable and efficient. A control that meets all other criteria but costs more than the risk it prevents is not a sound business decision. Now, why are the other options incorrect? Option A is incorrect. Best practices provide guidance but may not suit an organization's specific context, risk tolerance, or resource constraints. Option B is incorrect. Relevance to the business process is necessary but doesn't ensure the control is cost-effective or the best choice among alternatives. Option C is incorrect. Regulatory requirements are mandatory but do not guide the selection of additional controls beyond minimum compliance needs. Therefore, D, Cost-benefit analysis, is the correct answer.
Play from 2:04:01 Question 72. A financial institution has identified high risk of fraud in several business applications. Which of the following controls will BEST help reduce the risk of fraudulent internal transactions? Here are the options. Option A. Segregation of duties. Option B. Periodic internal audits. Option C. Log monitoring. Option D. Periodic user privileges review. Pause the video now if you want time to think about the answer.
The correct answer is A. Segregation of duties. Segregation of duties is the most effective preventive control against fraudulent internal transactions because it ensures no single individual can execute a complete fraudulent transaction without detection or collusion. It requires multiple people to be involved in key processes, making unauthorized or fraudulent activities much harder to accomplish. While audits, log monitoring, and privilege reviews are detective or monitoring controls that identify fraud after it occurs, segregation of duties prevents it from happening in the first place. Now, why are the other options incorrect? Option B is incorrect. Periodic internal audits are detective controls that identify fraud after it has occurred, not preventive controls that reduce the likelihood of fraud. Option C is incorrect. Log monitoring is a detective control that identifies suspicious activity but does not prevent fraudulent transactions from being initiated. Option D is incorrect. Privilege reviews help manage access but do not inherently prevent a single authorized user from committing fraud within their approved scope. Therefore, A, Segregation of duties, is the correct answer.
Play from 2:06:04 Question 73. Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk? Here are the options. Option A. Risk ratings may be inconsistently applied. Option B. Accountability may not be clearly defined. Option C. Different risk taxonomies may be used. Option D. Mitigation efforts may be duplicated. Pause the video now if you want time to think about the answer.
The correct answer is B. Accountability may not be clearly defined. When multiple risk owners are assigned to a single risk, the most critical concern is ensuring accountability is clearly defined. Without clear delineation of responsibilities, confusion arises about who is ultimately accountable for risk mitigation, monitoring, and reporting. This ambiguity can lead to gaps in oversight, delayed decisions, and ineffective risk management. Now, why are the other options incorrect? Option A is incorrect. Inconsistent rating application is possible but manageable with proper governance; accountability clarity is more fundamental. Option C is incorrect. Different taxonomies are an organizational process issue, not a direct consequence of multiple risk owners. Option D is incorrect. Duplication can occur but is secondary to the primary concern of unclear accountability. Therefore, B, Accountability may not be clearly defined, is the correct answer.
Play from 2:07:46 Question 74. An organization uses an automated vulnerability scanner to identify potential vulnerabilities on various enterprise systems. Who is accountable for ensuring the vulnerabilities are mitigated? Here are the options. Option A. System administrators. Option B. Data owners. Option C. System owners. Option D. Information security manager. Pause the video now if you want time to think about the answer.
The correct answer is C. System owners. System owners are ultimately accountable for ensuring vulnerabilities identified on systems they own are mitigated. While system administrators may perform the technical remediation work and information security managers may coordinate vulnerability management programs, the system owner bears the responsibility for the security posture of their systems and must ensure identified vulnerabilities are addressed within acceptable timeframes. Now, why are the other options incorrect? Option A is incorrect. System administrators execute the remediation but lack the authority and accountability for overall system security decisions. Option B is incorrect. Data owners are responsible for the data itself, not the systems on which it resides. Option D is incorrect. Information security managers oversee the program and policy but do not own individual systems. Therefore, C, System owners, is the correct answer.
Play from 2:09:27 Question 75. Which of the following is the BEST indicator of the effectiveness of a control? Here are the options. Option A. Number of steps necessary to operate process. Option B. Scope of the control coverage. Option C. Number of control deviations detected. Option D. The number of exceptions granted. Pause the video now if you want time to think about the answer.
