Which of the following resources is MOST helpful when creating a manageable set of IT risk scenarios?

• A.Internal and external audit findings
• B.Organizational strategy and objectives
• C.Lessons learned from materialized risk scenarios
• D.Results of current and past risk assessments

Comment: *

Name: *

Email: *

Verification: *

A control for mitigating risk in a key business area cannot be implemented immediately. Which of the following is the risk practitioner's BEST course of action when a compensating control needs to be applied?

• A.Record the risk as accepted in the risk register.
• B.Obtain the risk owner's approval.
• C.Inform senior management.
• D.Update the risk response plan.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true for risk analysis?

• A.Risk analysis should assume an equal degree of protection for all assets.
• B.Risk analysis should give more weight to the likelihood than the size of loss.
• C.Risk analysis should limit the scope to a benchmark of similar companies
• D.Risk analysis should address the potential size and likelihood of loss.

Comment: *

Name: *

Email: *

Verification: *

You are elected as the project manager of GHT project. You are in project initialization phase and are busy in defining requirements for your project. While defining requirements you are describing how users will interact with a system. Which of the following requirements are you defining here?

• A.Technical requirement
• B.Project requirement
• C.Functional requirement
• D.Business requirement
• E.Explanation:
  While defining requirements, there is need to define three requirements of the project- Business
  requirement, Functional requirement, and
  Technical requirement
  Functional requirements and use case models describe how users will interact with a system.
  Therefore here in this stem you are defining the functional requirement of the project.
• F.is incorrect. Business requirements contain descriptions of what a system should do.
• G.is incorrect. Technical requirements and design specifications and coding specifications
  describe how the system will interact, conditions under which the system will operate and the
  information criteria the system should meet.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of your enterprise. You have introduced an intrusion detection system for the control. You have identified a warning of violation of security policies of your enterprise. What type of control is an intrusion detection system (IDS)?

• A.Detective
• B.Corrective
• C.Preventative
• D.Recovery
• E.Explanation:
  An intrusion detection system (IDS) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPS for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. As IDS detects and gives warning when the violation of security policies of the enterprise occurs, it is a detective control.
• F.is incorrect. As IDS only detects the problem when it occurs and not prior of its occurrence, it is not preventive control. Answer: B is incorrect. These controls make effort to reduce the impact of a threat from problems discovered by detective controls.
  As IDS only detects but nt reduce the impact, hence it is not a corrective control.

Comment: *

Name: *

Email: *

Verification: *