What is the BEST information to present to business control owners when justifying costs related to controls?

• A.Return on IT security-related investments
• B.The previous year's budget and actuals
• C.Industry benchmarks and standards
• D.Loss event frequency and magnitude

Comment: *

Name: *

Email: *

Verification: *

A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?

• A.Transference
• B.Mitigation
• C.Avoidance
• D.Exploit
• E.Explanation:
  When you are hiring a third party to own risk, it is known as transference risk response. Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.
• F.is incorrect. The act of spending money to reduce a risk probability and impact is known as mitigation.
• G.is incorrect. Exploit is a strategy that may be selected for risks with positive impacts
  where the organization wishes to ensure that the opportunity is realized.

Comment: *

Name: *

Email: *

Verification: *

Your project team has completed the quantitative risk analysis for your project work. Based on their findings, they need to update the risk register with several pieces of information. Which one of the following components is likely to be updated in the risk register based on their analysis?

• A.Listing of risk responses
• B.Risk ranking matrix
• C.Listing of prioritized risks
• D.Qualitative analysis outcomes
• E.Explanation:
  The outcome of quantitative analysis can create a listing of prioritized risks that should be updated
  in the risk register. The project team will create and update the risk register with fourkey
  components: probabilistic analysis of the project, probability of achieving time and cost objectives,
  list of quantified risks, and trends in quantitative risk analysis.

Comment: *

Name: *

Email: *

Verification: *

A risk practitioner is utilizing a risk heat map during a risk assessment. Risk events that are coded with the same color will have a similar:

• A.risk response
• B.risk likelihood.
• C.risk score
• D.risk impact

Comment: *

Name: *

Email: *

Verification: *

When determining which control deficiencies are most significant, which of the following would provide the MOST useful information?

• A.Risk analysis results
• B.Exception handling policy
• C.Vulnerability assessment results
• D.Benchmarking assessments

Comment: *

Name: *

Email: *

Verification: *