لا تريد أن تفوت شيئا؟

نصائح اجتياز امتحان الشهادة

آخر أخبار الامتحانات ومعلومات الخصم

برعاية وحديثة من قبل خبرائنا

نعم، أرسل لي النشرة الإخبارية

خذ اختبارات أخرى عبر الإنترنت
السؤال #1
An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner’s FIRST course of action?
A. eploy a compensating control to address the identified deficiencies
B. eport the ineffective control for inclusion in the next audit report
C. etermine if the impact is outside the risk appetite
D. equest a formal acceptance of risk from senior management
عرض الإجابة
اجابة صحيحة: A
السؤال #2
Which of the following will BEST quantify the risk associated with malicious users in an organization?
A. usiness impact analysis
B. hreat risk assessment
C. ulnerability assessment
D. isk analysis
عرض الإجابة
اجابة صحيحة: B
السؤال #3
Which of the following should be the PRIMARY consideration when assessing the automation of control monitoring?
A. requency of failure of control
B. ontingency plan for residual risk
C. ost-benefit analysis of automation
D. mpact due to failure of control
عرض الإجابة
اجابة صحيحة: D
السؤال #4
For which of the following risk management capability maturity levels do the statement given below is true? "Real-time monitoring of risk events and control exceptions exists, as does automation of policy management"
A. evel 3
B. evel 0
C. evel 5
D. evel 2
عرض الإجابة
اجابة صحيحة: C
السؤال #5
Which of the following is the BEST indicator of the effectiveness of a control action plan’s implementation?
A. ncreased risk appetite
B. ncreased number of controls
C. educed risk level
D. takeholder commitment
عرض الإجابة
اجابة صحيحة: C
السؤال #6
You are the project manager of a large construction project. This project will last for 18 months and will cost $750,000 to complete. You are working with your project team, experts, and stakeholders to identify risks within the project before the project work begins. Management wants to know why you have scheduled so many risk identification meetings throughout the project rather than just initially during the project planning. What is the best reason for the duplicate risk identification sessions?
A. he iterative meetings allow all stakeholders to participate in the risk identification processes throughout the project phases
B. he iterative meetings allow the project manager to discuss the risk events which have passed the project and which did not happen
C. he iterative meetings allow the project manager and the risk identification participants to identify newly discovered risk events throughout the project
D. he iterative meetings allow the project manager to communicate pending risks events during project execution
عرض الإجابة
اجابة صحيحة: C
السؤال #7
An organization operates in a jurisdiction where heavy fines are imposed for leakage of customer data. Which of the following provides the BEST input to assess the inherent risk impact?
A. umber of customer records held
B. umber of databases that host customer data
C. umber of encrypted customer databases
D. umber of staff members having access to customer data
عرض الإجابة
اجابة صحيحة: D
السؤال #8
Which of the following are the MOST important risk components that must be communicated among all the stakeholders?Each correct answer represents a part of the solution. Choose three.
A. RGC models aim at building robust, integrative inter-disciplinary governance models for emerging and existing risks
B. RGC is both a concept and a tool
C. RGC addresses the development of resilience and the capacity of organizations and people to face unavoidable risks
D. RGC addresses understanding of the secondary impacts of a risk
عرض الإجابة
اجابة صحيحة: BCD
السؤال #9
You are the project manager of the QPS project. You and your project team have identified a pure risk. You along with the key stakeholders, decided to remove the pure risk from the project by changing the project plan altogether. What is a pure risk?
A.
B.
C.
D.
عرض الإجابة
اجابة صحيحة: A
السؤال #10
Which of the following would BEST help to ensure that identified risk is efficiently managed?
A. eviewing the maturity of the control environment
B. aintaining a key risk indicator for each asset in the risk register
C. egularly monitoring the project plan
D. eriodically reviewing controls per the risk treatment plan
عرض الإجابة
اجابة صحيحة: A
السؤال #11
Which of the following risk register updates is MOST important for senior management to review?
A. voiding a risk that was previously accepted
B. xtending the date of a future action plan by two months
C. etiring a risk scenario no longer used
D. hanging a risk owner
عرض الإجابة
اجابة صحيحة: B
السؤال #12
You are the project manager of the GHY Project for your company. You need to complete a project management process that will be on the lookout for new risks, changing risks, and risks that are now outdated. Which project management process is responsible for these actions?
A. isk planning
B. isk monitoring and controlling
C. isk identification
D. isk analysis
عرض الإجابة
اجابة صحيحة: B
السؤال #13
An application owner was specified the acceptable downtime in the event of an incident to be much lower the actual time required for the response team to recover the application. Which of the following should be the NEXT course of action?
A. nvoke the disaster recovery plan during an incident
B. educe the recovery time by strengthening the response team
C. repare a cost-benefit analysis of alternatives available
D. mplement redundant infrastructure for the application
عرض الإجابة
اجابة صحيحة: C
السؤال #14
Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?
A. ssess the vulnerability management process
B. onduct a control self-assessment
C. eassess the inherent risk of the target
D. onduct a vulnerability assessment
عرض الإجابة
اجابة صحيحة: D
السؤال #15
Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?
A. decrease in the number of key controls
B. hanges in control design
C. n increase in residual risk
D. hanges in control ownership
عرض الإجابة
اجابة صحيحة: D
السؤال #16
The annualized loss expectancy (ALE) method of risk analysis:
A. ses qualitative risk rankings such as low, medium, and high
B. an be used to determine the indirect business impact
C. elps in calculating the expected cost of controls
D. an be used in a cost-benefit analysis
عرض الإجابة
اجابة صحيحة: D
السؤال #17
Which of the following would be the BEST key performance indicator (KPI) for monitoring the effectiveness of the IT asset management process?
A. ercentage of unpatched IT assets
B. he number of IT assets procured during the previous month
C. he number of IT assets securely disposed during the past year
D. ercentage of IT assets without ownership
عرض الإجابة
اجابة صحيحة: C
السؤال #18
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability management process?
A. ercentage of vulnerabilities remediated within the agreed service level
B. umber of vulnerabilities identified during the period
C. umber of vulnerabilities re-opened during the period
D. ercentage of vulnerabilities escalated to senior management
عرض الإجابة
اجابة صحيحة: A
السؤال #19
What are the requirements for creating risk scenarios? Each correct answer represents a part of the solution. (Choose three.)
A. etermination of cause and effect
B. etermination of the value of business process at risk
C. otential threats and vulnerabilities that could cause loss
D. etermination of the value of an asset
عرض الإجابة
اجابة صحيحة: BCD
السؤال #20
To help ensure the success of a major IT project, it is MOST important to:
A. btain approval from business process owners
B. btain the appropriate stakeholders’ commitment
C. pdate the risk register on a regular basis
D. lign it with the organization’s strategic plan
عرض الإجابة
اجابة صحيحة: B
السؤال #21
Which of the following is the BEST way of managing risk inherent to wireless network?
A. nabling auditing on every host that connects to a wireless network
B. equire private, key-based encryption to connect to the wireless network
C. equire that every host that connect to this network have a well-tested recovery plan
D. nable auditing on every connection to the wireless network
عرض الإجابة
اجابة صحيحة: B
السؤال #22
It is MOST appropriate for changes to be promoted to production after they are:
A. pproved by the business owner
B. ested by business owners
C. ommunicated to business management
D. nitiated by business users
عرض الإجابة
اجابة صحيحة: B
السؤال #23
Which of the following is the MOST important outcome of reviewing the risk management process?
A. mproving the competencies of employees who performed the review
B. ssuring the risk profile supports the IT objectives
C. etermining what changes should be made to IS policies to reduce risk
D. etermining that procedures used in risk assessment are appropriate
عرض الإجابة
اجابة صحيحة: B
السؤال #24
Which of the following is the BEST way to determine the ongoing efficiency of control processes?