The correct answer is C. Number of control deviations detected. The number of control deviations detected directly measures how well a control is functioning in practice. Deviations indicate failures to operate as designed, and fewer deviations demonstrate greater effectiveness. The number of steps (A) relates to efficiency, not effectiveness. Scope of coverage (B) shows breadth but not quality of operation. Exceptions granted (D) reflect control flexibility but not operational performance. Now, why are the other options incorrect? Option A is incorrect. Number of steps relates to control efficiency and complexity, not effectiveness. Option B is incorrect. Scope of coverage indicates range but not how well the control actually operates. Option D is incorrect. Exceptions reflect management's discretion but not the control's actual performance against its design. Therefore, C, Number of control deviations detected, is the correct answer.
Play from 2:11:15 Question 76. Which of the following is MOST likely to result in a major change to the overall risk profile of the organization? Here are the options. Option A. Changes in internal and external auditors. Option B. Changes in vulnerability assessment and penetration testing. Option C. Changes in risk appetite and risk tolerance. Option D. Changes in internal and external risk factors. Pause the video now if you want time to think about the answer.
The correct answer is D. Changes in internal and external risk factors. Changes in internal and external risk factors directly reshape the organization's exposure landscape. External factors like regulatory changes, economic shifts, or emerging threats, combined with internal factors like business model changes or resource availability, fundamentally alter what risks the organization faces. Changes in auditors (A) involve personnel but not risk factors; assessment methodologies (B) are tools that measure risk but don't change actual risk; risk appetite/tolerance (C) affects how risk is managed but not the underlying risk profile itself. Now, why are the other options incorrect? Option A is incorrect. Changing auditors is an administrative change that does not alter the organization's actual risk exposure. Option B is incorrect. Changing assessment methods measures risk differently but does not change the underlying risk factors themselves. Option C is incorrect. Risk appetite and tolerance are organizational preferences for managing known risks, not changes to the risk environment itself. Therefore, D, Changes in internal and external risk factors, is the correct answer.
Play from 2:13:18 Question 77. Which of the following is the BEST way to protect sensitive data from administrators within a public cloud? Here are the options. Option A. Encrypt the data in the cloud database. Option B. Use an encrypted tunnel to connect to the cloud. Option C. Encrypt data before it leaves the organization. Option D. Encrypt physical hard drives within the cloud. Pause the video now if you want time to think about the answer.
The correct answer is C. Encrypt data before it leaves the organization. Encrypting data before it leaves the organization (client-side encryption) is the best protection against unauthorized access by cloud administrators because the encryption keys remain under the organization's control. The data is encrypted at the source before transmission, ensuring that even cloud administrators and infrastructure personnel cannot access the plaintext data. This approach protects against insider threats and provides defense in depth. Now, why are the other options incorrect? Option A is incorrect. Encrypting data in the cloud database still allows cloud administrators access to keys if key management is handled by the provider. Option B is incorrect. An encrypted tunnel only protects data in transit, not at rest, and does not prevent administrators with database access from viewing decrypted data. Option D is incorrect. Encrypting physical hard drives does not prevent logical access by administrators who have credentials to decrypt and access the data. Therefore, C, Encrypt data before it leaves the organization, is the correct answer.
Play from 2:15:16 Question 78. Management has determined that it will take significant time to remediate exposures in the current IT control environment. Which of the following is the BEST course of action? Here are the options. Option A. Reassess the risk periodically. Option B. Improve project management methodology. Option C. Implement control monitoring. Option D. Identify compensating controls. Pause the video now if you want time to think about the answer.
The correct answer is D. Identify compensating controls. When remediation will take significant time, compensating controls should be implemented to mitigate the risk in the interim. Compensating controls provide alternative protection while the organization works toward remediating the underlying exposures. This is a proactive risk management response rather than simply monitoring or reassessing existing gaps. Now, why are the other options incorrect? Option A is incorrect. Periodic reassessment acknowledges the problem but doesn't address the current risk exposure. Option B is incorrect. Improving project management may help with the remediation timeline but doesn't reduce current risk. Option C is incorrect. Control monitoring tracks what exists but doesn't reduce the risk posed by the current exposures. Therefore, D, Identify compensating controls, is the correct answer.
