IT-Risk-Fundamentals Practice Questions

A.  

criticality of I&T assets.

B.  

lost productivity.

C.  

reputational damage.

A.  

Threat mitigation

B.  

Report size

C.  

False positives

A.  

Understanding the impacts of the risk environment to the organization

B.  

Developing a top-down approach to risk management

C.  

Developing requirements for risk reporting to executive management

A.  

Chief risk officer (CRO)

B.  

Risk analysts

C.  

Risk owners

A.  

Risk issues and negative outcomes are only shared within a department.

B.  

The enterprise risk management (ERM) function manages all risk-related activities.

C.  

Risk is identified, documented, and discussed to make business decisions.

A.  

is a generic method that allows anyone in the organization to develop risk scenarios.

B.  

is based on hypothetical situations envisioned by people performing specific I&T functions.

C.  

should not be used in conjunction with other approaches to evaluate I&T related events.

A.  

File integrity monitoring (FIM) on personal database stores

B.  

Air conditioning systems with excess capacity to permit failure of certain components

C.  

Data management checks on sensitive data processing procedures

A.  

accepted and updated in the risk register.

B.  

mitigated through additional controls.

C.  

transferred and managed by a third party.

A.  

help establish the enterprise risk appetite.

B.  

determine loss associated with specific IT assets.

C.  

prioritize the enterprise's risk responses.

A.  

To determine how often risk mitigation strategies should be evaluated and updated within a specific timeframe

B.  

To determine how many risk scenarios will impact business objectives over a given period of time

C.  

To determine how often a particular risk scenario might be expected to occur during a specified period of time