A. nterview process owners
B. eview the risk register
C. erform annual risk assessments
D. nalyze key performance indicators (KPIs)
عرض الإجابة
اجابة صحيحة: D
السؤال #25
Which of the following items is considered as an objective of the three dimensional model within the framework described in COSO ERM?
A. isk assessment
B. inancial reporting
C. ontrol environment
D. onitoring
عرض الإجابة
اجابة صحيحة: B
السؤال #26
Reviewing results from which of the following is the BEST way to identify information systems control deficiencies?
A. ontrol self-assessment (CSA)
B. ulnerability and threat analysis
C. ser acceptance testing (UAT)
D. ontrol remediation planning
عرض الإجابة
اجابة صحيحة: B
السؤال #27
The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:
A. ackup recovery requests
B. esources to monitor backups
C. estoration monitoring reports
D. ecurring restore failures
عرض الإجابة
اجابة صحيحة: C
السؤال #28
Which of the following considerations should be taken into account while selecting risk indicators that ensures greater buy-in and ownership?
A. ag indicator
B. ead indicator
C. oot cause
D. takeholder
عرض الإجابة
اجابة صحيحة: D
السؤال #29
Which of the following is the BEST control to detect an advanced persistent threat (APT)?
A. onitoring social media activities
B. onducting regular penetration tests
C. tilizing antivirus systems and firewalls
D. mplementing automated log monitoring
عرض الإجابة
اجابة صحيحة: B
السؤال #30
Which of the following is the process of numerically analyzing the effects of identified risks on the overall enterprise's objectives?
A. dentifying Risks
B. uantitative Risk Assessment
C. ualitative Risk Assessment
D. onitoring and Controlling Risks
عرض الإجابة
اجابة صحيحة: B
السؤال #31
For the first time, the procurement department has requested that IT grant remote access to third-party suppliers. Which of the following is the BEST course of action for IT in responding to the request?
A. ropose a solution after analyzing IT risk
B. esign and implement key authentication controls
C. esign and implement a secure remote access process
D. dequate internal standards to fit the new business case
عرض الإجابة
اجابة صحيحة: A
السؤال #32
To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:
A. isk assessment results
B. ost-benefit analysis
C. ulnerability assessment results
D. isk mitigation approach
عرض الإجابة
اجابة صحيحة: A
السؤال #33
Using which of the following one can produce comprehensive result while performing qualitative risk analysis?
A. cenarios with threats and impacts
B. ost-benefit analysis
C. alue of information assets
D. ulnerability assessment
عرض الإجابة
اجابة صحيحة: A
السؤال #34
A risk practitioner is assisting with the preparation of a report on the organization’s disaster recovery (DR) capabilities. Which information would have the MOST impact on the overall recovery profile?
A. he percentage of systems meeting recovery target times has increased
B. he number of systems requiring a recovery plan has increased
C. he number of systems tested in the last year has increased
D. he percentage of systems with long recovery target times has decreased
عرض الإجابة
اجابة صحيحة: B
السؤال #35
Which of the following business requirements MOST relates to the need for resilient business and information systems processes?
A. onfidentiality
B. ffectiveness
C. ntegrity
D. vailability
عرض الإجابة
اجابة صحيحة: D
السؤال #36
The PRIMARY benefit of maintaining an up-to-date risk register is that it helps to:
A. nsure business unit risk uniformly distributed
B. uild a risk profile for management review
C. uantify the organization’s risk appetite
D. mplement uniform controls for common risk scenarios
عرض الإجابة
اجابة صحيحة: B
السؤال #37
What type of policy would an organization use to forbid its employees from using organizational e-mail for personal use?
A. nti-harassment policy
B. cceptable use policy
C. ntellectual property policy
D. rivacy policy
عرض الإجابة
اجابة صحيحة: B
السؤال #38
When reviewing management’s IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?
A. ropose mitigating controls
B. ssess management’s risk tolerance
C. ecommend management accept the low risk scenarios
D. e-evaluate the risk scenarios associated with the control
عرض الإجابة
اجابة صحيحة: A
السؤال #39
You are the project manager of GHT project. You have applied certain control to prevent the unauthorized changes in your project. Which of the following control you would have applied for this purpose?
A. ersonnel security control
B. ccess control
C. onfiguration management control
D. hysical and environment protection control
عرض الإجابة
اجابة صحيحة: C
السؤال #40
Which of the following is the PRIMARY purpose of analyzing log data collected from systems?
A. o identify risk that may materialize
B. o facilitate incident investigation
C. o detect changes in risk ownership
D. o prevent incidents caused by materialized risk
عرض الإجابة
اجابة صحيحة: A
السؤال #41
Which of the following is the MOST important key performance indicator (KPI) to establish in the service agreement (SLA) for an outsourced data center?
A. umber of key systems hosted
B. ercentage of system availability
C. verage response time to resolve system incidents
D. ercentage of systems included in recovery processes
عرض الإجابة
اجابة صحيحة: B
السؤال #42
The MOST effective approach to prioritize risk scenarios is by:
A. ssessing impact to the strategic plan
B. oliciting input from risk management experts
C. ligning with industry best practices
D. valuating the cost of risk response
عرض الإجابة
اجابة صحيحة: A
السؤال #43
Which of the following is the MOST effective way to mitigate identified risk scenarios?
A. ocument the risk tolerance of the organization
B. ssign ownership of the risk response plan
C. rovide awareness in early detection of risk
D. erform periodic audits on identified risk areas
عرض الإجابة
اجابة صحيحة: D
السؤال #44
Suppose you are working in Techmart Inc. which sells various products through its website. Due to some recent losses, you are trying to identify the most important risks to the Website. Based on feedback from several experts, you have come up with a list. You now want to prioritize these risks. Now in which category you would put the risk concerning the modification of the Website by unauthorized parties.
A. ing Flooding Attack
B. eb defacing
C. enial of service attack
D. TP Bounce Attack
عرض الإجابة
اجابة صحيحة: B
السؤال #45
You are the project manager of GHT project. You have analyzed the risk and applied appropriate controls. In turn, you got residual risk as a result of this. Residual risk can be used to determine which of the following?
A. ssue
B. ontingency response
C. rigger
D. hreshold
عرض الإجابة
اجابة صحيحة: CD
السؤال #46
You are working in Bluewell Inc. which make advertisement Websites. Someone had made unauthorized changes to your Website. Which of the following terms refers to this type of loss?
A. oss of confidentiality
B. oss of integrity
C. oss of availability
D. oss of revenue
عرض الإجابة
اجابة صحيحة: B
السؤال #47
For a large software development project, risk assessments are MOST effective when performed:
A. uring the development of the business case
B. t each stage of the SDLC
C. t system development
D. efore system development begins
عرض الإجابة
اجابة صحيحة: B
السؤال #48
You are the project manager of HGT project. You are in the first phase of the risk response process and are doing following tasks:-Communicating risk analysis results-Reporting risk management activities and the state of compliance Interpreting independent risk assessment findings-Identifying business opportunitiesWhich of the following process are you performing?
A. rticulating risk
B. itigating risk
C. racking risk
D. eporting risk
عرض الإجابة
اجابة صحيحة: A
السؤال #49
You are working in an enterprise. Assuming that your enterprise periodically compares finished goods inventory levels to the perpetual inventories in its ERP system. What kind of information is being provided by the lack of any significant differences between perpetual levels and actual levels?
A. irect information
B. ndirect information
C. isk management plan
D. isk audit information
عرض الإجابة
اجابة صحيحة: B
السؤال #50
How are the potential choices of risk based decisions are represented in decision tree analysis?
