Which of the following is PRIMARILY a risk management responsibly of the first line of defense?

• A.Conducting independent reviews of risk assessment results
• B.Establishing risk policies and standards
• C.Implementing risk treatment plans
• D.Validating the status of risk mitigation efforts

Comment: *

Name: *

Email: *

Verification: *

What is the BEST information to present to business control owners when justifying costs related to controls?

• A.Industry benchmarks and standards
• B.Return on IT security-related investments
• C.Loss event frequency and magnitude
• D.The previous year's budget and actuals

Comment: *

Name: *

Email: *

Verification: *

Which of the following business requirements MOST relates to the need for resilient business and information systems processes?

• A.Confidentiality
• B.Effectiveness
• C.Integrity
• D.Availability

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST approach for performing a business impact analysis (BIA) of a supply-chain management application?

• A.Circulating questionnaires to key internal stakeholders
• B.Reviewing the organization's policies and procedures
• C.Interviewing groups of key stakeholders
• D.Accepting IT personnel s view of business issues

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST indication of an effective risk management program?

• A.Residual risk is within the organizational risk appetite
• B.Risk action plans are approved by senior management.
• C.Risk is recorded and tracked in the risk register
• D.Mitigating controls are designed and implemented.

Comment: *

Name: *

Email: *

Verification: *