Sample Exam 2 Flashcards
Which of the following is the GREATEST challenge of performing a quantitative risk analysis?
A.Obtaining accurate figures on the impact of a realized threat
B.Obtaining accurate figures on the value of assets
C.Calculating the annual loss expectancy of a specific threat
D.Obtaining accurate figures on the frequency of specific threats
D is the correct answer.
Justification
The impact of a threat can be determined based on the type of threat that occurs.
The value of an asset should be easy to ascertain.
Annual loss expectancy will not be difficult to calculate if you know the correct frequency of threat occurrence.
It can be challenging to obtain an accurate figure representing the frequency of threat occurrence.
The PRIMARY reason to verify the completion of a risk mitigation response is to:
A.confirm that residual risk is within acceptable thresholds.
B.verify that vulnerabilities are no longer exploitable.
C.maintain an accurate risk profile and inventory.
D.manage and report on the status of risk action plans.
A is the correct answer.
Justification
The primary reason to verify the completion of the risk mitigation response is to confirm that residual risk is within acceptable thresholds or to plan for further action if it is not.
Verifying if vulnerabilities are no longer exploitable is not the primary reason to verify completion of a risk mitigation response as new exploits continuously emerge.
Accuracy of the risk register is not the primary reason for monitoring residual risk.
Risk reporting is not the primary reason to verify residual risk and its impact to the enterprise.
A PRIMARY reason for initiating a policy-exception process is:
A.the risk is justified by the benefit.
B.policy compliance is difficult to enforce.
C.operations are too busy to comply.
D.users may initially be inconvenienced.
A is the correct answer.
Justification
Exceptions to policies are warranted if the benefits outweigh the costs of policy compliance; however, the enterprise needs to assess both the tangible and intangible risk and evaluate both in the context of existing risk.
Difficulty in enforcement does not justify policy exceptions.
Lack of resources to achieve compliance does not justify policy exceptions.
User inconvenience does not warrant an automatic exception to a policy.
The board of directors wants to know the financial impact of specific, individual risk scenarios. What type of approach is BEST suited to fulfill this requirement?
A.Delphi method
B.Quantitative analysis
C.Qualitative analysis
D.Financial risk modeling
B is the correct answer.
Justification
The Delphi method is a forecasting method based on expert opinions that are gathered over several iterations of anonymous surveys.
A quantitative approach to risk evaluations would be the best approach because it is formula-based and puts a monetary amount on the potential loss resulting from a risk scenario, which is of most interest to senior management.
Qualitative analysis does not quantify the risk and loss in numbers and therefore is not the best option.
Financial risk modeling determines aggregate risk in a financial portfolio. It is generally not used to provide the financial impact of individual risk scenarios.
Which of the following practices BEST mitigates the risk associated with outsourcing a business function?
A.Performing audits to verify compliance with contract requirements
B.Requiring all vendor staff to complete annual awareness training sessions
C.Retaining copies of all sensitive data on internal systems
D.Reviewing the financial records of the vendor to verify financial soundness
A is the correct answer.
Justification
When an outsourcing relationship is established, the risk of noncompliance with the agreement must be met through review, monitoring and enforcement of the contract terms. Therefore, conducting regular audits to verify that the vendor is compliant with contract requirements is an important practice to mitigate the outsourcing risk.
Requiring the vendor’s staff to complete annual awareness training sessions would not provide the same level of mitigation as the verification of adherence to contract requirements.
Keeping copies of all sensitive data is an unnecessary expenditure and may result in errors or inconsistencies with data stored at the vendor site. In addition, duplicating sensitive data makes the enterprise liable for protecting data in two or more locations and increases the possibility of inappropriate access or data leakage.
Although it is common practice to review financial solvency before selecting a vendor to ensure that the vendor can function without the threat of liquidation for the foreseeable future, reviewing solvency is not the best practice to address risk related to outsourcing an IT or business function.
Which of the following is an effective monitoring process to ensure a third party is performing in accordance with contract requirements?
A.Review independent audit reports
B.Review the third party’s service level agreements
C.Review the number of third party security-related incidents
D.Ongoing third-party oversight
D is the correct answer.
Justification
Reviewing audit reports is only one aspect of the process. Third-party management encompasses more than audit reports.
The service level agreement is one of many ways to measure contractual compliance.
Reviewing the number of incidents is only one aspect of the ongoing monitoring process.
Third-party management should be an ongoing process that monitors for compliance with agreements, adequate insurance coverage, business continuity tests, results of independent audits, and policy reviews.
The criticality of an IT infrastructure element can be quantified based on:
A.audit logs.
B.thresholds.
C.dependencies.
D.replacement cost.
C is the correct answer.
Justification
Audit logs are a monitoring mechanism, not a basis for selection.
Thresholds are used as a means of limiting the number of events that draw attention, helping to avoid the noise that can be generated by an overwhelming number of false positives, while ensuring that events deserving attention are not overlooked. They apply to elements that have already been selected for monitoring.
One way to identify the criticality of a system, process or capability is to quantify the number and type of systems, processes and capabilities that depend on its continued operation. In general, a system on which many other things depend is critical even if the individual importance of any one of the elements that it supports is relatively low.
Replacement cost is not an effective means of identifying elements for monitoring because the importance of a particular element within an overall IT infrastructure to the enterprise as a whole typically goes far beyond the direct cost associated with the element’s purchase, installation and maintenance.
Which of the following processes is MOST critical for prioritizing actions in a business continuity plan?