A. takeholder management strategy
B. essons learned documentation
C. isk register
D. isk management plan
عرض الإجابة
اجابة صحيحة: D
السؤال #51
Which of the following is the MOST effective way to incorporate stakeholder concerns when developing risk scenarios?
A. valuating risk impact
B. reating quarterly risk reports
C. stablishing key performance indicators
D. onducting internal audits
عرض الإجابة
اجابة صحيحة: C
السؤال #52
From a business perspective, which of the following is the MOST important objective of a disaster recovery test?
A. ll business critical systems are successfully tested
B. rrors are discovered in the disaster recovery process
C. ll critical data is recovered within recovery time objectives (RTOs)
D. he organization gains assurance it can recover from a disaser
عرض الإجابة
اجابة صحيحة: C
السؤال #53
A risk practitioner has observed that risk owners have approved a high number of exceptions to the information security policy. Which of the following should be the risk practitioner’s GREATEST concern?
A. ggregate risk approaching the tolerance threshold
B. ulnerabilities are not being mitigated
C. ecurity policies are not being reviewed periodically
D. isk owners are focusing more on efficiency
عرض الإجابة
اجابة صحيحة: A
السؤال #54
Which of the following is the priority of data owners when establishing risk mitigation method?
A. ser entitlement changes
B. latform security
C. ntrusion detection
D. ntivirus controls
عرض الإجابة
اجابة صحيحة: A
السؤال #55
Which of the following would BEST help secure online financial transactions from improper users?
A. ulti-factor authentication
B. eriodic review of audit trails
C. ulti-level authorization
D. eview of log-in attempts
عرض الإجابة
اجابة صحيحة: A
السؤال #56
A risk practitioner has determined that a key control does not meet design expectations. Which of the following should be done NEXT?
A. nvoke the incident response plan
B. odify the design of the control
C. ocument the finding in the risk register
D. e-evaluate key risk indicators
عرض الإجابة
اجابة صحيحة: C
السؤال #57
Which of the following is an example of the second line in the three lines of defense model?
A. xternal auditors
B. nternal auditors
C. isk management committee
D. isk owners
عرض الإجابة
اجابة صحيحة: C
السؤال #58
The GREATEST concern when maintaining a risk register is that:
A. xecutive management does not perform periodic reviews
B. ignificant changes in risk factors are excluded
C. T risk is not linked with IT assets
D. mpacts are recorded in qualitative terms
عرض الإجابة
اجابة صحيحة: B
السؤال #59
Which of the following aspect of monitoring tool ensures that the monitoring tool has the ability to keep up with the growth of an enterprise?
A. calability
B. ustomizability
C. ustainability
D. mpact on performance
عرض الإجابة
اجابة صحيحة: A
السؤال #60
Which of the following documents is described in the statement below?"It is developed along with all processes of the risk management. It contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning."
A. eduction in the frequency of a threat
B. inimization of inherent risk
C. eduction in the impact of a threat
D. inimization of residual risk
عرض الإجابة
اجابة صحيحة: C
السؤال #61
Which of the following terms is described in the statement below?"They are the prime monitoring indicators of the enterprise, and are highly relevant and possess a high probability of predicting or indicating important risk."
A. ey risk indicators
B. ag indicators
C. ead indicators
D. isk indicators
عرض الإجابة
اجابة صحيحة: A
السؤال #62
To implement the MOST effective monitoring of key risk indicators (KRIs), which of the following needs to be in place?
A. utomated data feed
B. ontrols monitoring
C. scalation procedures
D. hreshold definition
عرض الإجابة
اجابة صحيحة: B
السؤال #63
Which among the following acts as a trigger for risk response process?
A.
B. nfinity
C. 0
D.
عرض الإجابة
اجابة صحيحة: B
السؤال #64
You are the IT manager in Bluewell Inc. You identify a new regulation for safeguarding the information processed by a specific type of transaction. What would be the FIRST action you will take?
A. ssess whether existing controls meet the regulation
B. pdate the existing security privacy policy
C. eet with stakeholders to decide how to comply
D. nalyze the key risk in the compliance process
عرض الإجابة
اجابة صحيحة: A
السؤال #65
Which of the following role carriers has to account for collecting data on risk and articulating risk?
A. nterprise risk committee
B. usiness process owner
C. hief information officer (CIO)
D. hief risk officer (CRO)
عرض الإجابة
اجابة صحيحة: D
السؤال #66
Which of the following interpersonal skills has been identified as one of the biggest reasons for project success or failure?
A. otivation
B. nfluencing
C. ommunication
D. olitical and cultural awareness
عرض الإجابة
اجابة صحيحة: C
السؤال #67
Which of the following would BEST help identify the owner for each risk scenario in a risk register?
A. llocating responsibility for risk factors equally to asset owners
B. etermining resource dependency of assets
C. apping identified risk factors to specific business processes
D. etermining which departments contribute most to risk
عرض الإجابة
اجابة صحيحة: C
السؤال #68
Wendy has identified a risk event in her project that has an impact of $75,000 and a 60 percent chance of happening. Through research, her project team learns that the risk impact can actually be reduced to just $15,000 with only a ten percent chance of occurring. The proposed solution will cost $25,000. Wendy agrees to the $25,000 solution. What type of risk response is this?
A. itigation
B. voidance
C. ransference
D. nhancing
عرض الإجابة
اجابة صحيحة: A
السؤال #69
Which of the following processes is described in the statement below?"It is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions."
A. isk governance
B. isk identification
C. isk response planning
D. isk communication
عرض الإجابة
اجابة صحيحة: D
السؤال #70
You are the risk professional in Bluewell Inc. You have identified a risk and want to implement a specific risk mitigation activity. What you should PRIMARILY utilize?
A. ulnerability assessment report
B. usiness case
C. echnical evaluation report
D. udgetary requirements
عرض الإجابة
اجابة صحيحة: B
السؤال #71
Which of the following is the MAIN reason to continuously monitor IT-related risk?
A. o ensure risk levels are within acceptable limits of the organization’s risk appetite and risk tolerance
B. o redefine the risk appetite and risk tolerance levels based on changes in risk factors
C. o help identify root causes of incidents and recommend suitable long-term solutions
D. o update the risk register to reflect changes in levels of identified and new IT-related risk
عرض الإجابة
اجابة صحيحة: A
السؤال #72
An organization has just started accepting credit card payments from customers via the corporate website. Which of the following is MOST likely to increase as a result of this new initiative?
A. isk appetite
B. esidual risk
C. isk tolerance
D. nherent risk
عرض الإجابة
اجابة صحيحة: D
السؤال #73
A risk owner should be the person accountable for:
A. mplementing actions
B. anaging controls
C. he risk management process
D. he business process
عرض الإجابة
اجابة صحيحة: A
السؤال #74
An effective control environment is BEST indicated by controls that:
A. inimize senior management’s risk tolerance
B. anage risk within the organization’s risk appetite
C. re cost-effective to implement
D. educe the thresholds of key risk indicators (KRIs)
عرض الإجابة
اجابة صحيحة: D
السؤال #75
Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?
A. onitoring key access control performance indicators
B. pdating multi-factor authentication
C. nalyzing access control logs for suspicious activity
D. evising the service level agreement (SLA)
عرض الإجابة
اجابة صحيحة: A
السؤال #76
Accountability for a particular risk is BEST represented in a:
A. isk register
B. ACI matrix
C. isk catalog
D. isk scenario
عرض الإجابة
اجابة صحيحة: B
السؤال #77
You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk, the response adopted is re- architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?
A. eferrals
B. uick win
C. usiness case to be made
D. ontagious risk
عرض الإجابة
اجابة صحيحة: C
السؤال #78
The MOST important characteristic of an organization’s policies is to reflect the organization’s:
A. isk appetite
B. apabilities
C. sset value
D. isk assessment methodology
عرض الإجابة
اجابة صحيحة: A
السؤال #79
Which of the following BEST measures the operational effectiveness of risk management capabilities?
