- (Exam Topic 2)
Which of the following would qualify as a key performance indicator (KPI)?

1. A. Aggregate risk of the organization
2. B. Number of identified system vulnerabilities
3. C. Number of exception requests processed in the past 90 days
4. D. Number of attacks against the organization's website

Correct Answer: B

- (Exam Topic 2)
A risk owner has identified a risk with high impact and very low likelihood. The potential loss is covered by insurance. Which of the following should the risk practitioner do NEXT?

1. A. Recommend avoiding the risk.
2. B. Validate the risk response with internal audit.
3. C. Update the risk register.
4. D. Evaluate outsourcing the process.

Correct Answer: C

- (Exam Topic 2)
The MOST significant benefit of using a consistent risk ranking methodology across an organization is that it enables:

1. A. allocation of available resources
2. B. clear understanding of risk levels
3. C. assignment of risk to the appropriate owners
4. D. risk to be expressed in quantifiable terms

Correct Answer: B

- (Exam Topic 2)
The PRIMARY purpose of using control metrics is to evaluate the:

1. A. amount of risk reduced by compensating controls.
2. B. amount of risk present in the organization.
3. C. variance against objectives.
4. D. number of incidents.

Correct Answer: C

- (Exam Topic 3)
To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:

1. A. require the vendor to sign a nondisclosure agreement
2. B. clearly define the project scope.
3. C. perform background checks on the vendor.
4. D. notify network administrators before testing

Correct Answer: A