- (Exam Topic 2)
An organization is planning to outsource its payroll function to an external service provider Which of the following should be the MOST important consideration when selecting the provider?

1. A. Disaster recovery plan (DRP) of the system
2. B. Right to audit the provider
3. C. Internal controls to ensure data privacy
4. D. Transparency of key performance indicators (KPIs)

Correct Answer: C

- (Exam Topic 1)
A risk practitioner has determined that a key control does not meet design expectations. Which of the following should be done NEXT?

1. A. Document the finding in the risk register.
2. B. Invoke the incident response plan.
3. C. Re-evaluate key risk indicators.
4. D. Modify the design of the control.

Correct Answer: A

- (Exam Topic 3)
Which of the following is the BEST way to manage the risk associated with malicious activities performed by database administrators (DBAs)?

1. A. Activity logging and monitoring
2. B. Periodic access review
3. C. Two-factor authentication
4. D. Awareness training and background checks

Correct Answer: A

- (Exam Topic 4)
An IT risk threat analysis is BEST used to establish

1. A. risk scenarios
2. B. risk maps
3. C. risk appetite
4. D. risk ownership.

Correct Answer: A

- (Exam Topic 2)
An audit reveals that there are changes in the environment that are not reflected in the risk profile. Which of the following is the BEST course of action?

1. A. Review the risk identification process.
2. B. Inform the risk scenario owners.
3. C. Create a risk awareness communication plan.
4. D. Update the risk register.

Correct Answer: A