A. apability maturity models (CMMs)
B. etric thresholds
C. ey risk indicators (KRIs)
D. ey performance indicators (KPIs)
عرض الإجابة
اجابة صحيحة: D
السؤال #80
The PRIMARY reason, a risk practitioner would be interested in an internal audit report is to:
A. aintain a risk register based on noncompliances
B. lan awareness programs for business managers
C. ssist in the development of a risk profile
D. valuate maturity of the risk management process
عرض الإجابة
اجابة صحيحة: D
السؤال #81
An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST?
A. he risk owner who also owns the business service enabled by this infrastructure
B. he site manager who is required to provide annual risk assessments under the contract
C. he data center manager who is also employed under the managed hosting services contract
D. he chief information officer (CIO) who is responsible for the hosted services
عرض الإجابة
اجابة صحيحة: A
السؤال #82
You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events. Where will you record the mitigation response?
A. isk register
B. isk log
C. roject management plan
D. isk management plan
عرض الإجابة
اجابة صحيحة: A
السؤال #83
You are the project manager of the GHT project. You are accessing data for further analysis. You have chosen such a data extraction method in which management monitors its own controls. Which of the following data extraction methods you are using here?
A. xtracting data directly from the source systems after system owner approval
B. xtracting data from the system custodian (IT) after system owner approval
C. xtracting data from risk register
D. xtracting data from lesson learned register
عرض الإجابة
اجابة صحيحة: A
السؤال #84
Which of the following should be the PRIMARY objective of a risk awareness training program?
A. o promote awareness of the risk governance function
B. o clarify fundamental risk management principles
C. o enable risk-based decision making
D. o ensure sufficient resources are available
عرض الإجابة
اجابة صحيحة: A
السؤال #85
The BEST method to align an organization’s business continuity plan (BCP) and disaster recovery plan (DRP) with core business needs to:
A. utsource the maintenance of the BCP and DRP to a third party
B. nclude BCP and DRP responsibilities as part of the new employee training
C. xecute periodic walk-throughs of the BCP and DRP
D. pdate the business impact analysis (BIA) for significant business changes
عرض الإجابة
اجابة صحيحة: C
السؤال #86
A data processing center operates in a jurisdiction where new regulations have significantly increased penalties for data breaches. Which of the following elements of the risk register is MOST important to update to reflect this change?
A. isk impact
B. isk trend
C. isk appetite
D. isk likelihood
عرض الإجابة
اجابة صحيحة: C
السؤال #87
During an IT department reorganization, the manager of a risk mitigation action plan was replaced. The new manager has begun implementing a new control after identifying a more effective option. Which of the following is the risk practitioner’s BEST course of action?
A. ommunicate the decision to the risk owner for approval
B. dentify an owner for the new control
C. odify the action plan in the risk register
D. eek approval from the previous action plan manager
عرض الإجابة
اجابة صحيحة: B
السؤال #88
Jeff works as a Project Manager for www.company.com Inc. He and his team members are involved in the identify risk process. Which of the following tools & techniques will Jeff use in the identify risk process?Each correct answer represents a complete solution. (Choose three.)
A. ary will schedule when the identified risks are likely to happen and affect the project schedule
B. ary will utilize the schedule controls and the nature of the schedule for the quantitative analysis of the schedule
C. ary will use the schedule management plan to schedule the risk identification meetings throughout the remaining project
D. ary will utilize the schedule controls to determine how risks may be allowed to change the project schedule
عرض الإجابة
اجابة صحيحة: ABC
السؤال #89
The FIRST task when developing a business continuity plan should be to:
A. dentify critical business functions and resources
B. etermine data backup and recovery availability at an alternate site
C. efine roles and responsibilities for implementation
D. dentify recovery time objectives (RTOs) for critical business applications
عرض الإجابة
اجابة صحيحة: A
السؤال #90
In addition to the risk register, what should a risk practitioner review to develop an understanding of the organization’s risk profile?
A. he asset profile
B. usiness objectives
C. he control catalog
D. ey risk indicators (KRIs)
عرض الإجابة
اجابة صحيحة: D
السؤال #91
Your project change control board has approved several scope changes that will drastically alter your project plan. You and the project team set about updating the project scope, the WBS, the WBS dictionary, the activity list, and the project network diagram. There are also some changes caused to the project risks, communication, and vendors. What also should the project manager update based on these scope changes?
A. ransaction data
B. rocess integrity
C. onfiguration settings
D. ystem changes
عرض الإجابة
اجابة صحيحة: C
السؤال #92
Which of the following laws applies to organizations handling health care information?
A. LBA
B. IPAA
C. OX
D. ISMA
عرض الإجابة
اجابة صحيحة: B
السؤال #93
You are the project manager of your enterprise. You have introduced an intrusion detection system for the control. You have identified a warning of violation of security policies of your enterprise. What type of control is an intrusion detection system (IDS)?
A. etective
B. orrective
C. reventative
D. ecovery
عرض الإجابة
اجابة صحيحة: A
السؤال #94
What can be determined from the risk scenario chart?
A. he multiple risk factors addressed by a chosen response
B. elative positions on the risk map
C. apability of enterprise to implement
D. isk treatment options
عرض الإجابة
اجابة صحيحة: A
السؤال #95
Which of the following parameters are considered for the selection of risk indicators? Each correct answer represents a part of the solution. Choose three.
A. anagement approval
B. ontinued awareness activities
C. ommunication to employees
D. aintenance and review
عرض الإجابة
اجابة صحيحة: ABD
السؤال #96
Quantifying the value of a single asset helps the organization to understand the:
A. ecessity of developing a risk strategy
B. onsequences of risk materializing
C. rganization’s risk threshold
D. verall effectiveness of risk management
عرض الإجابة
اجابة صحيحة: A
السؤال #97
Which of the following are true for threats?Each correct answer represents a complete solution. Choose three.
A. minimum threshold of information security controls that must be implemented
B. checklist of steps that must be completed to ensure information security
C. n overall statement of information security scope and direction
D. technology-dependent statement of best practices
عرض الإجابة
اجابة صحيحة: ABD
السؤال #98
Which of the following is the PRIMARY requirement before choosing Key performance indicators of an enterprise?
A. etermine size and complexity of the enterprise
B. rioritize various enterprise processes
C. etermine type of market in which the enterprise operates
D. nterprise must establish its strategic and operational goals
عرض الإجابة
اجابة صحيحة: D
السؤال #99
You are the project manager of your enterprise. You have identified several risks. Which of the following responses to risk is considered the MOST appropriate?
A. ny of the above
B. nsuring
C. voiding
D. ccepting
عرض الإجابة
اجابة صحيحة: A
السؤال #100
You work as a project manager for BlueWell Inc. You have declined a proposed change request because of the risk associated with the proposed change request. Where should the declined change request be documented and stored?
A. hange request log
B. roject archives
C. essons learned
D. roject document updates
عرض الإجابة
اجابة صحيحة: A
السؤال #101
Which of the following is the MOST important requirement for monitoring key risk indicators (KRIs) using log analysis?
A. ollecting logs from the entire set of IT systems
B. roviding accurate logs in a timely manner
C. mplementing an automated log analysis tool
D. btaining logs in an easily readable format
عرض الإجابة
اجابة صحيحة: A
السؤال #102
Which of the following BEST indicates the effectiveness of an organization’s data loss prevention (DLP) program?