Play from 2:16:54 Question 79. Which of the following is the result of a realized risk scenario? Here are the options. Option A. Threat event. Option B. Technical event. Option C. Loss event. Option D. Vulnerability event. Pause the video now if you want time to think about the answer.
The correct answer is C. Loss event. A loss event is the realized outcome when a risk scenario actually occurs. It represents the tangible impact or consequence that materializes when a threat exploits a vulnerability. A realized risk scenario by definition results in an actual loss or negative impact, which is precisely what a loss event represents in risk management terminology. Now, why are the other options incorrect? Option A is incorrect. A threat event is the occurrence of a threat, but a realized risk requires the threat to exploit a vulnerability and cause actual impact. Option B is incorrect. A technical event is not standard risk management terminology for describing the outcome of realized risks. Option D is incorrect. A vulnerability event is not a standard term; vulnerabilities are conditions, not events, and a realized risk results in a loss, not merely a vulnerability exposure. Therefore, C, Loss event, is the correct answer.
Play from 2:18:32 Question 80. Which of the following should be the PRIMARY basis for the development of an IT risk scenario? Here are the options. Option A. IT risk registers. Option B. IT objectives. Option C. IT risk owner input. Option D. IT threats and vulnerabilities. Pause the video now if you want time to think about the answer.
The correct answer is D. IT threats and vulnerabilities. IT threats and vulnerabilities form the primary basis for developing risk scenarios because a scenario must describe how a threat exploits a vulnerability to impact the organization. This threat-vulnerability pairing is the foundational element that makes a scenario realistic and relevant, whereas other inputs are secondary refinements. Now, why are the other options incorrect? Option A is incorrect. Risk registers document existing scenarios but are not the primary basis for developing new ones. Option B is incorrect. IT objectives provide context for impact assessment but do not generate the threat-vulnerability combinations that define scenarios. Option C is incorrect. Risk owner input is valuable for scenario validation and refinement but is not the primary basis for initial scenario identification. Therefore, D, IT threats and vulnerabilities, is the correct answer.
Play from 2:20:11 Question 81. Which of the following is the PRIMARY reason for an organization to include an acceptable use banner when users log in? Here are the options. Option A. To enable rapid discovery of insider threat. Option B. To reduce the likelihood of insider threat. Option C. To eliminate the possibility of insider threat. Option D. To reduce the impact of insider threat. Pause the video now if you want time to think about the answer.
The correct answer is B. To reduce the likelihood of insider threat. An acceptable use banner serves as a preventive control by making users aware of expectations and consequences before they log in, thereby reducing the likelihood of insider threats. While it cannot eliminate threats entirely or enable discovery of threats already occurring, its primary purpose is deterrence, influencing user behavior by establishing clear boundaries and demonstrating that the organization is monitoring compliance. Now, why are the other options incorrect? Option A is incorrect. Banners are preventive, not detective controls; they do not enable discovery of insider threats. Option C is incorrect. No control can eliminate the possibility of insider threat; this is unrealistic language that overstates the banner's capability. Option D is incorrect. Reducing impact is a secondary benefit; the primary purpose is prevention through awareness and behavioral modification. Therefore, B, To reduce the likelihood of insider threat, is the correct answer.
Play from 2:21:58 Question 82. Risk mitigation is MOST effective when which of the following is optimized? Here are the options. Option A. Inherent risk. Option B. Residual risk. Option C. Operational risk. Option D. Regulatory risk. Pause the video now if you want time to think about the answer.
