Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?

• A.Cost versus benefit of additional mitigating controls
• B.Frequency of business impact
• C.Cost of the Information control system
• D.Annualized loss expectancy (ALE) for the system

Comment: *

Name: *

Email: *

Verification: *

Which of the following BEST helps to balance the costs and benefits of managing IT risk?

• A.Prioritizing risk responses
• B.Considering risk factors that can be quantified
• C.Evaluating risk based on frequency and probability
• D.Managing the risk by using controls

Comment: *

Name: *

Email: *

Verification: *

If one says that the particular control or monitoring tool is sustainable, then it refers to what ability?

• A.The ability to adapt as new elements are added to the environment
• B.The ability to ensure the control remains in place when it fails
• C.The ability to protect itself from exploitation or attack
• D.The ability to be applied in same manner throughout the organization
• E.Explanation:
  Sustainability of the controls or monitoring tools refers to its ability to function as expected over
  time or when changes are made to the environment.
• F.is incorrect. This is not valid definition for defining sustainability of al tool.
• G.is incorrect. Sustainability ensures that controls changes with the conditions, so as not
  to fail in any circumstances. Hence this in not valid answer.

Comment: *

Name: *

Email: *

Verification: *

A department has been granted an exception to bypass the existing approval process for purchase orders. The risk practitioner should verify the exception has been approved by which of the following?

• A.Senior management
• B.Internal audit
• C.Risk manager
• D.Control owner

Comment: *

Name: *

Email: *

Verification: *

An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?

• A.Process owner
• B.Internal auditor
• C.Risk manager
• D.Project sponsor

Comment: *

Name: *

Email: *

Verification: *