Which of the following is the PRIMARY reason for monitoring activities performed in a production database environment?

• A.Deterring illicit actions of database administrators
• B.Ensuring that database changes are correctly applied
• C.Preventing system developers from accessing production data
• D.Enforcing that changes are authorized

Comment: *

Name: *

Email: *

Verification: *

Which of the following would BEST help an enterprise define and communicate its risk appetite?

• A.Gap analysis
• B.Risk register
• C.Heat map
• D.Risk assessment

Comment: *

Name: *

Email: *

Verification: *

Which of the following items is considered as an objective of the three dimensional model within the framework described in COSO ERM?

• A.Risk assessment
• B.Financial reporting
• C.Control environment
• D.Monitoring

Correct Answer: B

Explanation/Reference:
Explanation:
The COSO ERM (Enterprise Risk Management) frame work is a 3-dimensional model. The dimensions and their components include:
Strategic Objectives - includes strategic, operations, reporting, and compliance.

Risk Components - includes Internal Environment, Objectives settings, Event identification, Risk

assessment, Risk response, Control activities, Information and communication, and monitoring.
Organizational Levels - include subsidiary, business unit, division, and entity-level.

The COSO ERM framework contains eight risk components:
Internal Environment

Objective Settings

Event Identification

Risk Assessment

Risk Response

Control Activities

Information and Communication

Monitoring

Section 404 of the Sarbanes-Oley act specifies a three dimensional model- COSO ERM, comprised of Internal control components, Internal control objectives, and organization entities. All the items listed are components except Financial reporting which is an internal control objective.
Incorrect Answers:
A, C, D: They are the Internal control components, not the Internal control objectives.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important consideration when identifying stakeholders to review risk scenarios developed by a risk analyst? The reviewers are:

• A.authorized to select risk mitigation options.
• B.independent from the business operations.
• C.accountable for the affected processes.
• D.members of senior management.

Comment: *

Name: *

Email: *

Verification: *

Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes' impact on the features and functions of the project's product?

• A.Cost change control system
• B.Configuration management system
• C.Scope change control system
• D.Integrated change control

Comment: *

Name: *

Email: *

Verification: *