Isaca IT-RISK-FUNDAMENTALS Online Practice Questions and Exam Preparation

Isaca IT-RISK-FUNDAMENTALS Online Questions & Answers

• Question 41:

  Risk impact criteria are PRIMARILY used to:

  A. help establish the enterprise risk appetite.
  B. determine loss associated with specific IT assets.
  C. prioritize the enterprise's risk responses.
  C. prioritize the enterprise's risk responses.

• Question 42:

  Which of the following BEST supports a risk-aware culture within an enterprise?

  A. Risk issues and negative outcomes are only shared within a department.
  B. The enterprise risk management (ERM) function manages all risk-related activities.
  C. Risk is identified, documented, and discussed to make business decisions.
  C. Risk is identified, documented, and discussed to make business decisions.

• Question 43:

  Which of the following is considered an exploit event?

  A. An attacker takes advantage of a vulnerability
  B. Any event that is verified as a security breach
  C. The actual occurrence of an adverse event
  A. An attacker takes advantage of a vulnerability

• Question 44:

  As part of an IandT related risk assessment, which of the following should be reviewed to obtain an initial view of overall IandT related risk for the enterprise?

  A. Threats and vulnerabilities for each risk factor identified
  B. Components of the risk register with remediation plans
  C. Components of the risk universe at a high level
  C. Components of the risk universe at a high level

• Question 45:

  Which of the following is a KEY contributing component for determining risk rankings to direct risk response?

  A. Cost of mitigating controls
  B. Severity of a vulnerability
  C. Maturity of risk management processes
  A. Cost of mitigating controls

• Question 46:

  Which of the following is the objective of a frequency analysis?

  A. To determine how often risk mitigation strategies should be evaluated and updated within a specific timeframe
  B. To determine how many risk scenarios will impact business objectives over a given period of time
  C. To determine how often a particular risk scenario might be expected to occur during a specified period of time
  C. To determine how often a particular risk scenario might be expected to occur during a specified period of time

• Question 47:

  An enterprise has moved its data center from a flood-prone area where it had experienced significant service disruptions to one that is not a flood zone. Which risk response strategy has the organization selected?

  A. Risk mitigation
  B. Risk transfer
  C. Risk avoidance
  C. Risk avoidance

• Question 48:

  Key risk indicators (KRIs) are used for which of the following purposes when developing a project plan?

  A. Determining resource allocation
  B. Assigning risk owners
  C. Performing a gap analysis
  C. Performing a gap analysis

• Question 49:

  The PRIMARY goal of a business continuity plan (BCP) is to enable the enterprise to provide:

  A. a detailed list of hardware and software requirements to enable business functionality after an interruption.
  B. an immediate return of all business functionality after an interruption.
  C. a sufficient level of business functionality immediately after an interruption.
  C. a sufficient level of business functionality immediately after an interruption.

• Question 50:

  Which of the following is an example of an inductive method to gather information?

  A. Vulnerability analysis
  B. Controls gap analysis
  C. Penetration testing
  C. Penetration testing