The correct answer is B. Residual risk. Risk mitigation is most effective when residual risk is optimized (minimized to an acceptable level). Residual risk is the risk that remains after controls are implemented. The goal of mitigation is to reduce inherent risk through controls until the residual risk falls within the organization's risk tolerance. Therefore, optimizing residual risk is the direct measure of mitigation effectiveness. Now, why are the other options incorrect? Option A is incorrect. Inherent risk is the baseline risk before controls; mitigation does not optimize inherent risk but rather transforms it into residual risk. Option C is incorrect. Operational risk is a category of risk but not the specific metric that determines mitigation effectiveness. Option D is incorrect. Regulatory risk is a type of risk but is not the specific optimization target for assessing mitigation effectiveness. Therefore, B, Residual risk, is the correct answer.
Play from 2:23:31 Question 83. Which of the following is the PRIMARY reason to perform ongoing risk assessments? Here are the options. Option A. The risk environment is subject to change. Option B. The information security budget must be justified. Option C. Emerging risk must be continuously reported to management. Option D. New system vulnerabilities emerge at frequent intervals. Pause the video now if you want time to think about the answer.
The correct answer is A. The risk environment is subject to change. The primary reason to perform ongoing risk assessments is that the risk environment is constantly subject to change, new threats emerge, systems evolve, business objectives shift, and vulnerabilities are discovered. Ongoing assessments ensure that risk management remains current and relevant. While budget justification, emerging risk reporting, and vulnerability discovery are related benefits, they all stem from the fundamental fact that risks change over time and must be continuously re-evaluated. Now, why are the other options incorrect? Option B is incorrect. Budget justification, while important, is a secondary benefit derived from risk assessments, not the primary reason for conducting them. Option C is incorrect. Continuous reporting of emerging risks is a consequence of ongoing assessment, not the primary driver for conducting assessments. Option D is incorrect. While vulnerabilities do emerge frequently, this is only one aspect of the changing risk environment; risks change due to many factors beyond just technical vulnerabilities. Therefore, A, The risk environment is subject to change, is the correct answer.
Play from 2:25:30 Question 84. You are the project manager in your enterprise. You have identified risk that is noticeable failure threatening the success of certain goals of your enterprise. In which of the following levels do this identified risk exists? Here are the options. Option A. Moderate risk. Option B. High risk. Option C. Extremely high risk. Option D. Low risk. Pause the video now if you want time to think about the answer.
The correct answer is B. High risk. A risk that represents a noticeable failure threatening the success of certain goals of the enterprise is classified as a high risk. The description indicates a significant threat to enterprise objectives with a notable impact, which aligns with the definition of high-risk level, risks that could substantially compromise project or enterprise success if they occur. Now, why are the other options incorrect? Option A is incorrect. Moderate risk would not represent a noticeable failure threatening success; it would be less severe. Option C is incorrect. Extremely high risk would suggest an existential threat to the entire enterprise, not just certain goals. Option D is incorrect. Low risk would not threaten the success of goals in any noticeable way. Therefore, B, High risk, is the correct answer.
Play from 2:27:07 Question 85. Marie has identified a risk event in her project that needs a mitigation response. Her response actually creates a new risk event that must now be analyzed and planned for. What term is given to this newly created risk event? Here are the options. Option A. Residual risk. Option B. Secondary risk. Option C. Infinitive risk. Option D. Populated risk. Pause the video now if you want time to think about the answer.
The correct answer is B. Secondary risk. A secondary risk is a new risk that emerges as a direct result of implementing a risk response to an original risk. When Marie implements a mitigation response to address an identified risk, that response action itself can create or introduce new risks. These newly created risks are classified as secondary risks and must be identified, analyzed, and managed through the same risk management processes as the original risks. This is a standard concept in risk management where solutions can inadvertently create new problems. Now, why are the other options incorrect? Option A is incorrect. Residual risk refers to the risk remaining after implementing a response strategy, not a new risk created by the response. Option C is incorrect. Infinitive risk is not a recognized term in standard risk management terminology. Option D is incorrect. Populated risk is not a recognized risk management term. Therefore, B, Secondary risk, is the correct answer.
Play from 2:28:52 Question 86. Which of the following is the BEST way to determine the ongoing efficiency of control processes? Here are the options. Option A. Interview process owners. Option B. Review the risk register. Option C. Perform annual risk assessments. Option D. Analyze key performance indicators (KPIs). Pause the video now if you want time to think about the answer.
