- (Exam Topic 3)
Which of the following should be the risk practitioner's FIRST course of action when an organization plans to adopt a cloud computing strategy?

1. A. Request a budget for implementation
2. B. Conduct a threat analysis.
3. C. Create a cloud computing policy.
4. D. Perform a controls assessment.

Correct Answer: B

- (Exam Topic 1)
Which of the following should be the HIGHEST priority when developing a risk response?

1. A. The risk response addresses the risk with a holistic view.
2. B. The risk response is based on a cost-benefit analysis.
3. C. The risk response is accounted for in the budget.
4. D. The risk response aligns with the organization's risk appetite.

Correct Answer: D

- (Exam Topic 3)
Which of the following BEST enables the identification of trends in risk levels?

1. A. Correlation between risk levels and key risk indicators (KRIs) is positive.
2. B. Measurements for key risk indicators (KRIs) are repeatable
3. C. Quantitative measurements are used for key risk indicators (KRIs).
4. D. Qualitative definitions for key risk indicators (KRIs) are used.

Correct Answer: B

- (Exam Topic 2)
An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?

1. A. Project sponsor
2. B. Process owner
3. C. Risk manager
4. D. Internal auditor

Correct Answer: B

- (Exam Topic 3)
During an internal IT audit, an active network account belonging to a former employee was identified. Which of the following is the BEST way to prevent future occurrences?

1. A. Conduct a comprehensive review of access management processes.
2. B. Declare a security incident and engage the incident response team.
3. C. Conduct a comprehensive awareness session for system administrators.
4. D. Evaluate system administrators' technical skills to identify if training is required.

Correct Answer: A