A.Risk assessment
B.Vulnerability assessment
C.Business impact analysis
D.Business process mapping
C is the correct answer.
Justification
Risk assessment provides information on the likelihood of occurrence of security incidents. It assists in the selection of countermeasures but not in the prioritization of actions.
A vulnerability assessment provides information regarding the security weaknesses of the system and supports the risk identification process.
The business impact analysis is the most critical process for deciding which part of the information system/business process should be given priority in case of a security incident that may lead to business disruption.
Business process mapping does not help in decision-making, but it does help in implementing a decision.
Which of the following BEST helps the risk practitioner identify IS control deficiencies?
A.An IT control framework
B.Defined control objectives
C.A countermeasure analysis
D.A threat analysis
B is the correct answer.
Justification
An IT control framework is generic, and reviewing it does not help in identifying IS control deficiencies.
Controls are deployed to achieve the desired objectives based on risk assessment and to meet the business requirements.
A countermeasure analysis provides results on countermeasures for a control. The countermeasures are deployed when a threat is perceived and additional controls act as countermeasures. This, however, does not help to identify IS control deficiencies.
A threat analysis identifies the various threats affecting the systems and assets and does not help to identify IS control deficiencies.
Which of the following objectives is the PRIMARY reason that risk professionals conduct risk assessments?
A.To maintain the enterprise’s risk register
B.To enable management to choose the right risk response
C.To provide assurance on the risk management process
D.To identify risk with the highest business impact
D is the correct answer.
Justification
The maintenance of the risk register is part of the ongoing risk assessment process.
Management chooses the right risk response strategy based on risk analysis. A risk assessment itself is not sufficient to make educated risk response decisions.
Assurance on risk management is not the main reason risk assessment is performed by the risk professional.
All decisions should be taken in the context of business impact. For each action to be taken, consideration ultimately must be given to its positive or negative impact on the business.
Which of the following types of risk is high for projects that affect multiple business areas?
A.Control risk
B.Inherent risk
C.Compliance risk
D.Residual risk
B is the correct answer.
Justification
Control risk may be high, but it would follow from failure to identify, evaluate or test internal controls, not from the number of users or business areas affected.
Inherent risk normally grows as the number of users and business areas that may be affected increases. Inherent risk reflects risk or exposure without accounting for mitigating action by management. It is often higher whenever multiple parties may have conflicting responsibilities for a business process.
Compliance risk reflects the penalty applied to current and future earnings for nonconformance to laws and regulations; number of users and affected business areas will not necessarily increase compliance risk.
Residual risk is risk that persists after management implements a risk response. It is not based on the number of users or business areas affected.
Which of the following compensating controls should management implement when a segregation of duties conflict exists because an enterprise has a small IT department?
A.Independent analysis of IT incidents
B.Entitlement reviews
C.Independent review of audit logs
D.Tighter controls over user provisioning
C is the correct answer.
Justification
Independent analysis of IT incidents could point to segregation of duties violations. This is not a compensating control but a detective control.
Entitlement reviews are performed to review the access of individuals to ensure they have the proper access for their current role. This review is the responsibility of the data owner and usually occurs at regular intervals. This is not the best way to prevent or detect a segregation of duties conflict.
An independent review of the audit logs would be the best compensating control because someone outside the IT department can validate that no activity exploited segregation of duties.
User provisioning is the process of granting access to an application or system. While a normal part of the provisioning process is to make sure that no segregation of duties conflicts exist, this approach is not practical for the present case due to the small size of the IT department; therefore, tighter controls over user provisioning will be of limited value.
Which of the following can be expected when a key control is being maintained at an optimal level?
A.The shortest lead time until the control breach comes to the surface
B.Balance between control effectiveness and cost
C.An adequate maturity level of the risk management process
D.An accurate estimation of operational risk amounts
B is the correct answer.
Justification
Even though a key control is in place, it may take time until a breach surfaces if escalation procedures are not adequately set up. Thus, a key control alone does not ensure the shortest lead time for a breach to be communicated to management.
Maintaining controls at an optimal level translates into a balance between control cost and derived benefit.
Measurement of the maturity level in risk management may depend on the function of key controls. However, the key control is not the major driver to assess the maturity of risk management.
The key control does not directly contribute to the accurate estimation of operational risk amounts. Maintenance of an incident database and the application of statistical methods are essential for the estimation of operational risk.
Which of the following factors determines the acceptable level of residual risk in an enterprise?
A.Management discretion
B.Regulatory requirements
C.Risk assessment results
D.Internal audit findings
A is the correct answer.
Justification
Deciding what level of risk is acceptable to an enterprise is fundamentally a function of management. At its discretion, enterprise management may decide to accept risk. The target risk level for a control is, therefore, subject to management discretion.
Failure to comply with regulatory requirements has consequences, but those consequences are considered in the context of enterprise risk. In some cases, the cost of failure to comply may be lower than the cost of compliance; in this case, management may decide to accept the risk.
The acceptable level of residual risk is determined by management and is not dependent on the results of the risk assessment.
The results of an internal audit determine the actual level of residual risk within a specific audit scope, but whether this level is acceptable is fundamentally a management decision.
What should be performed FIRST when establishing the IT risk framework of an enterprise?
A.Setting accountabilities and responsibilities for risk
B.Articulating the financial risk appetite for the enterprise
C.Allocating control owners for critical information systems
D.Endorsing a risk matrix that specifies risk tolerances
A is the correct answer.
Justification
Without ownership and accountability, the risk framework will not be driven forward.
