Which of the following is the PRIMARY reason to establish the root cause of an IT security incident?

• A.Prepare a report for senior management.
• B.Assign responsibility and accountability for the incident.
• C.Avoid recurrence of the incident.
• D.Update the risk register.

Comment: *

Name: *

Email: *

Verification: *

Which of the following BEST illustrates the relationship of actual risk exposure to appetite?

• A.Residual risk that exceeds appetite.
• B.Risk events in the risk profile.
• C.Percentage of high risk scenarios.
• D.Controls that exceed risk appetite.

Comment: *

Name: *

Email: *

Verification: *

NIST SP 800-53 identifies controls in three primary classes. What are they?

• A.Technical, Administrative, and Environmental
• B.Preventative, Detective, and Corrective
• C.Technical, Operational, and Management
• D.Administrative, Technical, and Operational

Comment: *

Name: *

Email: *

Verification: *

Which of the following is MOST important for maintaining the effectiveness of an IT risk register?

• A.Recording and tracking the status of risk response plans within the register.
• B.Communicating the register to key stakeholders.
• C.Performing regular reviews and updates to the register.
• D.Removing entries from the register after the risk has been treated.

Comment: *

Name: *

Email: *

Verification: *

Judy has identified a risk event in her project that will have a high probability and a high impact. Based on the requirements of the project, Judy has asked to change the project scope to remove the associated requirement and the associated risk. What type of risk response is this?

• A.Exploit
• B.Not a risk response, but a change request
• C.Avoidance
• D.Transference

Comment: *

Name: *

Email: *

Verification: *