- (Exam Topic 3)
When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes

1. A. risk exposure in business terms
2. B. a detailed view of individual risk exposures
3. C. a summary of incidents that have impacted the organization.
4. D. recommendations by an independent risk assessor.

Correct Answer: A

- (Exam Topic 3)
An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?

1. A. Analyze data protection methods.
2. B. Understand data flows.
3. C. Include a right-to-audit clause.
4. D. Implement strong access controls.

Correct Answer: B

- (Exam Topic 1)
Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios?

1. A. Derive scenarios from IT risk policies and standards.
2. B. Map scenarios to a recognized risk management framework.
3. C. Gather scenarios from senior management.
4. D. Benchmark scenarios against industry peers.

Correct Answer: A

- (Exam Topic 3)
Which of the following should be done FIRST when information is no longer required to support business objectives?

1. A. Archive the information to a backup database.
2. B. Protect the information according to the classification policy.
3. C. Assess the information against the retention policy.
4. D. Securely and permanently erase the information

Correct Answer: C

- (Exam Topic 2)
An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. Which risk treatment was adopted by the organization?

1. A. Acceptance
2. B. Transfer
3. C. Mitigation
4. D. Avoidance

Correct Answer: A