A financial risk appetite is important, but its articulation is not the first step in establishing the IT risk framework, which must set accountabilities and ownership to be effective. Furthermore, the risk appetite will require interpretation and translation into the IT domain.
Ownership of critical systems is a subset of overall accountability, without which the IT risk framework could not be complete or enforceable.
Risk matrices are not required for risk assessments and risk frameworks (especially those emphasizing risk tolerance).
Which of the following is the GREATEST benefit of a risk-aware culture?
A.Issues are escalated when suspicious activity is noticed.
B.Controls are double-checked to anticipate any issues.
C.Individuals communicate with peers for knowledge sharing.
D.Employees are self-motivated to learn about costs and benefits.
A is the correct answer.
Justification
Management benefits most from an escalation process because risk and incidents are reported in a timely manner. Escalation posture among employees is best developed through training and awareness programs.
Double-checking controls is a thorough business practice. It is a basic business stance, so benefit for management may be limited.
Knowledge sharing is an important theme and should be encouraged through awareness programs. However, its benefit to risk management may be indirect.
Encouraging employees to learn is desirable. However, management may not expect awareness programs to emphasize assessment of cost and benefit.
Which of the following is the MOST important risk an enterprise must consider when developing a disaster recovery plan?
A.Budgets have not yet been finalized.
B.A business impact analysis has not been conducted.
C.No risk strategy has been established.
D.All employees have not attended disaster recovery training.
B is the correct answer.
Justification
A budget is important when developing a disaster recovery plan, but if set without knowledge of what to cover and when, the budget will not be useful.
Without a business impact analysis (BIA), the enterprise does not know what it needs to recover and when it needs to recover it.
A risk strategy is just one part of the BIA.
All employees do not necessarily need to attend training. Employees with a role in key business processes should be trained to know their responsibilities following a disaster.
Who is MOST likely responsible for data classification?
A.Data user
B.Data owner
C.Data custodian
D.System administrator
B is the correct answer.
Justification
The data user gains access based on justified business need and the approval of the data owner.
The data owner is responsible for classifying data according to the enterprise’s data classification scheme. The classification scheme then defines who is eligible to access the data and what controls are required.
The data custodian is responsible for safe custody, transport and storage of data, including implementation of associated business rules.
System administrators are considered data custodians because they ensure safe custody, transport and storage of data, including implementation of associated business rules.
A substantive test to verify that tape library inventory records are accurate involves:
A.determining whether bar code readers are installed.
B.conducting a physical count of the tape inventory.
C.checking whether receipts and issues of tapes are accurately recorded.
D.determining whether the movement of tapes is authorized.
B is the correct answer.
Justification
Testing the existence of bar code readers is a compliance test, not a substantive test. A substantive test involves gathering evidence to evaluate the integrity of individual transactions, data or other information.
A substantive test involves gathering evidence to evaluate the integrity of individual transactions, data or other information. Conducting a physical count of the tape inventory is a substantive test.
Confirming that receipts and issues of tapes are accurately recorded is a compliance test, not a substantive test. A substantive test involves gathering evidence to evaluate the integrity of individual transactions, data or other information.
Testing the approval of tape movements is a compliance test, not a substantive test. A substantive test involves gathering evidence to evaluate the integrity of individual transactions, data or other information.
The implementation of unjustified controls is MOST likely to result in:
A.an increase in residual risk related to the controls.
B.a decrease in residual risk related to the controls.
C.an ineffective monitoring of the related controls.
D.a smaller return on IT investment.
D is the correct answer.
Justification
Residual risk will not increase as a result of unjustified controls; however, if controls that do not support business objectives are implemented, the enterprise may place focus on less critical activities.
Residual risk will not decrease as a result of unjustified controls; however, if controls that do not support business objectives are implemented, the enterprise may place focus on less critical activities.
Monitoring will not be impacted by unjustified controls; rather, monitoring will be performed on controls that do not provide value toward achieving business objectives.
Enterprises that have a large suite of controls that do not relate to their critical objectives have a greater likelihood of decreasing their return on IT investment due to the cost of implementing those controls.
Which of the following options BEST ensures that an identified risk is mitigated?
A.Control metrics
B.Control testing
C.Control objective
D.Control ownership
B is the correct answer.
Justification
Control metrics will only report on the control’s effectiveness on an ongoing basis. Control metrics do not necessarily trigger immediate remedial actions, although they will be used to determine such actions.
Control testing determines the effectiveness of the controls in achieving their stated objectives, ensuring that the risk is mitigated.
A control objective is only a statement of the desired result or purpose to be achieved by implementing a given control and does not ensure a risk is mitigated.
Control ownership establishes lines of accountability but does not identify whether a risk has been mitigated.
Which of the following requirements MUST be met during the initial stages of developing a risk management program?
A.Management establishes ownership of identified risk.
B.Information security policies and standards are established.
C.A management committee exists to provide program oversight.
D.The context and purpose of the program are defined.
D is the correct answer.
Justification
Although an important component in the development of any managed program, establishing ownership of identified risk would occur later in the program.
Information security policies and standards are based on the decisions made in the planning phase of the program and are developed based on the outcomes and business objectives established by the enterprise.
Management oversight of the risk management program constitutes a monitoring control developed to ensure that the program meets business objectives. This process is established in later stages of development, after the purpose of the program and the mechanics of its deployment have been established.
Initial requirements to determine the enterprise’s purpose for creating an information security risk management program include determining the desired outcomes and defining objectives.
A lack of adequate controls represents:
A.an impact.
