IT-Risk-Fundamentals Practice Questions

A.  

keeping impact criteria and cost data as generic as possible.

B.  

measuring existing impact criteria exclusively in financial terms.

C.  

using standardized frequency and impact metrics.

A.  

The enterprise learns from negative outcomes and treats the root cause.

B.  

The enterprise enables discussions of risk and facts within the risk management functions.

C.  

The enterprise places a strong emphasis on the positive and negative elements of risk.

A.  

Vulnerability assessment

B.  

Threat assessment

C.  

Control self-assessment

A.  

Cybersecurity risk scenarios

B.  

Vulnerabilities

C.  

Threats

A.  

supports established KPIs.

B.  

produces multiple and varied results.

C.  

is a reliable predictor of the risk event.

A.  

normalize risk taxonomy across the organization.

B.  

aggregate risk statements for all lines of business.

C.  

establish risk tolerance for each business unit.

A.  

The probability of a cyber attack varies between unlikely and very likely.

B.  

Risk management believes the likelihood of a cyber attack is not imminent.

C.  

Security measures are configured to minimize the risk of a cyber attack.

A.  

The risk report should be published for transparency and enterprise risk awareness.

B.  

The risk report should be uniform for all stakeholders to ensure consistency.

C.  

The risk report should be customized to stakeholder expectations.

A.  

are effective and manage risk to the desired level.

B.  

enable IT operations to meet agreed service levels.

C.  

mitigate risk associated with regulatory noncompliance.

A.  

When its risk appetite and tolerance are reviewed annually

B.  

When its actual risk eventually exceeds organizational risk appetite

C.  

When its risk appetite and actual risk exceed its risk capacity