Who should be accountable for monitoring the control environment to ensure controls are effective?

• A.Risk owner
• B.Impacted data owner
• C.System owner
• D.Security monitoring operations

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST indication of a mature organizational risk culture?

• A.Risk owners understand and accept accountability for risk.
• B.Management encourages the reporting of policy breaches.
• C.Risk policy has been published and acknowledged by employees.
• D.Corporate risk appetite is communicated to staff members.

Comment: *

Name: *

Email: *

Verification: *

There are four inputs to the Monitoring and Controlling Project Risks process. Which one of the following will NOT help you, the project manager, to prepare for risk monitoring and controlling?

• A.Risk register
• B.Work Performance Information
• C.Project management plan
• D.Change requests
• E.Explanation:
  Change requests are not one of the four inputs to the Risk Monitoring and Controlling Process.
  The four inputs are the risk register, the project management plan, work performance information,
  and performance reports.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is true for Single loss expectancy (SLE), Annual rate of occurrence (ARO), and Annual loss expectancy (ALE)?

• A.ALE= ARO/SLE
• B.ARO= SLE/ALE
• C.ARO= ALE*SLE
• D.ALE= ARO*SLE
• E.Explanation:
  A quantitative risk assessment quantifies risk in terms of numbers such as dollar values. This involves gathering data and then entering it into standard formulas. The results can help in identifying the priority of risks. These results are also used to determine the effectiveness of controls. Some of the terms associated with quantitative risk assessments are : Single loss expectancy (SLE)-It refers to the total loss expected from a single incident. This incident can occur when vulnerability is being exploited by threat. The loss is expressed as a dollar value such as $1,000. It includes the value of data, software, and hardware. SLE = Asset value * Exposure factor Annual rate of occurrence (ARO)-It refers to the number of times expected for an incident to occur in a year. If an incident occurred twice a month in the past year, the ARO is 24. Assuming nothing changes, it is likely that it will occur 24 times next year. Annual loss expectancy (ALE)-It is the expected loss for a year. ALE is calculated by multiplying SLE with ARO. Because SLE is a given in a dollar value, ALE is also given in a dollar value. For example, if the SLE is $1,000 and the ARO is 24, the ALE is $24,000. ALE = SLE * ARO Safeguard value-This is the cost of a control. Controls are used to mitigate risk. For example, antivirus software of an average cost of $50 for each computer. If there are 50 computers, the safeguard value is $2,500.

Comment: *

Name: *

Email: *

Verification: *

Which of the following risks is the risk that happen with an important business partner and affects a large group of enterprises within an area or industry?

• A.Contagious risk
• B.Reporting risk
• C.Operational risk
• D.Systemic risk

Comment: *

Name: *

Email: *

Verification: *