Isaca IT-RISK-FUNDAMENTALS Online Practice Questions and Exam Preparation

Isaca IT-RISK-FUNDAMENTALS Online Questions & Answers

• Question 1:

  Which of the following is the FIRST step in an advanced persistent threat (APT) attack?

  A. Identify administrators and crack passwords to obtain administrator access.
  B. Use social engineering to encourage employees to visit an infected website.
  C. Collect information on the infrastructure of an organization to know where to attack.
  C. Collect information on the infrastructure of an organization to know where to attack.

• Question 2:

  Which of the following is an example of a preventive control?

  A. File integrity monitoring (FIM) on personal database stores
  B. Air conditioning systems with excess capacity to permit failure of certain components
  C. Data management checks on sensitive data processing procedures
  C. Data management checks on sensitive data processing procedures

• Question 3:

  What is the PRIMARY purpose of providing timely and accurate risk information to key stakeholders?

  A. To establish risk appetite
  B. To facilitate risk-based decision making
  C. To develop effective key risk indicators (KRIs)
  B. To facilitate risk-based decision making

• Question 4:

  The MOST important reason for developing and monitoring key risk indicators (KRIs) is that they provide:

  A. measurable metrics for acceptable risk levels.
  B. information about control compliance.
  C. an early warning of possible risk materialization.
  C. an early warning of possible risk materialization.

• Question 5:

  An enterprise has performed a risk assessment for the risk associated with the theft of sales team laptops while in transit. The results of the assessment concluded that the cost of mitigating the risk is higher than the potential loss. Which of the following is the BEST risk response strategy?

  A. Limit travel with laptops.
  B. Accept the inherent risk.
  C. Encrypt the sales team laptops.
  B. Accept the inherent risk.

• Question 6:

  Which of the following is important to ensure when validating the results of a frequency analysis?

  A. Estimates used during the analysis were based on reliable and historical data.
  B. The analysis was conducted by an independent third party.
  C. The analysis method has been fully documented and explained.
  A. Estimates used during the analysis were based on reliable and historical data.

• Question 7:

  Which of the following is a valid source or basis for selecting key risk indicators (KRIs)?

  A. Historical enterprise risk metrics
  B. Risk workshop brainstorming
  C. External threat reporting services
  A. Historical enterprise risk metrics

• Question 8:

  Which of the following are KEY considerations when selecting the best risk response for a given situation?

  A. Alignment with risk policy and industry standards
  B. Previous risk response strategies and action plans
  C. Cost of the response and capability to implement
  C. Cost of the response and capability to implement

• Question 9:

  Which of the following is the PRIMARY concern with vulnerability assessments?

  A. Threat mitigation
  B. Report size
  C. False positives
  C. False positives

• Question 10:

  Which of the following represents a vulnerability associated with legacy systems using older technology?

  A. Lost opportunity to capitalize on emerging technologies
  B. Rising costs associated with system maintenance
  C. Inability to patch or apply system updates
  C. Inability to patch or apply system updates