A. eduction in financial impact associated with data loss incidents
B. eduction in the number of false positives and false negatives
C. eduction in the number of approved exceptions to the DLP policy
D. eduction in the severity of detected data loss events
عرض الإجابة
اجابة صحيحة: D
السؤال #103
When developing risk scenarios, it is MOST important to ensure they are:
A. tructured and reportable
B. lexible and scalable
C. elevant and realistic
D. omprehensive and detailed
عرض الإجابة
اجابة صحيحة: C
السؤال #104
A risk practitioner is organizing a training session to communicate risk assessment methodologies to ensure a consistent risk view within the organization. Which of the following is the MOST important topic to cover in this training?
A. pplying risk factors
B. pplying risk appetite
C. nderstanding risk culture
D. eferencing risk event data
عرض الإجابة
اجابة صحيحة: C
السؤال #105
An organization has raised the risk appetite for technology risk. The MOST likely result would be:
A. ower risk management cost
B. ecreased residual risk
C. igher risk management cost
D. ncreased inherent risk
عرض الإجابة
اجابة صحيحة: B
السؤال #106
Which among the following is the MOST crucial part of risk management process?
A. isk communication
B. uditing
C. isk monitoring
D. isk mitigation
عرض الإجابة
اجابة صحيحة: A
السؤال #107
Which of the following is the BEST indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees?
A. n increase in the number of identified system flaws
B. reduction in the number of help desk calls
C. n increase in the number of incidents reported
D. reduction in the number of user access resets
عرض الإجابة
اجابة صحيحة: C
السؤال #108
Which of the following would provide the BEST guidance when selecting an appropriate risk treatment plan?
A. eturn on investment
B. isk mitigation budget
C. ost-benefit analysis
D. usiness impact analysis
عرض الإجابة
اجابة صحيحة: C
السؤال #109
Which of the following is true for risk evaluation?
A. isk evaluation is done only when there is significant change
B. isk evaluation is done once a year for every business processes
C. isk evaluation is done annually or when there is significant change
D. isk evaluation is done every four to six months for critical business processes
عرض الإجابة
اجابة صحيحة: C
السؤال #110
An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?
A. rocess owner
B. nternal auditor
C. isk manager
D. roject sponsor
عرض الإجابة
اجابة صحيحة: C
السؤال #111
What are the PRIMARY requirements for developing risk scenarios? Each correct answer represents a part of the solution. Choose two.
A. ontract change control system
B. cope change control system
C. ost change control system
D. chedule change control system
عرض الإجابة
اجابة صحيحة: AB
السؤال #112
Which of the following should an organization perform to forecast the effects of a disaster?
A. nalyze capability maturity model gaps
B. efine recovery time objectives (RTO)
C. evelop a business impact analysis (BIA)
D. imulate a disaster recovery
عرض الإجابة
اجابة صحيحة: D
السؤال #113
Which of the following data would be used when performing a business impact analysis (BIA)?
A. ost of regulatory compliance
B. xpected costs for recovering the business
C. ost-benefit analysis of running the current business
D. rojected impact of current business on future business
عرض الإجابة
اجابة صحيحة: B
السؤال #114
Which of the following provides the BEST evidence of the effectiveness of an organization’s account provisioning process?
A. ser provisioning
B. ecurity log monitoring
C. ntitlement reviews
D. ole-based access controls
عرض الإجابة
اجابة صحيحة: A
السؤال #115
You are the project manager of HJT project. Important confidential files of your project are stored on a computer. Keeping the unauthorized access of this computer in mind, you have placed a hidden CCTV in the room, even on having protection password. Which kind of control CCTV is?
A. echnical control
B. hysical control
C. dministrative control
D. anagement control
عرض الإجابة
اجابة صحيحة: B
السؤال #116
The BEST way to justify the risk mitigation actions recommended in a risk assessment would be to:
A. ocus on the business drivers
B. eference best practice
C. enchmark with competitor’s actions
D. lign with audit results
عرض الإجابة
اجابة صحيحة: A
السؤال #117
What is the BEST information to present to business control owners when justifying costs related to controls?
A. eturn on IT security-related investments
B. he previous year’s budget and actuals
C. ndustry benchmarks and standards
D. oss event frequency and magnitude
عرض الإجابة
اجابة صحيحة: D
السؤال #118
What is the value of exposure factor if the asset is lost completely?
A. nhancing
B. ositive
C. pportunistic
D. xploiting
عرض الإجابة
اجابة صحيحة: A
السؤال #119
Which of the following should be the PRIMARY input when designing IT controls?
A. nternal and external risk reports
B. utcome of control self-assessments
C. enchmark of industry standards
D. ecommendations from IT risk experts
عرض الإجابة
اجابة صحيحة: A
السؤال #120
Which of the following should be the risk practitioner’s PRIMARY focus when determining whether controls are adequate to mitigate risk?
A. ost-benefit analysis
B. ensitivity analysis
C. evel of residual risk
D. isk appetite
عرض الإجابة
اجابة صحيحة: D
السؤال #121
As part of an overall IT risk management plan, an IT risk register BEST helps management:
A. tay current with existing control status
B. lign IT processes with business objectives
C. nderstand the organizational risk profile
D. ommunicate the enterprise risk management policy
عرض الإجابة
اجابة صحيحة: A
السؤال #122
When reviewing a business continuity plan (BCP), which of the following would be the MOST significant deficiency?
A. CP is often tested using the walkthrough method
B. CP testing is not in conjunction with the disaster recovery plan (DRP)
C. ach business location has separate, inconsistent BCPs
D. ecovery time objectives (RTOs) do not meet business requirements
عرض الإجابة
اجابة صحيحة: B
السؤال #123
Which of the following activities would BEST facilitate effective risk management throughout the organization?
A. erforming a business impact analysis
B. erforming frequent audits
C. eviewing risk-related process documentation
D. onducting periodic risk assessments
عرض الإجابة
اجابة صحيحة: A
السؤال #124
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery plan (DRP)?
A. ercentage of issues related as a result of DRP testing
B. umber of users that participated in the DRP testing
C. umber of issues identified during DRP testing
D. ercentage of applications that met the RTO during DRP testing
عرض الإجابة
اجابة صحيحة: D
السؤال #125
Which of the following is prepared by the business and serves as a starting point for producing the IT Service Continuity Strategy?
A. usiness Continuity Strategy
B. ndex of Disaster-Relevant Information
C. isaster Invocation Guideline
D. vailability/ ITSCM/ Security Testing Schedule
عرض الإجابة
اجابة صحيحة: A
السؤال #126
Which of the following risk responses include feedback and guidance from well-qualified risk officials and those internal to the project?
A. ontingent response strategy
B. isk Acceptance
C. xpert judgment
D. isk transfer
عرض الإجابة
اجابة صحيحة: C
السؤال #127
Your company is covered under a liability insurance policy, which provides various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc. Which of the following risk management techniques is your company using?
A. nvolve subject matter experts in the risk analysis activities
B. nvolve the stakeholders for risk identification only in the phases where the project directly affects them
C. se qualitative risk analysis to quickly assess the probability and impact of risk events
D. ocus on the high-priority risks through qualitative risk analysis
عرض الإجابة
اجابة صحيحة: A
السؤال #128
You work as a project manager for BlueWell Inc. You have declined a proposed change request because of the risk associated with the proposed change request. Where should the declined change request be documented and stored?
A. hange request log
B. roject archives
C. essons learned
D. roject document updates
عرض الإجابة
اجابة صحيحة: A
السؤال #129
An organization is planning to engage a cloud-based service provider for some of its data-intensive business processes. Which of the following is MOST important to help define the IT risk associated with this outsourcing activity?
A. ervice level agreement
B. ight to audit the provider
C. ustomer service reviews
D. cope of services provided
عرض الإجابة
اجابة صحيحة: A
السؤال #130
Which of the following should be the MOST important consideration when determining controls necessary for a highly critical information system?
