- (Exam Topic 3)
Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board''

1. A. A summary of risk response plans with validation results
2. B. A report with control environment assessment results
3. C. A dashboard summarizing key risk indicators (KRIs)
4. D. A summary of IT risk scenarios with business cases

Correct Answer: C

- (Exam Topic 3)
When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?

1. A. Verbal majority acceptance of risk by committee
2. B. List of compensating controls
3. C. IT audit follow-up responses
4. D. A memo indicating risk acceptance

Correct Answer: C

- (Exam Topic 3)
Which of the following would BEST mitigate the ongoing risk associated with operating system (OS) vulnerabilities?

1. A. Temporarily mitigate the OS vulnerabilities
2. B. Document and implement a patching process
3. C. Evaluate permanent fixes such as patches and upgrades
4. D. Identify the vulnerabilities and applicable OS patches

Correct Answer: B

- (Exam Topic 1)
When reviewing management's IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?

1. A. Assess management's risk tolerance.
2. B. Recommend management accept the low risk scenarios.
3. C. Propose mitigating controls
4. D. Re-evaluate the risk scenarios associated with the control

Correct Answer: D

- (Exam Topic 3)
Which of the following BEST indicates the condition of a risk management program?

1. A. Number of risk register entries
2. B. Number of controls
3. C. Level of financial support
4. D. Amount of residual risk

Correct Answer: D