- (Exam Topic 4)
A legacy application used for a critical business function relies on software that has reached the end of extended support Which of the following is the MOST effective control to manage this application?

1. A. Subscribe to threat intelligence to monitor external attacks.
2. B. Apply patches for a newer version of the application.
3. C. Segment the application within the existing network.
4. D. Increase the frequency of regular system and data backups.

Correct Answer: D

- (Exam Topic 3)
Which of the following is MOST important when developing key risk indicators (KRIs)?

1. A. Alignment with regulatory requirements
2. B. Availability of qualitative data
3. C. Properly set thresholds
4. D. Alignment with industry benchmarks

Correct Answer: C

- (Exam Topic 1)
Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?

1. A. A decrease in control layering effectiveness
2. B. An increase in inherent risk
3. C. An increase in control vulnerabilities
4. D. An increase in the level of residual risk

Correct Answer: D

- (Exam Topic 1)
Periodically reviewing and updating a risk register with details on identified risk factors PRIMARILY helps to:

1. A. minimize the number of risk scenarios for risk assessment.
2. B. aggregate risk scenarios identified across different business units.
3. C. build a threat profile of the organization for management review.
4. D. provide a current reference to stakeholders for risk-based decisions.

Correct Answer: C

- (Exam Topic 2)
An organization is considering modifying its system to enable acceptance of credit card payments. To reduce the risk of data exposure, which of the following should the organization do FIRST?

1. A. Conduct a risk assessment.
2. B. Update the security strategy.
3. C. Implement additional controls.
4. D. Update the risk register.

Correct Answer: A