- (Exam Topic 3)
When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?

1. A. Risk management strategy planning
2. B. Risk monitoring and control
3. C. Risk identification
4. D. Risk response planning

Correct Answer: C

- (Exam Topic 3)
Which of the following is the MOST important consideration when sharing risk management updates with executive management?

1. A. Including trend analysis of risk metrics
2. B. Using an aggregated view of organizational risk
3. C. Relying on key risk indicator (KRI) data
4. D. Ensuring relevance to organizational goals

Correct Answer: D

- (Exam Topic 2)
Due to a change in business processes, an identified risk scenario no longer requires mitigation. Which of the following is the MOST important reason the risk should remain in the risk register?

1. A. To support regulatory requirements
2. B. To prevent the risk scenario in the current environment
3. C. To monitor for potential changes to the risk scenario
4. D. To track historical risk assessment results

Correct Answer: D

- (Exam Topic 2)
An organization has just implemented changes to close an identified vulnerability that impacted a critical business process. What should be the NEXT course of action?

1. A. Redesign the heat map.
2. B. Review the risk tolerance.
3. C. Perform a business impact analysis (BIA)
4. D. Update the risk register.

Correct Answer: D

- (Exam Topic 3)
An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses. What should be done NEXT in response to this report?

1. A. Migrate all data to another compliant service provider.
2. B. Analyze the impact of the provider's control weaknesses to the business.
3. C. Conduct a follow-up audit to verify the provider's control weaknesses.
4. D. Review the contract to determine if penalties should be levied against the provider.

Correct Answer: B