Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?

• A.To raise awareness of operational issues
• B.To identify control vulnerabilities
• C.To measure business exposure to risk
• D.To monitor the achievement of set objectives

Comment: *

Name: *

Email: *

Verification: *

Which of the following data would be used when performing a business impact analysis (BIA)?

• A.Expected costs for recovering the business
• B.Projected impact of current business on future business
• C.Cost of regulatory compliance
• D.Cost-benefit analysis of running the current business

Comment: *

Name: *

Email: *

Verification: *

Which of the following BEST indicates the risk appetite and tolerance level (or the risk associated with business interruption caused by IT system failures?

• A.IT system criticality classification
• B.Incident management service level agreement (SLA)
• C.Mean time to recover (MTTR)
• D.Recovery time objective (RTO)

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?

• A.Audit reports from internal information systems audits
• B.Directives from legal and regulatory authorities
• C.Trend analysis of external risk factors
• D.Automated logs collected from different systems

Comment: *

Name: *

Email: *

Verification: *

Which of the following MUST be updated to maintain an IT risk register?

• A.Risk appetite
• B.Enterprise-wide IT risk assessment
• C.Expected frequency and potential impact
• D.Risk tolerance

Comment: *

Name: *

Email: *

Verification: *