B.a risk indicator.
C.a vulnerability.
D.a threat.
C is the correct answer.
Justification
Impact measures the financial loss posed by a threat.
A risk indicator is a metric capable of showing that the enterprise is subject to, or has a high probability of being subject to, a risk that exceeds its defined risk appetite.
The lack of adequate controls represents a vulnerability, exposing sensitive processes and/or data to the possibility of malicious damage, attack, or unauthorized access by hackers. Vulnerabilities can result in loss of sensitive information, financial loss, legal penalties, etc.
A threat is a potential cause or actor behind an adverse incident.
Risk assessments should be repeated at regular intervals because:
A.omissions in earlier assessments can be addressed.
B.periodic assessments allow various methodologies.
C.business threats are constantly changing.
D.they help raise risk awareness among staff.
C is the correct answer.
Justification
Omissions not found in earlier assessments do not necessarily justify regular reassessments.
Unless the environment changes, risk assessments should be performed using the same methodologies.
As business objectives and methods change, the nature and relevance of threats also change.
There are better ways of raising security awareness than by performing a risk assessment, such as risk awareness training.
Which of the following is the MAIN reason senior management monitors and analyzes trends in key control indicators?
A.It provides feedback on the overall control environment.
B.It helps in identifying redundant controls.
C.It proactively identifies impacts to the risk profile.
D.It helps determine if additional controls are required.
C is the correct answer.
Justification
The control environment is primarily the responsibility of the operations team, and not senior management. Tuning and related feedback is the responsibility of the operations team.
Redundancy is a design and operations responsibility, not senior management.
The primary objective of key control indicators (KCIs) is to ensure that controls actually mitigate risk at an effective level. Analysis of KCI trends provides information on the overall effectiveness of controls and provides management information on the status of risk management.
Determining the need for additional controls is the responsibility of operations, not senior management. KCIs would not necessarily identify the need for additional controls.
Which of the following risk response options is MOST likely to increase the liability of the enterprise?
A.Risk acceptance
B.Risk reduction
C.Risk transfer
D.Risk avoidance
A is the correct answer.
Justification
An enterprise may choose to accept risk without knowing the correct level of risk that is being accepted; this may result in accusations of negligence.
Risk reduction indicates an attempt to reduce the risk level. It may not be as effective as intended, but is not likely to increase the level of risk.
Risk transfer allocates a portion of risk to another party (e.g., insurance).
Risk avoidance will terminate a process that is considered to have an unacceptable level of risk that cannot be mitigated economically.
Purchasing insurance is a form of:
A.risk avoidance.
B.risk mitigation.
C.risk acceptance.
D.risk transfer.
D is the correct answer.
Justification
Risk avoidance means that activities or conditions that give rise to risk are discontinued.
Risk mitigation is the management of risk through the use of countermeasures and controls. Risk transfer is one form of risk mitigation.
Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs.
Transferring risk typically involves insurance policies to share the financial risk.
Which of the following BEST mitigates control risk?
A.Continuous monitoring
B.An effective security awareness program
C.Effective change management procedures
D.Senior management support for control implementation
A is the correct answer.
Justification
Continuous monitoring tests controls that mitigate the risk of the control being less effective over time. A risk assessment will identify when the control is no longer effective and the control will be replaced.
An effective security awareness program does not mitigate control risk.
Effective change management procedures alone do not mitigate control risk.
Senior management support will only assist in implementing a new control but does not directly mitigate control risk.
Which of the following is BEST addressed by transferring risk?
A.An antiquated fire suppression system in the computer room
B.The threat of disgruntled employee sabotage
C.The threat of disgruntled employee theft
D.A building located in a 100-year flood plain
D is the correct answer.
Justification
Although an enterprise may hold insurance policies for physical assets such as computer equipment, the most appropriate risk remediation strategy is to update the fire suppression system.
This risk is not readily transferable. Full risk response planning should be performed for all risk that could happen at any time during routine business activities.
This risk is not readily transferable. Removable media policies and procedures should proactively be in place to mitigate the risk of lost or stolen media.
Purchasing an insurance policy transfers the risk of a flood. Risk transfer is the process of assigning risk to another entity, usually through the purchase of an insurance policy or through outsourcing the service.
Development of corporate information security policy should PRIMARILY be based on:
A.vulnerabilities.
B.threats.
C.assets.
D.impacts.
C is the correct answer.
Justification
Absent a threat, vulnerabilities do not pose a risk. A vulnerability is defined as a weakness in the design, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events.
A threat is defined as anything (e.g., object, substance, human actor) that is capable of acting against an asset in a manner that can result in harm. The information security policy is not written to address a threat directly, but rather to address the protection of assets from threats.
The corporate information security policy is based on management’s commitment to protect the assets of the enterprise (and relevant information of its business partners) from threats, risk and exposures that could occur.
Impact is not an issue if no threat exists. The impact is generally quantified as a direct financial loss in the short term or an ultimate (indirect) financial loss in the long term. Impact does not drive the development of the policy but is a component of the policy.
Which of the following is an example of a key performance indicator?
A.Average network availability uptime
B.Average number of missed patches
C.Average number of data entry errors
D.Average number of virus and phishing attacks
A is the correct answer.
Justification
Average network availability is an example of a key performance indicator.
Average number of missed patches is an example of a key risk indicator.
Average number of data entry errors is an example of a key risk indicator.
Average number of virus and phishing attacks is an example of a key risk indicator.
Which of the following BEST assists in the proper design of an effective key risk indicator?