The correct answer is D. Analyze key performance indicators (KPIs). Analyzing Key Performance Indicators (KPIs) is the BEST way to determine ongoing control process efficiency because KPIs are specifically designed metrics that measure performance against objectives. They provide quantifiable, data-driven evidence of how well controls are functioning over time. Interviews (A) are subjective, risk registers (B) document risks rather than control efficiency, and annual risk assessments (C) are periodic snapshots rather than ongoing measurement tools. Now, why are the other options incorrect? Option A is incorrect. Interviews are subjective and not the best method for determining ongoing efficiency; they provide anecdotal rather than systematic data. Option B is incorrect. Risk registers document identified risks but do not measure control process efficiency metrics. Option C is incorrect. Annual risk assessments are periodic reviews, not continuous monitoring of control process efficiency. Therefore, D, Analyze key performance indicators (KPIs), is the correct answer.
Play from 2:30:48 Question 87. To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the: Here are the options. Option A. risk assessment results. Option B. cost-benefit analysis. Option C. vulnerability assessment results. Option D. risk mitigation approach. Pause the video now if you want time to think about the answer.
The correct answer is A. risk assessment results. To ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the risk assessment results. The risk assessment process systematically identifies, analyzes, and evaluates risks across the organization. These documented results are the comprehensive source of all identified risks and should drive the risk register's contents, ensuring completeness and accuracy. Now, why are the other options incorrect? Option B is incorrect. Cost-benefit analysis is used for mitigation decisions, not for identifying what risks exist. Option C is incorrect. Vulnerability assessments identify technical weaknesses but represent only one category of risk and miss business, operational, and strategic risks. Option D is incorrect. The mitigation approach addresses how to handle identified risks, not what risks should be included in the register. Therefore, A, risk assessment results, is the correct answer.
Play from 2:32:34 Question 88. An organization wants to launch a campaign to advertise a new product. Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST concern to the risk practitioner? Here are the options. Option A. Purpose limitation. Option B. Data minimization. Option C. Accuracy. Option D. Accountability. Pause the video now if you want time to think about the answer.
The correct answer is B. Data minimization. Data minimization is the greatest concern because the organization should only collect and use the minimum amount of personal data necessary for the specific campaign purpose. Using data analytics to target customers based on extensive customer data raises data privacy risks that should be evaluated against the principle of collecting only what is needed. Purpose limitation, accuracy, and accountability are important, but data minimization directly addresses whether the organization is justifying the collection of personal data in the first place. Now, why are the other options incorrect? Option A is incorrect. Purpose limitation is important but assumes the data collection itself is justified. Option C is incorrect. Accuracy of targeting data is secondary to whether such extensive data should be collected at all. Option D is incorrect. Accountability mechanisms address governance but don't address whether data minimization principles are followed. Therefore, B, Data minimization, is the correct answer.
Play from 2:34:32 Question 89. The risk associated with an asset before controls are applied can be expressed as: Here are the options. Option A. the likelihood of a given threat. Option B. the magnitude of an impact. Option C. a function of the likelihood and impact. Option D. a function of the cost and effectiveness of controls. Pause the video now if you want time to think about the answer.
The correct answer is C. a function of the likelihood and impact. Inherent risk (the risk before controls are applied) is expressed as a function of the likelihood and impact. This is the fundamental risk equation: Risk = Likelihood × Impact. Both the probability that a threat will occur and the severity of consequences must be considered together to understand the true risk exposure before any controls mitigate it. Now, why are the other options incorrect? Option A is incorrect. Likelihood alone does not capture the full risk; impact severity must also be considered. Option B is incorrect. Impact alone does not capture the full risk; the probability of occurrence must also be considered. Option D is incorrect. Control costs and effectiveness are applied after inherent risk is determined; they calculate residual risk, not inherent risk. Therefore, C, a function of the likelihood and impact, is the correct answer.
