- (Exam Topic 2)
A control owner has completed a year-long project To strengthen existing controls. It is MOST important for the risk practitioner to:

1. A. update the risk register to reflect the correct level of residual risk.
2. B. ensure risk monitoring for the project is initiated.
3. C. conduct and document a business impact analysis (BIA).
4. D. verify cost-benefit of the new controls being implemented.

Correct Answer: A

- (Exam Topic 2)
Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?

1. A. The outsourcing of related IT processes
2. B. Outcomes of periodic risk assessments
3. C. Changes in service level objectives
4. D. Findings from continuous monitoring

Correct Answer: B

- (Exam Topic 4)
An organization recently implemented a machine learning-based solution to monitor IT usage and analyze user behavior in an effort to detect internal fraud. Which of the following is MOST likely to be reassessed as a result of this initiative?

1. A. Risk likelihood
2. B. Risk culture
3. C. Risk appetite
4. D. Risk capacity

Correct Answer: A

- (Exam Topic 3)
A deficient control has been identified which could result in great harm to an organization should a low frequency threat event occur. When communicating the associated risk to senior management the risk practitioner should explain:

1. A. mitigation plans for threat events should be prepared in the current planning period.
2. B. this risk scenario is equivalent to more frequent but lower impact risk scenarios.
3. C. the current level of risk is within tolerance.
4. D. an increase in threat events could cause a loss sooner than anticipated.

Correct Answer: A

- (Exam Topic 2)
What are the MOST important criteria to consider when developing a data classification scheme to facilitate risk assessment and the prioritization of risk mitigation activities?

1. A. Mitigation and control value
2. B. Volume and scope of data generated daily
3. C. Business criticality and sensitivity
4. D. Recovery point objective (RPO) and recovery time objective (RTO)

Correct Answer: C