A. he number of vulnerabilities to the system
B. he level of acceptable risk to the organization
C. he organization’s available budget
D. he number of threats to the system
عرض الإجابة
اجابة صحيحة: A
السؤال #131
A risk assessment has identified that an organization may not be in compliance with industry regulations. The BEST course of action would be to:
A. ollaborate with management to meet compliance requirements
B. onduct a gap analysis against compliance criteria
C. dentify necessary controls to ensure compliance
D. odify internal assurance activities to include control validation
عرض الإجابة
اجابة صحيحة: A
السؤال #132
If one says that the particular control or monitoring tool is sustainable, then it refers to what ability?
A. he ability to adapt as new elements are added to the environment
B. he ability to ensure the control remains in place when it fails
C. he ability to protect itself from exploitation or attack
D. he ability to be applied in same manner throughout the organization
عرض الإجابة
اجابة صحيحة: A
السؤال #133
Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?
A. onduct a control assessment
B. urchase cyber insurance from a third party
C. ncrease the frequency of incident reporting
D. nhance the security awareness program
عرض الإجابة
اجابة صحيحة: A
السؤال #134
Which of the following statements are true for enterprise's risk management capability maturity level 3?
A. usiness management
B. usiness process owner
C. hief information officer (CIO)
D. hief risk officer (CRO)
عرض الإجابة
اجابة صحيحة: ABD
السؤال #135
John is the project manager of the NHQ Project for his company. His project has 75 stakeholders, some of which are external to the organization. John needs to make certain that he communicates about risk in the most appropriate method for the external stakeholders. Which project management plan will be the best guide for John to communicate to the external stakeholders?
A. isk Response Plan
B. ommunications Management Plan
C. roject Management Plan
D. isk Management Plan
عرض الإجابة
اجابة صحيحة: B
السؤال #136
An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. Which risk treatment was adopted by the organization?
A. cceptance
B. ransfer
C. itigation
D. voidance
عرض الإجابة
اجابة صحيحة: A
السؤال #137
Employees are repeatedly seen holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges. This behavior BEST represents:
A. vulnerability
B. control
C. n impact
D. threat
عرض الإجابة
اجابة صحيحة: A
السؤال #138
Which of the following is MOST important when developing key risk indicators (KRIs)?
A. vailability of qualitative data
B. lignment with regulatory requirements
C. roperty set thresholds
D. lignment with industry benchmarks
عرض الإجابة
اجابة صحيحة: B
السؤال #139
Which of the following issues regarding an organization's IT incident response plan would be the GREATEST concern?
A. he incident response capability is outsourced
B. eams are not operational until an incident occurs
C. ot all employees have attended incident response training
D. oles and responsibilities are not clearly defined
عرض الإجابة
اجابة صحيحة: D
السؤال #140
What is the most important benefit of classifying information assets?
A. inking security requirements to business objectives
B. llotting risk ownership
C. efining access rights
D. dentifying controls that should be applied
عرض الإجابة
اجابة صحيحة: D
السؤال #141
When reviewing a risk response strategy, senior management’s PRIMARY focus should be placed on the:
A. nvestment portfolio
B. lignment with risk appetite
C. ey performance indicators (KPIs)
D. ost-benefit analysis
عرض الإجابة
اجابة صحيحة: D
السؤال #142
What is the PRIMARY need for effectively assessing controls?
A. ontrol's alignment with operating environment
B. ontrol's design effectiveness
C. ontrol's objective achievement
D. ontrol's operating effectiveness
عرض الإجابة
اجابة صحيحة: C
السؤال #143
You are the project manager of the GHY project for your company. This project has a budget of $543,000 and is expected to last 18 months. In this project, you have identified several risk events and created risk response plans. In what project management process group will you implement risk response plans?
A. isk response
B. onitoring and Control Risk
C. uantitative risk assessment
D. ualitative risk assessment
عرض الإجابة
اجابة صحيحة: A
السؤال #144
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti- virus program?
A. requency of anti-virus software updates
B. umber of alerts generated by the anti-virus software
C. ercentage of IT assets with current malware definitions
D. umber of false positives detected over a period of time
عرض الإجابة
اجابة صحيحة: C
السؤال #145
Which of the following is MOST effective in continuous risk management process improvement?
A. olicy updates
B. eriodic assessments
C. wareness training
D. hange management
عرض الإجابة
اجابة صحيحة: B
السؤال #146
An organization's chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner's BEST course of action is to:
A. alidate the CTO's decision wish the business process owner
B. ecommend that the CTO revisit the risk acceptance decision
C. dentify key risk indicators (KRIs) for ongoing monitoring
D. pdate the risk register with the selected risk response
عرض الإجابة
اجابة صحيحة: A
السؤال #147
Which of the following is true for Single loss expectancy (SLE), Annual rate of occurrence (ARO), and Annual loss expectancy (ALE)?
A. LE= ARO/SLE
B. RO= SLE/ALE
C. RO= ALE*SLE
D. LE= ARO*SLE
عرض الإجابة
اجابة صحيحة: D
السؤال #148
The BEST criteria when selecting a risk response is the:
A. ffectiveness of risk response options
B. lignment of response to industry standards
C. mportance of IT risk within the enterprise
D. apability to implement the response
عرض الإجابة
اجابة صحيحة: A
السؤال #149
Which of the following is the BEST method to identify unnecessary controls?
A. valuating existing controls against audit requirements
B. eviewing system functionalities associated with business processes
C. onitoring existing key risk indicators (KRIs)
D. valuating the impact of removing existing controls
عرض الإجابة
اجابة صحيحة: B
السؤال #150
The best way to test the operational effectiveness of a data backup procedure is to:
A. nspect a selection of audit trails and backup logs
B. onduct an audit of files stored offsite
C. emonstrate a successful recovery from backup files
D. nterview employees to compare actual with expected procedures
عرض الإجابة
اجابة صحيحة: C
السؤال #151
Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact?
A. ost-benefit analysis
B. ndent probability
C. isk magnitude
D. isk appetite
عرض الإجابة
اجابة صحيحة: C
السؤال #152
Fred is the project manager of a large project in his organization. Fred needs to begin planning the risk management plan with the project team and key stakeholders. Which plan risk management process tool and technique should Fred use to plan risk management?
A. nformation gathering techniques
B. ata gathering and representation techniques
C. lanning meetings and analysis
D. ariance and trend analysis
عرض الإجابة
اجابة صحيحة: C
السؤال #153
Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?
A. ontinuous monitoring and alerting
B. ccess controls and active logging
C. onfiguration management
D. ulnerability scanning
عرض الإجابة
اجابة صحيحة: A
السؤال #154
Which of the following is the way to verify control effectiveness?
A. he capability of providing notification of failure
B. hether it is preventive or detective
C. ts reliability
D. he test results of intended objectives
عرض الإجابة
اجابة صحيحة: D
السؤال #155
An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?
A. nalyze data protection methods
B. nderstand data flows
C. nclude a right-to-audit clause
D. mplement strong access controls
عرض الإجابة
اجابة صحيحة: B
السؤال #156
You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?
A. isk Management Plan
B. takeholder management strategy
C. ommunications Management Plan
D. esource Management Plan
عرض الإجابة
اجابة صحيحة: C
السؤال #157
You are the project manager of GHT project. You have identified a risk event on your project that could save $100,000 in project costs if it occurs. Which of the following statements BEST describes this risk event?
A. his risk event should be mitigated to take advantage of the savings
B. his is a risk event that should be accepted because the rewards outweigh the threat to the project
C. his risk event should be avoided to take full advantage of the potential savings
D. his risk event is an opportunity to the project and should be exploited
عرض الإجابة
اجابة صحيحة: D
السؤال #158
An organization uses a vendor to destroy hard drives. Which of the following would BEST reduce the risk of data leakage?