Play from 2:36:16 Question 90. Who should be responsible for determining which stakeholders need to be involved in the development of a risk scenario? Here are the options. Option A. Risk owner. Option B. Control owner. Option C. Compliance manager. Option D. Risk practitioner. Pause the video now if you want time to think about the answer.
The correct answer is D. Risk practitioner. The risk practitioner should determine which stakeholders are needed for risk scenario development. Risk practitioners have the expertise in risk methodology and scenario analysis to identify all relevant perspectives (operational, business, technical, compliance) needed for comprehensive scenarios. They coordinate stakeholder involvement across the organization. Now, why are the other options incorrect? Option A is incorrect. The risk owner has accountability for the risk but not necessarily the methodological expertise to determine appropriate scenario stakeholders. Option B is incorrect. Control owners focus on specific control effectiveness, not the broader stakeholder identification for scenario development. Option C is incorrect. Compliance managers represent one stakeholder perspective but should not unilaterally determine all scenario participant needs. Therefore, D, Risk practitioner, is the correct answer.
Play from 2:37:52 Question 91. After identifying new risk events during a project, the project manager's NEXT step should be to: Here are the options. Option A. continue with a quantitative risk analysis. Option B. determine if the scenarios need to be accepted or responded to. Option C. continue with a qualitative risk analysis. Option D. record the scenarios into the risk register. Pause the video now if you want time to think about the answer.
The correct answer is D. record the scenarios into the risk register. After identifying new risk events, the immediate next step is to formally document them in the risk register. This creates an official record and baseline for all subsequent risk management activities. Recording the scenarios is the foundational step that must occur before analysis, response planning, or acceptance decisions can be properly made and tracked. Now, why are the other options incorrect? Option A is incorrect. Quantitative analysis comes after qualitative analysis and only for risks deemed significant enough to warrant detailed quantification. Option B is incorrect. Determining acceptance or response strategies occurs after analysis, not immediately after identification. Option C is incorrect. Qualitative risk analysis follows documentation in the risk register, not before it. Therefore, D, record the scenarios into the risk register, is the correct answer.
Play from 2:39:39 Question 92. Which of the following is the MOST important requirement for monitoring key risk indicators (KRIs) using log analysis? Here are the options. Option A. Collecting logs from the entire set of IT systems. Option B. Providing accurate logs in a timely manner. Option C. Implementing an automated log analysis tool. Option D. Obtaining logs in an easily readable format. Pause the video now if you want time to think about the answer.
The correct answer is B. Providing accurate logs in a timely manner. Providing accurate logs in a timely manner is the most critical requirement because KRI monitoring depends on reliable, current data to detect emerging risks. Without accurate and timely logs, the entire monitoring system becomes ineffective, false positives waste resources while missed indicators fail to warn of actual risks. Accuracy and timeliness are foundational to any effective KRI monitoring program. Now, why are the other options incorrect? Option A is incorrect. While comprehensive log collection is important, KRIs can be effectively monitored from a targeted set of relevant systems rather than requiring logs from every system. Option C is incorrect. An automated tool is helpful for efficiency but is not strictly required if manual log analysis provides accurate and timely results. Option D is incorrect. Readable format aids human interpretation but automated KRI monitoring can work with any structured log format, making this secondary to accuracy and timeliness. Therefore, B, Providing accurate logs in a timely manner, is the correct answer.
Play from 2:41:41 Question 93. Who is BEST suited to own an IT risk scenario in an organization where only one IT support person knows how to maintain a core business application? Here are the options. Option A. Business owner. Option B. IT manager. Option C. Application business analyst. Option D. Risk manager. Pause the video now if you want time to think about the answer.
The correct answer is A. Business owner. The business owner is best suited to own IT risk scenarios because they are responsible for the business processes and outcomes that depend on IT systems. While the IT manager understands the technical aspects and the application business analyst knows the system details, the business owner has accountability for the business impact if the application fails. In this case, the business owner must manage the risk of having only one person who knows how to maintain a critical application by implementing cross-training, documentation, or redundancy measures. Now, why are the other options incorrect? Option B is incorrect. IT managers handle IT operations but lack ultimate business accountability for the risk's impact. Option C is incorrect. Application business analysts understand requirements but do not own overall business risk accountability. Option D is incorrect. Risk managers facilitate and coordinate risk management but do not own individual business risks. Therefore, A, Business owner, is the correct answer.
