Controls should be defined during the design phase of system development because:
#601
Answer: C✅ Correct❌ Incorrect
Which of the following will BEST support management reporting on risk?
#602
Answer: A✅ Correct❌ Incorrect
Which of the following provides the BEST evidence that a selected risk treatment plan is effective?
#603
Answer: A✅ Correct❌ Incorrect
Which of the following conditions presents the GREATEST risk to an application?
#604
Answer: B✅ Correct❌ Incorrect
To reduce costs, an organization is combining the second and third lines of defense in a new department that reports to a recently appointed C-level executive.Which of the following is the GREATEST concern with this situation?
#605
Answer: B✅ Correct❌ Incorrect
Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?
#606
Answer: C✅ Correct❌ Incorrect
Which of the following is MOST important to have in place to ensure the effectiveness of risk and security metrics reporting?
#607
Answer: A✅ Correct❌ Incorrect
Which of the following is the MOST appropriate key risk indicator (KRI) for backup media that is recycled monthly?
#608
Answer: D✅ Correct❌ Incorrect
Which of the following BEST indicates the efficiency of a process for granting access privileges?
#609
Answer: A✅ Correct❌ Incorrect
Which of the following BEST indicates the effectiveness of anti-malware software?
#610
Answer: C✅ Correct❌ Incorrect
When establishing an enterprise IT risk management program, it is MOST important to:
#611
Answer: A✅ Correct❌ Incorrect
Which of the following is the BEST way to determine software license compliance?
#612
Answer: A✅ Correct❌ Incorrect
Which of the following is the GREATEST benefit of updating the risk register to include outcomes from a risk assessment?
#613
Answer: A✅ Correct❌ Incorrect
A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?
#614
Answer: A✅ Correct❌ Incorrect
Which of the following provides the MOST important information to facilitate a risk response decision?
#615
Answer: A✅ Correct❌ Incorrect
Which of the following BEST contributes to the implementation of an effective risk response action plan?
#616
Answer: B✅ Correct❌ Incorrect
Implementing which of the following controls would BEST reduce the impact of a vulnerability that has been exploited?
#617
Answer: C✅ Correct❌ Incorrect
Which of the following is the MOST important reason to test new controls?
#618
Answer: A✅ Correct❌ Incorrect
A new international data privacy regulation requires personal data to be disposed after the specified retention period, which is different from the local regulatory requirement. Which of the following is the risk practitioner's BEST recommendation to resolve the disparity?
#619
Answer: B✅ Correct❌ Incorrect
Which of the following should be the MAIN consideration when validating an organization's risk appetite?
#620
Answer: C✅ Correct❌ Incorrect
Which of the following would MOST likely result in updates to an IT risk profile?
#621
Answer: C✅ Correct❌ Incorrect
A risk practitioner notices a risk scenario associated with data loss at the organization's cloud provider is assigned to the provider. Who should the risk scenario be reassigned to?
#622
Answer: C✅ Correct❌ Incorrect
Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?
#623
Answer: C✅ Correct❌ Incorrect
Which of the following is MOST important for an organization that wants to reduce IT operational risk?
#624
Answer: D✅ Correct❌ Incorrect
The MAIN goal of the risk analysis process is to determine the:
#625
Answer: C✅ Correct❌ Incorrect
An IT organization is replacing the customer relationship management (CRM) system. Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?
#626
Answer: D✅ Correct❌ Incorrect
An organization has identified that terminated employee accounts are not disabled or deleted within the time required by corporate policy. Unsure of the reason, the organization has decided to monitor the situation for three months to obtain more information. As a result of this decision, the risk has been:
#627
Answer: A✅ Correct❌ Incorrect
Which of the following is the BEST key performance indicator (KPI) for determining how well an IT policy is aligned to business requirements?
#628
Answer: C✅ Correct❌ Incorrect
The PRIMARY purpose of a maturity model is to compare the:
#629
Answer: A✅ Correct❌ Incorrect
Which of the following is the MAIN reason for analyzing risk scenarios?