Who is BEST suited to determine whether a new control properly mitigates data loss risk within a system?

• A.System owner
• B.Control owner
• C.Risk owner
• D.Data owner

Comment: *

Name: *

Email: *

Verification: *

Which of the following is MOST important for an organization to have in place when developing a risk management framework?

• A.An organization-wide risk awareness training program
• B.A risk-based internal audit plan for the organization
• C.A strategic approach to risk including an established risk appetite
• D.A control function within the risk management team

Comment: *

Name: *

Email: *

Verification: *

To reduce costs, an organization is combining the second and third tines of defense in a new department that reports to a recently appointed C-level executive. Which of the following is the GREATEST concern with this situation?

• A.The risk governance approach of the second and third lines of defense may differ.
• B.Cost reductions may negatively impact the productivity of other departments.
• C.The new structure is not aligned to the organization's internal control framework.
• D.The independence of the internal third line of defense may be compromised.

Comment: *

Name: *

Email: *

Verification: *

What is the BEST information to present to business control owners when justifying costs related to controls?

• A.The previous year's budget and actuals
• B.Industry benchmarks and standards
• C.Loss event frequency and magnitude
• D.Return on IT security-related investments

Comment: *

Name: *

Email: *

Verification: *

Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?

• A.Updating multi-factor authentication
• B.Revising the service level agreement (SLA)
• C.Monitoring key access control performance indicators
• D.Analyzing access control logs for suspicious activity

Comment: *

Name: *

Email: *

Verification: *