Play from 2:43:32 Question 94. Which of the following provides the MOST useful information when assessing whether an organization has appropriately managed its level of risk compared to its established risk appetite? Here are the options. Option A. Risk velocity. Option B. Residual risk. Option C. Inherent risk. Option D. Risk trend. Pause the video now if you want time to think about the answer.
The correct answer is B. Residual risk. Residual risk is the risk remaining after controls and mitigation strategies have been applied. It directly measures whether an organization's actual risk exposure aligns with its established risk appetite. By comparing residual risk to risk appetite, management can assess if the organization has appropriately managed its risk position. Inherent risk shows pre-control exposure, risk velocity measures speed of change, and risk trend shows direction, none directly answer whether risk is aligned with appetite. Now, why are the other options incorrect? Option A is incorrect. Risk velocity measures how quickly risk is changing but does not indicate whether current risk levels match organizational appetite. Option C is incorrect. Inherent risk reflects risk before controls are applied and does not account for the organization's mitigation efforts or risk appetite alignment. Option D is incorrect. Risk trend shows the direction of risk movement but does not directly measure whether the organization's risk position matches its established appetite. Therefore, B, Residual risk, is the correct answer.
Play from 2:45:20 Question 95. Which of the following is the BEST way to identify changes to the risk landscape? Here are the options. Option A. Access reviews. Option B. Root cause analysis. Option C. Internal audit reports. Option D. Threat modeling. Pause the video now if you want time to think about the answer.
The correct answer is D. Threat modeling. Threat modeling is the best method for identifying changes to the risk landscape because it systematically and comprehensively identifies potential new threats, vulnerabilities, and attack vectors by analyzing systems, assets, and threat actors. It provides a structured, forward-looking approach that can uncover emerging risks. Access reviews identify access-related issues, root cause analysis addresses past incidents, and audit reports document current-state findings, but none of these proactively identify emerging changes in the risk landscape as effectively as threat modeling. Now, why are the other options incorrect? Option A is incorrect. Access reviews focus specifically on user access rights and do not comprehensively identify changes to the broader risk landscape. Option B is incorrect. Root cause analysis examines what happened in past incidents but is reactive, not proactive in identifying emerging risk landscape changes. Option C is incorrect. Internal audit reports document findings about current state but do not systematically model future threats and landscape changes. Therefore, D, Threat modeling, is the correct answer.
Play from 2:47:15 Question 96. Which of the following provides the BEST assurance of the effectiveness of internal controls? Here are the options. Option A. Balanced scorecard review. Option B. Control self-assessments (CSAs). Option C. Compliance training metrics. Option D. Continuous monitoring. Pause the video now if you want time to think about the answer.
The correct answer is D. Continuous monitoring. Continuous monitoring provides real-time, ongoing assessment of whether controls are operating as designed across changing business conditions and threats. This approach detects control breakdowns and ineffectiveness promptly, providing the best assurance of sustained control effectiveness. While control self-assessments, compliance training, and balanced scorecards contribute to control environments, continuous monitoring is the only mechanism that provides persistent, objective evidence of whether controls actually function effectively over time. Now, why are the other options incorrect? Option A is incorrect. Balanced scorecards measure organizational performance metrics but don't specifically assure internal control effectiveness. Option B is incorrect. Control self-assessments rely on process owners' subjective evaluations and lack the objectivity and continuity of monitoring. Option C is incorrect. Compliance training metrics measure training completion but don't directly assess whether resulting controls operate effectively. Therefore, D, Continuous monitoring, is the correct answer.
Play from 2:49:05 Question 97. In order to efficiently execute a risk response action plan, it is MOST important for the emergency response team members to understand: Here are the options. Option A. system architecture in target areas. Option B. business objectives of the organization. Option C. defined roles and responsibilities. Option D. IT management policies and procedures. Pause the video now if you want time to think about the answer.
