Risk management strategies are PRIMARILY adopted to:

• A.achieve compliance with legal requirements
• B.take necessary precautions for claims and losses
• C.avoid risk for business and IT assets
• D.achieve acceptable residual risk levels

Comment: *

Name: *

Email: *

Verification: *

An organization has allowed its cyber risk insurance to lapse while seeking a new insurance provider. The risk practitioner should report to management that the risk has been:

• A.accepted
• B.mitigated
• C.transferred
• D.avoided

Comment: *

Name: *

Email: *

Verification: *

You work as a Project Manager for Company Inc. You have to conduct the risk management activities for a project. Which of the following inputs will you use in the plan risk management process?
Each correct answer represents a complete solution. (Choose three.)

• A.Quality management plan
• B.Schedule management plan
• C.Cost management plan
• D.Project scope statement

Correct Answer: B,C,D

Explanation/Reference:
Explanation:
The inputs to the plan risk management process are as follows:
Project scope statement: It provides a clear sense of the range of possibilities associated with the

project and establishes the framework for how significant the risk management effort may become.
Cost management plan: It describes how risk budgets, contingencies, and management reserves will

be reported and accessed.
Schedule management plan: It describes how the schedule contingencies will be reported and

assessed.
Communication management plan: It describes the interactions, which occurs on the project and

determines who will be available to share information on various risks and responses at different times.
Enterprise environmental factors: It include, but are not limited to, risk attitudes and tolerances that

describe the degree of risk that an organization withstand.
Organizational process assets: It includes, but are not limited to, risk categories, risk statement formats,

standard templates, roles and responsibilities, authority levels for decision-making, lessons learned, and stakeholder registers.
Incorrect Answers:
A: It is not an input for Plan risk management process.

Comment: *

Name: *

Email: *

Verification: *

Business areas within an organization have engaged various cloud service providers directly without assistance from the IT department. What should the risk practitioner do?

• A.Recommend a risk assessment be conducted.
• B.Engage with the business area managers to review controls applied.
• C.Recommend the IT department remove access to the cloud services.
• D.Escalate to the risk committee.

Comment: *

Name: *

Email: *

Verification: *

An organization is planning to engage a cloud-based service provider for some of its data-intensive business processes. Which of the following is MOST important to help define the IT risk associated with this outsourcing activity?

• A.Service level agreement
• B.Right to audit the provider
• C.Customer service reviews
• D.Scope of services provided

Comment: *

Name: *

Email: *

Verification: *