Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?

• A.User management coordination does not exists
• B.Audit recommendations may not be implemented
• C.Users may have unauthorized access to originate, modify or delete data
• D.Specific user accountability cannot be established
• E.Explanation:
  There is an increased risk without a policy defining who has the responsibility for granting access
  to specific data or systems, as one could gain system access without a justified business needs.
  There is better chance that business objectives will be properly supported when there is
  appropriate ownership.

Comment: *

Name: *

Email: *

Verification: *

What is the PRIMARY reason an organization should include background checks on roles with elevated access to production as part of its hiring process?

• A.Ensure new hires have the required skills
• B.Eliminate risk associated with personnel
• C.Reduce exposure to vulnerabilities
• D.Reduce internal threats

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?

• A.Ongoing availability of data
• B.Ability to aggregate data
• C.Availability of automated reporting systems
• D.Ability to predict trends

Comment: *

Name: *

Email: *

Verification: *

A risk practitioner has discovered a deficiency in a critical system that cannot be patched. Which of the following should be the risk practitioner's FIRST course of action?

• A.Review the business impact assessment.
• B.Submit a request to change management.
• C.Conduct a risk assessment.
• D.Report the issue to internal audit.

Comment: *

Name: *

Email: *

Verification: *

Which of the following BEST indicates the condition of a risk management program?

• A.Number of controls
• B.Level of financial support
• C.Amount of residual risk
• D.Number of risk register entries

Comment: *

Name: *

Email: *

Verification: *