A. mplement an encryption policy for the hard drives
B. equire the vendor to degauss the hard drives
C. se an accredited vendor to dispose of the hard drives
D. equire confirmation of destruction from the IT manager
عرض الإجابة
اجابة صحيحة: D
السؤال #159
Which of the following would be MOST important for a risk practitioner to provide to the internal audit department during the audit planning process?
A. losed management action plans from the previous audit
B. nnual risk assessment results
C. n updated vulnerability management report
D. list of identified generic risk scenarios
عرض الإجابة
اجابة صحيحة: B
السؤال #160
Mary is the project manager for the BLB project. She has instructed the project team to assemble, to review the risks. She has included the schedule management plan as an input for the quantitative risk analysis process. Why is the schedule management plan needed for quantitative risk analysis?
A. eterrent control
B. etective control
C. ompensation control
D. reventative control
عرض الإجابة
اجابة صحيحة: B
السؤال #161
The MAIN reason for creating and maintaining a risk register is to:
A. ccount for identified key risk factors
B. nsure assets have low residual risk
C. efine the risk assessment methodology
D. ssess effectiveness of different projects
عرض الإجابة
اجابة صحيحة: A
السؤال #162
Which of the following role carriers are responsible for setting up the risk governance process, establishing and maintaining a common risk view, making risk-aware business decisions, and setting the enterprise's risk culture?Each correct answer represents a complete solution. Choose two.
A. isk avoidance
B. isk transference
C. isk acceptance
D. isk mitigation
عرض الإجابة
اجابة صحيحة: AD
السؤال #163
Which of the following is the FOREMOST root cause of project risk? Each correct answer represents a complete solution. Choose two.
A. roject management plan updates
B. n organizational process asset updates
C. hange requests
D. roject document updates
عرض الإجابة
اجابة صحيحة: CD
السؤال #164
Which of the following attributes of a key risk indicator (KRI) is MOST important?
A. epeatable
B. ualitative
C. utomated
D. uantitative
عرض الإجابة
اجابة صحيحة: D
السؤال #165
There are four inputs to the Monitoring and Controlling Project Risks process. Which one of the following will NOT help you, the project manager, to prepare for risk monitoring and controlling?
A. isk register
B. ork Performance Information
C. roject management plan
D. hange requests
عرض الإجابة
اجابة صحيحة: D
السؤال #166
Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?
A. bility to predict trends
B. ngoing availability of data
C. vailability of automated reporting systems
D. bility to aggregate data
عرض الإجابة
اجابة صحيحة: D
السؤال #167
Which of the following is MOST important to include in regulatory and risk updates when a new legal requirement affects the organization?
A. ecommended key risk indicator (KRI) thresholds
B. ost of changes to critical business processes
C. isk associated with noncompliance
D. ime frame to remediate noncompliance risk
عرض الإجابة
اجابة صحيحة: C
السؤال #168
The acceptance of control costs that exceed risk exposure is MOST likely an example of:
A. orporate culture alignment
B. orporate culture misalignment
C. ow risk tolerance
D. igh risk tolerance
عرض الإجابة
اجابة صحيحة: C
السؤال #169
Which of the following statements BEST describes risk appetite?
A. cceptable variation between risk thresholds and business objectives
B. he amount of risk an organization is willing to accept
C. he effective management of risk and internal control environments
D. he acceptable variation relative to the achievement of objectives
عرض الإجابة
اجابة صحيحة: B
السؤال #170
Which of the following is the MOST relevant input to an organization’s risk profile?
A. xternal audit’s risk assessment
B. anagement’s risk self-assessment
C. nternal audit’s risk assessment
D. nformation security’s vulnerability assessment
عرض الإجابة
اجابة صحيحة: A
السؤال #171
Which of the following tools is MOST helpful when mapping IT risk management outcomes to organizational objectives?
A. isk dashboard
B. ACI chart
C. nformation security risk map
D. trategic business plan
عرض الإجابة
اجابة صحيحة: D
السؤال #172
Which of the following would BEST provide early warning of a high-risk condition?
A. isk assessment
B. ey risk indicator (KRI)
C. isk register
D. ey performance indicator (KPI)
عرض الإجابة
اجابة صحيحة: B
السؤال #173
Which of the following provides the BEST measurement of an organization’s risk management maturity level?
A. T alignment to business objectives
B. evel of residual risk
C. ey risk indicators (KRIs)
D. he results of a gap analysis
عرض الإجابة
اجابة صحيحة: A
السؤال #174
You work as a project manager for BlueWell Inc. You are preparing for the risk identification process. You will need to involve several of the project's key stakeholders to help you identify and communicate the identified risk events. You will also need several documents to help you and the stakeholders identify the risk events. Which one of the following is NOT a document that will help you identify and communicate risks within the project?
A. takeholder registers
B. ctivity duration estimates
C. ctivity cost estimates
D. isk register
عرض الإجابة
اجابة صحيحة: D
السؤال #175
You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen. What should you do with these identified risk events?
A. hese risks can be dismissed
B. hese risks can be accepted
C. hese risks can be added to a low priority risk watch list
D. ll risks must have a valid, documented risk response
عرض الإجابة
اجابة صحيحة: C
السؤال #176
You are the project manager of the HGT project in Bluewell Inc. The project has an asset valued at $125,000 and is subjected to an exposure factor of 25 percent. What will be the Single Loss Expectancy of this project?
A. 125,025
B. 31,250
C. 5,000
D. 3,125,000
عرض الإجابة
اجابة صحيحة: B
السؤال #177
In an organization with a mature risk management program, which of the following would provide the BEST evidence that the IT risk profile is up to date?
A. isk questionnaire
B. isk register
C. ompliance manual
D. anagement assertion
عرض الإجابة
اجابة صحيحة: B
السؤال #178
You are the project manager of the GHY project for your organization. You are working with your project team to begin identifying risks for the project. As part of your preparation for identifying the risks within the project you will need eleven inputs for the process. Which one of the following is NOT an input to the risk identification process?
A. uality management plan
B. takeholder register
C. ost management plan
D. rocurement management plan
عرض الإجابة
اجابة صحيحة: D
السؤال #179
Ben is the project manager of the CMH Project for his organization. He has identified a risk that has a low probability of happening, but the impact of the risk event could save the project and the organization with a significant amount of capital. Ben assigns Laura to the risk event and instructs her to research the time, cost, and method to improve the probability of the positive risk event. Ben then communicates the risk event and response to management. What risk response has been used here?
A. ransference
B. nhance
C. xploit
D. haring
عرض الإجابة
اجابة صحيحة: B
السؤال #180
Which of the following is the first MOST step in the risk assessment process?
A. dentification of assets
B. dentification of threats
C. dentification of threat sources
D. dentification of vulnerabilities
عرض الإجابة
اجابة صحيحة: A
السؤال #181
The PRIMARY benefit associated with key risk indicators (KRIs) is that they:
A. dentify trends in the organization’s vulnerabilities
B. rovide ongoing monitoring of emerging risk
C. elp an organization identify emerging threats
D. enchmark the organization’s risk profile
عرض الإجابة
اجابة صحيحة: C
السؤال #182
You are the project manager of HFD project. You have identified several project risks. You have adopted alternatives to deal with these risks which do not attempt to reduce the probability of a risk event or its impacts. Which of the following response have you implemented?
A. cceptance
B. itigation
C. voidance
D. ontingent response
عرض الإجابة
اجابة صحيحة: D
السؤال #183
Your project has several risks that may cause serious financial impact if they occur. You have studied the risk events and made some potential risk responses for the risk events but management wants you to do more. They'd like you to create some type of a chart that identified the risk probability and impact with a financial amount for each risk event. What is the likely outcome of creating this type of chart?
A. isk response plan
B. ontingency reserve
C. isk response
D. uantitative analysis
عرض الإجابة
اجابة صحيحة: B
السؤال #184
Which of the following is the MOST important consideration when developing an organization’s risk taxonomy?
