- (Exam Topic 3)
Which of the following provides the MOST useful information when determining if a specific control should be implemented?

1. A. Business impact analysis (BIA)
2. B. Cost-benefit analysis
3. C. Attribute analysis
4. D. Root cause analysis

Correct Answer: B

- (Exam Topic 1)
Malware has recently affected an organization. The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:

1. A. a gap analysis
2. B. a root cause analysis.
3. C. an impact assessment.
4. D. a vulnerability assessment.

Correct Answer: C

- (Exam Topic 3)
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:

1. A. stakeholder risk tolerance.
2. B. benchmarking criteria.
3. C. suppliers used by the organization.
4. D. the control environment.

Correct Answer: D

- (Exam Topic 3)
Which of the following is the GREATEST benefit for an organization with a strong risk awareness culture?

1. A. Reducing the involvement by senior management
2. B. Using more risk specialists
3. C. Reducing the need for risk policies and guidelines
4. D. Discussing and managing risk as a team

Correct Answer: D

- (Exam Topic 3)
An application runs a scheduled job that compiles financial data from multiple business systems and updates the financial reporting system. If this job runs too long, it can delay financial reporting. Which of the following is the risk practitioner's BEST recommendation?

1. A. Implement database activity and capacity monitoring.
2. B. Ensure the business is aware of the risk.
3. C. Ensure the enterprise has a process to detect such situations.
4. D. Consider providing additional system resources to this job.

Correct Answer: C