A.Generating the frequency of reporting cycles to report on the risk
B.Preparing a business case that includes the measurement criteria for the risk
C.Conducting a risk assessment to provide an overview of the key risk
D.Documenting the operational flow of the business from beginning to end
D is the correct answer.
Justification
Generating the frequency of reporting for the key risk indicator (KRI) means nothing if the KRI is not designed.
A proper business case describes what is going to be done, why it is worth doing, how it will be accomplished, and what resources will be required. It will not document the data points, structures, or anything else needed for designing a KRI.
A risk assessment is the determination of a value of risk related to some situation and a recognized threat. While it contributes somewhat to the design of the KRI, there is a need for additional information.
Prior to starting to design the KRI, a risk manager must understand the end-to-end operational flow of the business. The risk manager requires detailed insight into data flows, decision-making processes, acceptable levels of risk for the business, etc., which enables the application of top and bottom levels for the KRI.
An excessive number of standard workstation images can be categorized as a key risk indicator for:
A.change management.
B.configuration management.
C.IT operations management.
D.data management.
B is the correct answer.
Justification
Change management deals with the process of managing changes to existing environments, rather than the initial environment definition.
An excessive number of unique workstation images is an indicator that poor configuration management processes are in place and that sufficient attention to actual business requirements has not been paid during the initial image definition.
IT operations management relates to the day-to-day operations of IT.
Data management relates to the handling of the data, rather than environment definition.
Which of the following is MOST important when selecting an appropriate risk management methodology?
A.Risk culture
B.Countermeasure analysis
C.Cost-benefit analysis
D.Risk transfer strategy
A is the correct answer.
Justification
Without understanding risk culture—how and why an enterprise makes decisions regarding risk—one cannot select a risk management methodology.
Countermeasure analysis targets controls that address specific attacks, sometimes while the attack is occurring. Countermeasure analysis does not inform selection of an appropriate risk management methodology.
Cost-benefit analysis measures the projected benefit of a solution (such as a control) relative to its price, either at a given point in time or over an extended period. Cost-benefit analysis is generally not considered when selecting a risk management methodology.
Because not all risk can be transferred, implementing a proper risk assessment methodology must begin by considering the overall risk profile, not the risk transfer strategy.
Risk management strategic plans are MOST effective when developed for:
A.the enterprise as a whole.
B.each individual system based on technology used.
C.every location based on geographic threats.
D.end-to-end business processes.
A is the correct answer.
Justification
Risk management strategic plans are most effective when they are created and followed by the entire enterprise.
Because most enterprises use many different technologies, creating a management plan for each technology creates unnecessary and counterproductive complexity, and may increase conflicts among policies.
It is difficult to create a risk management plan for each location based on geographic threats. Also, these plans do not take other types of threats into account.
Risk management plans based on end-to-end business processes can result in overlapping and/or conflicting policies and procedures.
Which of the following is the MOST important when transmitting personal information across networks?
A.encrypting the personal information.
B.obtaining consent to transfer personal information.
C.ensuring the privacy of the personal information.
D.ensuring effective change management.
C is the correct answer.
Justification
Encryption is a method of protecting the data at rest and in transit, but there may be remaining unmitigated risk resulting in inadequate privacy protection. Therefore, encryption is a partial answer.
Consent is one of the protections that are frequently, but not always, required.
Privacy protection is necessary to ensure that the receiving party has the appropriate level of protection of personal data.
Change management is a core control that ensures that the privacy protections, encryption settings and consent processes are implemented as management intended; however, it will not directly address the privacy of the individuals.
Which of the following is MOST suitable for reporting IT-related business risk to senior management?
A.Balanced scorecards
B.Gantt charts
C.Technical vulnerability reports
D.Dashboards
D is the correct answer.
Justification
A balanced scorecard is a coherent set of performance measures organized into four categories: traditional financial measures, and customer, internal business process, and learning and growth perspectives.
Gantt charts show the critical path for a project but are not suitable for reporting IT-related business risk.
Technical vulnerability reports provide a detailed overview of system vulnerabilities and often include leading practices on how to mitigate vulnerabilities. Often, they are not tied to the business impact and are too granular to be used for reporting IT-related business risk to senior management.
Dashboards are most suitable for reporting risk to senior management because they provide a high-level overview of risk levels that can be easily understood.
An enterprise has contracted an external supplier to develop critical components of a consumer product. Risk tolerance levels for the outsourced component have been documented and approved. Which of the following can serve to gauge risk that may trigger stakeholder concern?
A.Indicators with approved thresholds
B.Approved status report of completed milestones
C.List of controls to be implemented by the supplier
D.Number of findings in external audit reports
A is the correct answer.
Justification
Indicators with approved thresholds demonstrate the acceptable risk levels stakeholders are willing to tolerate, and any risk above those approved levels will likely trigger stakeholder concern.
A status report of completed milestones only shows deliverables that have been completed against projected timelines for the outsourced component.
The lists of controls to be implemented by the supplier are requirements that the supplier will fulfill. To gauge potential for stakeholder concern, indicators for thresholds and tolerance must be defined and approved.
The number of findings in external audit reports is not an indicator of risk tolerance levels.
Which of the following choices should drive the IT plan?
A.Strategic planning and business requirements
B.Technology and operational procedures
C.Compliance with laws and regulations
D.Project plans and stakeholder requirements
A is the correct answer.
Justification
IT exists to support business objectives. Management of enterprise IT should align the IT plan closely with the business.
