- (Exam Topic 3)
Which of the following BEST protects an organization against breaches when using a software as a service (SaaS) application?

1. A. Control self-assessment (CSA)
2. B. Security information and event management (SIEM) solutions
3. C. Data privacy impact assessment (DPIA)
4. D. Data loss prevention (DLP) tools

Correct Answer: B

- (Exam Topic 2)
Which of the following key risk indicators (KRIs) is MOST effective for monitoring risk related to a bring your own device (BYOD) program?

1. A. Number of users who have signed a BYOD acceptable use policy
2. B. Number of incidents originating from BYOD devices
3. C. Budget allocated to the BYOD program security controls
4. D. Number of devices enrolled in the BYOD program

Correct Answer: A

- (Exam Topic 3)
Which of the following is the PRIMARY benefit of using an entry in the risk register to track the aggregate risk associated with server failure?

1. A. It provides a cost-benefit analysis on control options available for implementation.
2. B. It provides a view on where controls should be applied to maximize the uptime of servers.
3. C. It provides historical information about the impact of individual servers malfunctioning.
4. D. It provides a comprehensive view of the impact should the servers simultaneously fail.

Correct Answer: D

- (Exam Topic 2)
An organization's risk practitioner learns a new third-party system on the corporate network has introduced vulnerabilities that could compromise corporate IT systems. What should the risk practitioner do
FIRST?

1. A. Confirm the vulnerabilities with the third party
2. B. Identify procedures to mitigate the vulnerabilities.
3. C. Notify information security management.
4. D. Request IT to remove the system from the network.

Correct Answer: B

- (Exam Topic 2)
Which of the following provides The MOST useful information when determining a risk management program's maturity level?

1. A. Risk assessment results
2. B. A recently reviewed risk register
3. C. Key performance indicators (KPIs)
4. D. The organization's risk framework

Correct Answer: A