A. T strategy
B. eading industry frameworks
C. usiness context
D. egulatory requirements
عرض الإجابة
اجابة صحيحة: C
السؤال #185
The BEST way to determine the likelihood of a system availability risk scenario is by assessing the:
A. vailability of fault tolerant software
B. trategic plan for business growth
C. ulnerability scan results of critical systems
D. edundancy of technical infrastructure
عرض الإجابة
اجابة صحيحة: D
السؤال #186
Which of the following would MOST likely result in updates to an IT risk appetite statement?
A. hanges in senior management
B. xternal audit findings
C. eedback from focus groups
D. elf-assessment reports
عرض الإجابة
اجابة صحيحة: B
السؤال #187
Which of the following decision tree nodes have probability attached to their branches?
A. oot node
B. vent node
C. nd node
D. ecision node
عرض الإجابة
اجابة صحيحة: B
السؤال #188
A risk practitioner has identified that the organization’s secondary data center does not provide redundancy for a critical application. Who should have the authority to accept the associated risk?
A. usiness continuity director
B. usiness application owner
C. isaster recovery manager
D. ata center manager
عرض الإجابة
اجابة صحيحة: B
السؤال #189
What should a risk practitioner do NEXT if an ineffective key control is identified on a critical system?
A. evalidate the risk assessment
B. scalate to senior management
C. ropose acceptance of the risk
D. onduct a gap analysis
عرض الإجابة
اجابة صحيحة: D
السؤال #190
Which of the following assets are the examples of intangible assets of an enterprise? Each correct answer represents a complete solution. Choose two.
A. onitoring and Controlling
B. n any process group where the risk event resides
C. lanning
D. xecuting
عرض الإجابة
اجابة صحيحة: AB
السؤال #191
Which of the following is MOST important to include when identifying risk scenarios for inclusion in a risk review of a third-party service provider?
A. pen vendor issues
B. urchasing agreements
C. upplier questionnaires
D. rocess mapping
عرض الإجابة
اجابة صحيحة: D
السؤال #192
Which of the following will BEST ensure that information security risk factors are mitigated when developing in- house applications?
A. nclude information security control specifications in business cases
B. dentify key risk indicators (KRIs) as process output
C. dentify information security controls in the requirements analysis
D. esign key performance indicators (KPIs) for security in system specifications
عرض الإجابة
اجابة صحيحة: C
السؤال #193
Calculation of the recovery time objective (RTO) is necessary to determine the:
A. nnual loss expectancy (ALE)
B. riority of restoration
C. oint of synchronization
D. ime required to restore files
عرض الإجابة
اجابة صحيحة: D
السؤال #194
Mapping open risk issues to an enterprise risk heat map BEST facilitates:
A. isk ownership
B. isk identification
C. isk response
D. ontrol monitoring
عرض الإجابة
اجابة صحيحة: B
السؤال #195
Which of the following controls do NOT come under technical class of control?
A. rogram management control
B. ystem and Communications Protection control
C. dentification and Authentication control
D. ccess Control
عرض الإجابة
اجابة صحيحة: A
السؤال #196
When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?
A. list of assets exposed to the highest risk
B. otential losses compared to treatment cost
C. ecent audit and self-assessment results
D. isk action plans and associated owners
عرض الإجابة
اجابة صحيحة: B
السؤال #197
After identifying new risk events during a project, the project manager’s NEXT step should be to:
A. ontinue with a quantitative risk analysis
B. etermine if the scenarios need to be accepted or responded to
C. ontinue with a qualitative risk analysis
D. ecord the scenarios into the risk register
عرض الإجابة
اجابة صحيحة: A
السؤال #198
Which of the following is a technique that provides a systematic description of the combination of unwanted occurrences in a system?
A. ensitivity analysis
B. cenario analysis
C. ault tree analysis
D. ause and effect analysis
عرض الإجابة
اجابة صحيحة: C
السؤال #199
You are the risk official of your enterprise. You have just completed risk analysis process. You noticed that the risk level associated with your project is less than risk tolerance level of your enterprise. Which of following is the MOST likely action you should take?
A. pply risk response
B. pdate risk register
C. o action
D. rioritize risk response options
عرض الإجابة
اجابة صحيحة: C
السؤال #200
You work as the project manager for Company Inc. The project on which you are working has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?
A. esource Management Plan
B. ommunications Management Plan
C. isk Management Plan
D. takeholder management strategy
عرض الإجابة
اجابة صحيحة: B
السؤال #201
Which of the following phases is involved in the Data Extraction, Validation, Aggregation and Analysis?
A. isk response and Risk monitoring
B. equirements gathering, Data access, Data validation, Data analysis, and Reporting and corrective action
C. ata access and Data validation
D. isk identification, Risk assessment, Risk response and Risk monitoring
عرض الإجابة
اجابة صحيحة: B
السؤال #202
Which of the following is the MOST important consideration for a risk practitioner when making a system implementation go-live recommendation?
A. vailability of in-house resources
B. ompleteness of system documentation
C. ariances between planned and actual cost
D. esults of end user acceptance testing
عرض الإجابة
اجابة صحيحة: B
السؤال #203
Which of the following tools is MOST effective in identifying trends in the IT risk profile?
A. isk dashboard
B. isk register
C. isk self-assessment
D. isk map
عرض الإجابة
اجابة صحيحة: D
السؤال #204
What is the PRIMARY reason to periodically review key performance indicators (KPIs)?
A. dentify trends
B. ptimize resources needed for controls
C. nsure compliance
D. romote a risk-aware culture
عرض الإجابة
اجابة صحيحة: B
السؤال #205
Which of the following is the BEST indicator of an effective IT security awareness program?
A. ecreased success rate of internal phishing tests
B. umber of employees that complete security training
C. umber of disciplinary actions issued for security violations
D. ecreased number of reported security incidents
عرض الإجابة
اجابة صحيحة: D
السؤال #206
A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event happen it'll cause the project to be delayed by three weeks, which will cause new risk in the project. What should the project manager do with the risk event?
A. dd the identified risk to a quality control management chart
B. dd the identified risk to the issues log
C. dd the identified risk to the risk register
D. dd the identified risk to the low-level risk watch-list
عرض الإجابة
اجابة صحيحة: C
السؤال #207
Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?
A. udit reports from internal information systems audits
B. irectives from legal and regulatory authorities
C. rend analysis of external risk factors
D. utomated logs collected from different systems
عرض الإجابة
اجابة صحيحة: D
السؤال #208
A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?
A. ransference
B. itigation
C. voidance
D. xploit
عرض الإجابة
اجابة صحيحة: A
السؤال #209
After the review of a risk record, internal audit questioned why the risk was lowered from medium to low. Which of the following is the BEST course of action in responding to this inquiry?
A. otify the business at the next risk briefing
B. btain industry benchmarks related to the specific risk
C. rovide justification for the lower risk rating
D. eopen the risk issue and complete a full assessment
عرض الإجابة
اجابة صحيحة: C
السؤال #210
Which of the following is MOST critical to the design of relevant risk scenarios?
A. he scenarios are linked to probable organizational situations
B. he scenarios are based on past incidents
C. he scenarios are aligned with risk management capabilities
D. he scenarios are mapped to incident management capabilities
عرض الإجابة
اجابة صحيحة: A

عرض الإجابات بعد التقديم

يرجى إرسال البريد الإلكتروني الخاص بك والواتس اب للحصول على إجابات الأسئلة.

ملحوظة: يرجى التأكد من صلاحية معرف البريد الإلكتروني وWhatsApp حتى تتمكن من الحصول على نتائج الاختبار الصحيحة.

بريد إلكتروني:
رقم الواتس اب/الهاتف:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.