IT exists to support business objectives. The IT plan should consider technology and procedures, but should not eclipse business strategy, which would risk creating a gap between strategy and IT.
IT exists to support business objectives. Compliance with laws and regulations should be evaluated in the same manner as any other risk.
IT exists to support business objectives. When IT projects are based on a project-by-project approach, effort is often duplicated or wasted, and results are likely to be incompatible across the enterprise.
Which of the following documents BEST identifies an enterprise’s compliance risk and the corrective actions in progress to meet these regulatory requirements?
A.An internal audit report
B.A risk register
C.An external audit report
D.A risk assessment report
B is the correct answer.
Justification
Audit reports track audit findings and their respective actions but, based on the audit scope, do not necessarily include compliance-oriented findings or their risk. They generally do not include corrective actions in progress.
A risk register provides a report of all current identified risk within an enterprise (including compliance risk) and tracks the status of corrective actions or exceptions.
External audit reports are generally more reliable than internal audit reports due to the relative independence of external auditors. However, they do not generally include all relevant compliance risk. They may focus on one requirement at a time, such as privacy, the US Occupational Safety and Health Administration (OSHA) regulations, the US Sarbanes-Oxley Act of 2002, etc. They generally do not include corrective actions in progress.
Risk assessment reports may include compliance risk, but often do not track ongoing or anticipated corrective actions.
An enterprise has decided to perform backups on a weekly basis. Which of the following choices BEST describes the risk response approach used by management?
A.Any residual risk from performing weekly backups has been accepted.
B.The risk of losing data has been mitigated to as low a level as possible.
C.The control is ineffective because any loss of data should be minimized.
D.The inherent risk of losing data has not been adequately mitigated.
A is the correct answer.
Justification
Residual risk arises where there is a risk response or control in place, but the potential for loss is still probable. There is a risk of data loss, but management tolerance for risk is such that it is willing to accept that loss.
The control could reduce risk to an even lower level; however, it would be at a higher cost that may not be deemed reasonable.
The effectiveness of the control needs to be matched against the control objective. As long as the control objective to perform weekly backups is carried out by management, implementation of the control is still effective, even if it may not be adequate.
The resulting risk associated with performing weekly backups is not inherent risk but residual risk. Inherent risk is risk that exists in the absence of any controls.
Which of the following is the MOST appropriate metric to measure how well the information security function is managing the administration of user access?
A.Elapsed time to suspend accounts of terminated users
B.Elapsed time to suspend accounts of users transferring
C.Ratio of actual accounts to actual end users
D.Percent of accounts with configurations in compliance
D is the correct answer.
Justification
Elapsed time to suspend accounts of terminated users is only part of the picture and does not address the volume of requests.
Elapsed time to suspend accounts of users transferring is only part of the picture and does not address the volume of requests.
The ratio of actual accounts to actual end users does not indicate much in terms of how well security is administered.
The percent of accounts with configurations in compliance is the best measure of how well the administration is being managed because it shows the overall impact.
The application of information classification is the responsibility of the:
A.information security officer.
B.information owner.
C.information systems auditor.
D.information custodian.
B is the correct answer.
Justification
The information security officer has functional responsibility for security and does not determine the classification of information.
The information owner determines classification based on the criticality and sensitivity of information.
The information systems auditor examines security and does not determine the classification of information.
The information custodian preserves the confidentiality, availability and integrity of information and does not determine the classification of information.
As part of risk monitoring, the administrator of a two-factor authentication system identifies a trusted independent source indicating that the algorithm used for generating keys has been compromised. The vendor of the authentication system has not provided further information. Which of the following is the BEST initial course of action?
A.Wait for the vendor to formally confirm the breach and provide a solution.
B.Determine and implement suitable compensating controls.
C.Identify all systems requiring two-factor authentication and notify their business owners.
D.Disable the system and rely on single-factor authentication until further information is received.
C is the correct answer.
Justification
Waiting for the vendor to acknowledge the vulnerability may result in unacceptable exposure and may be considered negligent.
Determining suitable compensating controls is not appropriate without instructions from the responsible business owner.
Business owners should be notified, even when some information may not be available. Business owners are responsible for responding to new risk.
Disabling the system is not appropriate because there is no indication that the compromise will have an impact on the first-factor authentication.
Which of the following risk management activities initially identifies critical business functions and key business risk?
A.Risk monitoring
B.Risk analysis
C.Risk assessment
D.Risk evaluation
C is the correct answer.
Justification
Risk monitoring provides timely information on the actual status of risk in the enterprise.
Risk analysis estimates the frequency and magnitude of IT risk scenarios.
Risk assessment identifies and evaluates risk and its potential effects. It includes recognizing and assessing critical functions and processes necessary for an enterprise to continue operating, defines the controls in place to reduce exposure, and evaluates the cost of such controls.
Risk evaluation compares estimated risk against given risk criteria to determine the significance of the risk.
Risk tolerance levels, risk ratings, related projects, affected stakeholders, assessment details and risk owners are all captured in which of the following items?
A.Risk register
B.Risk subject
C.Risk factors
D.Risk treatment plan
A is the correct answer.
Justification
A risk register includes risk tolerance levels, risk ratings, related projects, affected stakeholders, assessment details and risk owners.
A risk subject refers to the risk owner and affected business unit but does not address projects.
Risk factors reference internal and external context, risk management and IT-related capabilities.
