Questions Flashcards
Risk policy item should have (multiple choice)
a) Scope and authority tied to risk appetite or tolerance
b) Stakeholder roles and responsibilities
c) Examples of how to process
d) Consequences
e) Always have as responsible the IT management
f) KPI of to fulfill compliance of the policy
g) Exception handling
a) Scope and authority tied to risk appetite or tolerance
b) Stakeholder roles and responsibilities
f) How policy compliance is checked and measured
d) Consequences of failing to comply with the policy
g) Means for handling policy exceptions
Which of the following statement BEST describes the relationship between threats and vulnerabilities?
a) Threats are aimed to exploit vulnerabilities
b) Threats and vulnerabilities both represent control weaknesses
c) Threat are initiated externally, while vulnerabilities exist internally
a) CORRECT Threats are aimed to exploit vulnerabilities. Which are control conditions that are deemed to be deficient relative to requirements of the threat levels being faced by the enterprise
b) INCORRECT. Vulnerabilities aline are control conditions that are deemed to be deficient relative to requirements of the threat levels being faced by the enterprise
c) INCORRECT- Threats can be external or internal. While vulnerabilities exist within IT system.
The risk of a sudden and impactful change in customer preferences for an enterprise’s core products is a primary example of
a) Strategic risk
b) Operational risk
c) Market Risk
a) CORRECT. Strategic risk involves an enterprise’s future business plans and strategies. A sudden and impactful change in customer preferences for an enterprise core products would represent a risk to these future plans and strategies, either positive or negatively
Which of the following I&T related activities is part of the second line of defense within a good governance structure
A) Establishing I&T controls to mitigate risk
B) Monitoring I&T control effectiveness
C)Managing I&T related risk
A)INCORRECT. This is the first line
B) CORRECT Monitoring I&T control effectiveness.
C)INCORRECT. This is part of the first line.
Which of the following documents empowers risk management and clearly describes how IT will be governed and managed within an enterprise?
A)IT Standard
B)IT procedure
C)IT Policy
A)INCORRECT. Standard is a mandatory requirement and are implemented to comply with the requirements and direction of an IT policy to limit risk and support efficient bus operation.
B)INCORRECT. An IT procedure contains detailed descriptions of the steps of operations to comply with the standards.
C)CORRECT. Empower risk management and should clearly state the position of senior management toward the protection of information, which allows the development of procedures, standards and baselines that reflect management priorities.
Match letters with numbers.
A)An improved understanding of operational I&T related risk-an important component of an overall I&T risk management framework
B)An improved understanding of I&T related risK and its significance in investment and portfolio management
C)More informed assessment of an enterprise’s approach to I&T risk management
1) CFO
2) Regulators
3) IT Service Managers
A)An improved understanding of operational I&T related risk-an important component of an overall I&T risk management framework MATCH WITH 3)IT Service Managers
B)An improved understanding of I&T related risK and its significance in investment and portfolio management MATCH 1)CFO
C)More informed assessment of an enterprise’s approach to I&T risk management MATCH WITH 2)Regulators
Place in order:
A-Monitoring, reporting and communicating to senior management
B-Identification of assets, common risk factor and documenting risk.
C-Context settling
D-Response and mitigation.
F-Analysis. Qualitive and quantitively analysis of impact and probability
G-Assessment. Asses and prioritize risk
C-Context settling
B-Identification of assets, common risk factor and documenting risk.
G-Assessment. Asses and prioritize
F-Analysis. Qualitive and quantitively analysis of impact and probability
D-Response and mitigation.
A-Monitoring, reporting and communicating to senior management
The selection of items included in the risk activities are generally based on understanding the full risk universe and then selecting the specific part of the enterprise to which the risk activities will be applied. This often is referred to as
A)Risk policy
B)Risk mitigation
C)Risk management
D)Risk scope
D)Risk scope
Which of the following defines, at strategic, tactical and operational levels how the risk of an enterprise need to be governed and managed pursuant to its business objectives?
A)Information security policy
B)Core IT risk policy
C)Crisis policy
D)Continuity policy
B)Core IT risk policy
Which of the following have governance authority over I&T Risk management?
A)Board of directors
B)Risk management
C)Business management
D)Senior management
A)Board of directors
Identify the most common business risk types, select all that apply:
A)Administrative B)External C)Compliance D)Strategic F)Environmental D)Market
C)Compliance
D)Strategic
F)Environmental
D)Market
Which of the following is one of the four level of risk
A)Strategic
B)Regulatory
C)Management
A)Strategic
What is an example of the first line of defense? Select all that apply
A)IT governance
B)Risk IT
C)Information Security
D)Internal Audit
A)IT governance
C)Information Security
What is an example of the second line of defense? Select all that apply
A)Compliance IT
B)Risk IT
C)Information Security
D)Internal Audit
A)Compliance IT
B)Risk IT
What is NOT an example of managerial controls.
a) Policy & procedures
b) compliance reporting
c) passwords and antivirus software
c)passwords and antivirus software
Which of the following approached to risk governance could result in an enterprise NOT taking risk that unintentionally exposes the parts of the enterprise?
A)Establishing a risk governance function to oversee the operations of risk management activities
B)Enforcing a departmental approach to risk where each department manager risk independently of other departments
C)Making risk decision only after evaluation the full range of opportunities and consequences of each decision and its impact of the enterprise
A)INCORRECT. As a part of establishing and maintaining a common view of risk, the risk governance function must oversee the
operations of the risk management team
B)CORRECT. Taking a departmental approach to risk could lead to unacceptable consequences. There must be an understanding that risk in one department or system may pose an unacceptable risk to another department or system requires the integration of risk management into the enterprise
C)Making risk decision only after evaluation the full range of opportunities and consequences of each decision and its impact of the enterprise
The effective governance and management of I&T- related risk responses are implemented and prioritized;
A)According to the ease of developing new controls over considering existing controls
B)Based on a cost/benefit analysis or where there can be greatest impact
C)Independent of the enterprise-stated risk
B)CORRECT Based on a cost/benefit analysis or where there can be greatest impact
A risk aware culture:
A)Ensures that acceptable levels of risk are understood and maintained
B)Restricts a discussion of risk to only those responsible for managing risk
C)Allows business units to voice their complaint when other business units are not meeting expectations
A) CORRECT. a risk aware culture ensures acceptable levels of risk are understood and maintained
B)INCORRECT
C)INCORRECT. Allows business units to voice their complaint when other business units are not meeting expectations. Risk aware culture should avoid blame, because it inhibits relevant and efficient communication and fails to foster collaboration trough the enterprise.
Risk scoping is used to focus risk management activities on:
A)The full risk universe that an enterprise is subject to
B)Potential high-impact risk areas throughout the enterprise
C)Only risk that the enterprise has an ability to influence.
B)CORRECT. Potential high-impact risk areas throughout the enterprise
