Which of the following aspects are included in the Internal Environment Framework of COSO ERM?
Each correct answer represents a complete solution. Choose three.

• A.Enterprise's integrity and ethical values
• B.Enterprise's working environment
• C.Enterprise's human resource standards
• D.Enterprise's risk appetite

Correct Answer: A,C,D

Explanation/Reference:
Explanation:
The internal environment for risk management is the foundational level of the COSO ERM framework, which describes the philosophical basics of managing risks within the implementing enterprise. The different aspects of the internal environment include the enterprise's:
Philosophy on risk management

Risk appetite

Attitudes of Board of Directors

Integrity and ethical values

Commitment to competence

Organizational structure

Authority and responsibility

Human resource standards

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GHT project. A risk event has occurred in your project and you have identified it. Which of the following tasks you would do in reaction to risk event occurrence? Each correct answer represents a part of the solution. Choose three.

• A.Monitor risk
• B.Maintain and initiate incident response plans
• C.Update risk register
• D.Communicate lessons learned from risk events

Correct Answer: A,B,D

Explanation/Reference:
Explanation:
When the risk events occur then following tasks have to done to react to it:
Maintain incident response plans

Monitor risk

Initiate incident response

Communicate lessons learned from risk events

Incorrect Answers:
C: Risk register is updated after applying appropriate risk response and at the time of risk event occurrence.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a detective control?

• A.Limit check
• B.Access control software
• C.Periodic access review
• D.Rerun procedures

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GHT project. You are performing cost and benefit analysis of control. You come across the result that costs of specific controls exceed the benefits of mitigating a given risk. What is the BEST action would you choose in this scenario?

• A.The enterprise may apply the appropriate control anyway.
• B.The enterprise should adopt corrective control.
• C.The enterprise may choose to accept the risk rather than incur the cost of mitigation.
• D.The enterprise should exploit the risk.
• E.Explanation:
  If the costs of specific controls or countermeasures (control overhead) exceed the benefits of
  mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of
  mitigation. This is done according to the principle of proportionality described in:
  Generally accepted security systems principles (GASSP)
  Generally accepted information security principles (GAISP)
• F.is incorrect. When the cost of specific controls exceed the benefits of mitigating a given
  risk, then controls are not applied, rather risk is being accepted.
• G.is incorrect. The risk is being exploited when there is an opportunity, i.e., the risk is
  positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot
  be done.

Comment: *

Name: *

Email: *

Verification: *

The risk associated with a high-risk vulnerability in an application is owned by the:

• A.vendor.
• B.business unit
• C.security department.
• D.IT department.

Comment: *

Name: *

Email: *

Verification: *