A risk treatment plan includes risk scenarios requiring mitigation, root cause analysis, risk response evaluation criteria, accountability and responsibility, proposed actions, required resources, performance measurements and constraints, cost-benefit analysis, reporting and monitoring requirements, and timing and scheduling.
The PRIMARY reason to have the risk management process reviewed by an independent risk management professional is to:
A.validate cost-effective solutions for mitigating risk.
B.validate control weaknesses detected by the internal team.
C.assess the validity of the end-to-end process.
D.assess whether the risk profile and risk factors are properly defined.
C is the correct answer.
Justification
Cost-effective solutions can be provided by the internal teams.
The internal team can find weaknesses. It is not necessary to involve an external risk professional to validate the weaknesses detected by the internal team.
The independent risk professional will be unbiased to review the risk management process end to end. The independent reviewer will not have any involvement in any stage of the risk management process and will be unaffected by all internal factors.
The risk profile and risk factors are properly defined when the risk assessment process is performed correctly. An independent assessment may result in further improvements.
Which of the following controls within the user provision process BEST ensures revocation of system access for contractors and other temporary users when it is no longer required?
A.Log all account usage and send it to the users’ managers.
B.Establish predetermined, automatic expiration dates.
C.Ensure that each user signs a security acknowledgment.
D.Require managers to email security when the user leaves.
B is the correct answer.
Justification
Logging, when coupled with monitoring, may be a detective control but it would not be as effective as the preventive control of implementing user accounts with predetermined expiration dates.
Predetermined expiration dates are the most effective means of removing systems access for temporary users.
Requiring each individual to sign a security acknowledgment has little effect in this case.
Managers often do not promptly submit termination notices.
To which of the following documents does an enterprise refer to determine the intellectual property ownership of an application built by a third-party service manager in the course of its work for the enterprise?
A.Service level agreement
B.Statement of work
C.Operational level agreement
D.Nondisclosure agreement
B is the correct answer.
Justification
A service level agreement (SLA) defines minimum performance targets; mechanisms for performance measurement; and, typically, penalties for noncompliance. It does not address matters of intellectual property (IP) ownership.
A statement of work typically defines terms of governance and conditions for third-party engagement, and it delineates IP ownership of products developed under the contract. Failure to include adequate language for IP may result in limited or no rights to resulting deliverables. Therefore, it is critical to review language rather than rely on boilerplate clauses to optimize ownership of deliverables and assess vulnerability associated with third-party engagements.
An operational level agreement is comparable to an SLA but involves different departments within an enterprise. IP ownership is usually not disputed among departments within the same enterprise.
A nondisclosure agreement typically provides confidentiality of shared materials and information. It does not apply to work performed under contract by one party for the other.
Which of the following criteria is MOST essential for the effectiveness of operational metrics?
A.Relevance to the recipient
B.Timeliness of the reporting
C.Accuracy of the measurement
D.Cost of obtaining the metrics
A is the correct answer.
Justification
Unless the metric is relevant to the recipient and the recipient understands what the metric means and what action to take, if any, all other criteria are of little importance.
Timeliness of reporting is important, but it is secondary to relevance.
A high degree of accuracy is not essential if the metric is reliable and indications are within an acceptable range.
Cost is always a consideration, but it is secondary to relevance.
An asset’s annual loss expectancy is calculated as the:
A.exposure factor (EF) multiplied by the annualized rate of occurrence (ARO).
B.single loss expectancy (SLE) multiplied by the EF.
C.SLE multiplied by the ARO.
D.asset value multiplied by the SLE.
C is the correct answer.
Justification
This is not the correct formula to calculate annual loss expectancy (ALE). ALE is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO), the number of times the enterprise expects the loss to occur.
This is not the correct formula to calculate ALE. ALE is calculated by multiplying the SLE by the ARO, the number of times the enterprise expects the loss to occur.
ALE is calculated by multiplying the SLE by the ARO (the number of times the enterprise expects the loss to occur).
This is not the correct formula to calculate ALE. ALE is calculated by multiplying the SLE by the ARO (the number of times the enterprise expects the loss to occur).
Which of the following is MOST likely to be reduced to achieve acceptable risk?
A.Risk appetite
B.Control risk
C.Residual risk
D.Inherent risk
C is the correct answer.
Justification
Risk appetite is the amount of risk that an entity is willing to accept. It does not change with risk mitigation activities.
Control risk is incurred whenever controls can fall short of their objectives and is not necessarily related to residual risk.
Residual risk is the remaining risk after management has implemented a risk response. Acceptable risk is achieved when the residual risk is reduced to the levels within the enterprise’s risk appetite.
Inherent risk is a risk that is part of an activity; it cannot be minimized, only avoided by not engaging in the activity itself.
Which of the following is the BEST way for a risk practitioner to ensure that controls are in place and effectively addressing the risk?
A.Key performance indicators
B.Control testing
C.Control monitoring
D.Key risk indicators
C is the correct answer.
Justification
Key performance indicators report on control performance. However, monitoring provides a better view of effectiveness.
Control testing is performed when the control is put in place and on an ad hoc basis. However, monitoring provides a better view of effectiveness.
Control monitoring confirms that the control is addressing the risk and operating effectively.
Key risk indicators report on control performance and could communicate a problem. However, they may not provide enough information to confirm that a problem exists.
An enterprise wants to use a cloud solution for its travel booking system that will store its employees’ information. Which of the following cloud models presents the lowest risk to the risk practitioner?
A.Hybrid
B.Private
C.Public
D.Community
B is the correct answer.
Justification
In the hybrid cloud model, the enterprise depends on third parties to protect its data.