The correct answer is C. defined roles and responsibilities. Clearly defined roles and responsibilities ensure coordinated, efficient response execution because team members understand their specific duties and decision authorities without confusion or overlap. This prevents delays, duplication of effort, and gaps in response execution, which are critical for efficient plan implementation under pressure. Now, why are the other options incorrect? Option A is incorrect. System architecture knowledge is important for technical execution but does not directly enable efficient plan execution. Option B is incorrect. Business objectives provide strategic context but do not ensure operational efficiency of response actions. Option D is incorrect. IT policies and procedures are reference materials but less critical than understanding one's own role and responsibility in the response. Therefore, C, defined roles and responsibilities, is the correct answer.
Play from 2:50:54 Question 98. Which of the following IT controls is MOST useful in mitigating the risk associated with inaccurate data? Here are the options. Option A. Audit trails for updates and deletions. Option B. Encrypted storage of data. Option C. Links to source data. Option D. Check totals on data records and data fields. Pause the video now if you want time to think about the answer.
The correct answer is D. Check totals on data records and data fields. Inaccurate data results from errors in data entry, processing, or storage. Check totals (hash totals, record counts) and field-level validations directly detect and prevent inaccurate data by verifying completeness and correctness at the point of entry or processing. Audit trails (A) record what happened but do not prevent inaccuracy. Encrypted storage (B) protects data confidentiality but does not ensure accuracy. Links to source data (C) enable traceability but do not validate whether data itself is accurate. Now, why are the other options incorrect? Option A is incorrect. Audit trails detect unauthorized changes but do not prevent inaccurate data entry or calculation errors. Option B is incorrect. Encryption protects data confidentiality and integrity in transit/storage but does not prevent inaccurate values. Option C is incorrect. Source data links enable traceability and reconciliation but do not validate that data values themselves are correct. Therefore, D, Check totals on data records and data fields, is the correct answer.
Play from 2:52:50 Question 99. Optimized risk management is achieved when risk is reduced: Here are the options. Option A. with strategic initiatives. Option B. within resource availability. Option C. below risk appetite. Option D. to meet risk appetite. Pause the video now if you want time to think about the answer.
The correct answer is D. to meet risk appetite. Optimized risk management aligns actual risk levels with the organization's risk appetite, the level of risk the organization is willing to accept. Risk should be reduced to meet (not below) this appetite, as reducing risk beyond appetite wastes resources. Strategic initiatives (A) and resource availability (B) are constraints or methods, not the optimization goal. Risk appetite is the target, not a floor to go beneath. Now, why are the other options incorrect? Option A is incorrect. Strategic initiatives are tools to manage risk, not the definition of optimization. Option B is incorrect. Resource availability is a constraint on how much risk can be reduced, not the optimization objective. Option C is incorrect. Reducing risk below appetite is wasteful; optimization targets meeting appetite, not exceeding it. Therefore, D, to meet risk appetite, is the correct answer.
Play from 2:54:30 Question 100. You are the project manager of the HGT project in Bluewell Inc. The project has an asset valued at $125,000 and is subjected to an exposure factor of 25 percent. What will be the Single Loss Expectancy of this project? Here are the options. Option A. $ 125,025. Option B. $ 31,250. Option C. $ 5,000. Option D. $ 3,125,000. Pause the video now if you want time to think about the answer.
The correct answer is B. $ 31,250. Single Loss Expectancy (SLE) is calculated using the formula: SLE = Asset Value × Exposure Factor. In this case: SLE = $125,000 × 0.25 = $31,250. The exposure factor of 25% represents the percentage of the asset value that would be lost in a single loss event, resulting in a SLE of $31,250. Now, why are the other options incorrect? Option A is incorrect. This result appears to add the exposure factor value rather than multiply it, which is not the correct SLE formula. Option C is incorrect. This calculation is incorrect and does not reflect the proper application of the SLE formula. Option D is incorrect. This result incorrectly multiplies the asset value by 25,000 instead of applying the 25% exposure factor correctly. Therefore, B, $ 31,250, is the correct answer.
