An organization is considering outsourcing user administration controls for a critical system. The potential vendor has offered to perform quarterly self-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to the risk practitioner?

• A.The vendor will not achieve best practices
• B.Lack of a risk-based approach to access control
• C.The controls may not be properly tested
• D.The vendor will not ensure against control failure

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the priority of data owners when establishing risk mitigation method?

• A.User entitlement changes
• B.Platform security
• C.Intrusion detection
• D.Antivirus controls

Comment: *

Name: *

Email: *

Verification: *

Harry is the project manager of HDW project. He has identified a risk that could injure project team members. He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?

• A.Transference
• B.Mitigation
• C.Acceptance
• D.Avoidance

Comment: *

Name: *

Email: *

Verification: *

The number of tickets to rework application code has significantly exceeded the established threshold.
Which of the following would be the risk practitioner's BEST recommendation?

• A.Implement training on coding best practices
• B.Perform a code review
• C.Implement version control software
• D.Perform a root cause analysis

Comment: *

Name: *

Email: *

Verification: *

Which of the following data would be used when performing a business impact analysis (BIA)?

• A.Cost of regulatory compliance
• B.Expected costs for recovering the business
• C.Cost-benefit analysis of running the current business
• D.Projected impact of current business on future business

Comment: *

Name: *

Email: *

Verification: *