The private cloud model presents the least risk because the data is under the control of the enterprise.
In the public cloud model, the enterprise depends on third parties to protect its data.
In the community cloud model, the enterprise depends on third parties to protect its data.
Which of the following choices is the MOST important critical success factor of implementing a risk-based approach to the system development life cycle?
A.Existence of a risk management framework
B.Defined risk mitigation strategies
C.Compliance with the change management process
D.Adequate involvement of business representatives
D is the correct answer.
Justification
The existence of a risk management framework does not necessarily ensure compliance and success during the system development life cycle.
Understanding the defined risk mitigation strategies will help the enterprise manage risk effectively; however, adequate involvement of business representatives is still required.
Although compliance with the change management process is a critical success factor (CSF) for system development, it is not the most important one.
A CSF for system development is the adequate involvement of business representatives, including management, users, quality assurance, IT, privacy, legal, audit, regulatory affairs or compliance teams in high-risk regulatory situations.
While prioritizing the risk for treatment, the IT risk practitioner should PRIMARILY consider the:
A.risk impact
B.risk appetite
C.risk exposure
D.risk rating
D is the correct answer.
Justification
The risk impact is only one component of the risk assessment and prioritization process. A high-impact event may have a low likelihood, thus resulting in a low risk rating.
The risk appetite is only one component of the risk assessment and prioritization process. Risk should be quantified to determine if it falls within the enterprise’s risk appetite; therefore, the risk rating is needed.
The risk exposure is only one component of the risk assessment and prioritization process. It may or may not be quantifiable at the time of prioritization.
The risk rating quantifies the risk by providing a ranking (for example, high, medium, low) that can be used to prioritize treatment.
Which of the following information in the risk register BEST helps in developing proper risk scenarios? A list of:
A.potential threats to assets.
B.residual risk on individual assets.
C.accepted risk.
D.security incidents.
A is the correct answer.
Justification
Identifying potential threats to business assets will help isolate vulnerabilities and associated risk, all of which contribute to developing proper risk scenarios.
Identifying residual risk on individual assets does not help develop a proper risk scenario.
Accepted risk generally reflects a small subset of entries in the risk register. Accepted risk should be included in the risk register to ensure that events continue to be monitored in case an actual incident alters current acceptance of the risk.
Previous security incidents at the enterprise itself or at entities with a similar profile may inspire the inclusion of similar risk scenarios in the risk register. However, the best approach to create a meaningful risk register is to capture potential threats on tangible and intangible assets.
Which of the following is MOST relevant to include in a cost-benefit analysis of a two-factor authentication system?
A.The approved budget of the project
B.The frequency of incidents
C.The annual loss expectancy of security incidents
D.The total cost of ownership
D is the correct answer.
Justification
The approved budget of the project may have no bearing on what the project may actually cost.
The frequency of security incidents can help measure the benefit but the relationship is indirect because not all security incidents may be mitigated by implementing a two-factor authentication system.
The ALE of incidents can help measure the benefit but the relationship is indirect because not all incidents may be mitigated by implementing a two-factor authentication system.
Total cost of ownership is the most relevant piece of information to be included in the cost-benefit analysis because it establishes a cost baseline that must be considered for the full life cycle of the control.
Which of the following BEST describes the risk-related roles and responsibilities of an organizational business unit (BU)? The BU management team:
A.owns the mitigation plan for the risk belonging to its BU, while board members are responsible for identifying and assessing risk and reporting to the appropriate support functions.
B.owns the risk and is responsible for identifying, assessing and mitigating risk, and reporting to the appropriate support functions and the board of directors.
C.carries out the respective risk-related responsibilities, but ultimate accountability for risk management and goal achievement belongs to the board of directors.
D.is ultimately accountable for risk management and goal achievement, and the board of directors owns the risk.
B is the correct answer.
Justification
The business unit (BU) management team owns both the risk management activities (identifying, assessing and reporting the mitigation plan for the risk belonging to its BU) and the reporting activities. The board members do not perform the risk identification, assessment and risk reporting functions.
The BU is responsible for owning the risk and its resulting actions. Risk owners have the responsibility of identifying, measuring, monitoring, controlling and reporting on risk to executive management as established by the corporate risk framework.
The ultimate accountability for the day-to-day work also belongs to the BU, not the board of directors.
The board members do not own the BU risk; the BU leader owns it and, along with the BU management team, is accountable for the remediation efforts.
Which of the following is a MAJOR risk associated with the use of governance, risk and compliance (GRC) tools?
A.Misinterpretation of the dashboard’s output
B.Incomplete or inaccurate coverage in the enterprise for GRC
C.Obsolescence of content
D.Complex integration of diverse requirements
C is the correct answer.
Justification
Misinterpreting the dashboard’s output is easily corrected by training or employing subject matter experts.
A governance, risk and compliance (GRC) program that is assumed to be complete but is not would misrepresent risk—for example, one that failed to explicitly state that its privileged access management did not include network devices.
A GRC application has to be updated regularly with current regulations, policies, etc. Obsolete content renders a GRC outdated. Many GRC applications are based on the unified compliance framework (UCF) for mapping to various regulations, frameworks and standards. The technology team should refresh the UCF file quarterly through its vendor and should implement processes to identify and address changes from one release to the next. Additionally, the enterprise needs to commit internal resources to maintain company data in the tool to guard against obsolescence.
Most GRC tools are designed to integrate diverse, complex requirements. Obsolete content represents a greater risk because its maintenance rests entirely with users.
