An organization has completed a project to implement encryption on all databases that host customer data. Which of the following elements of the risk register should be updated to reflect this change?

A. Risk tolerance
B. Inherent risk
C. Risk appetite
D. Risk likelihood

A rule-based data loss prevention (DLP) tool has recently been implemented to reduce the risk of sensitive data leakage. Which of the following is MOST likely to change as a result of this implementation?

A. Risk velocity
B. Risk impact
C. Risk likelihood
D. Risk appetite

An organization has implemented a preventive control to lock user accounts after three unsuccessful login attempts. This practice has been proven to be unproductive, and a change in the control threshold value has been recommended. Who should authorize changing this threshold?

A. Control owner
B. IT security manager
C. Risk owner
D. IT system owner

Which of the following is the PRIMARY objective of providing an aggregated view of IT risk to business management?

A. To provide consistent and clear terminology
B. To allow for proper review of risk tolerance
C. To identify dependencies for reporting risk
D. To enable consistent data on risk to be obtained

Which of the following is the PRIMARY reason to perform ongoing risk assessments?

A. The risk environment is subject to change.
B. The information security budget must be justified.
C. Emerging risk must be continuously reported to management.
D. New system vulnerabilities emerge at frequent intervals.

When prioritizing risk response, management should FIRST:

A. evaluate the organization’s ability and expertise to implement the solution.
B. evaluate the risk response of similar organizations.
C. determine which risk factors have high remediation costs.
D. address high risk factors that have efficient and effective solutions.

The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:

A. backup recovery requests.
B. resources to monitor backups.
C. restoration monitoring reports.
D. recurring restore failures.

Which of the following is the MOST important characteristic of an effective risk management program?

A. Risk response plans are documented.
B. Key risk indicators are defined.
C. Risk ownership is assigned.
D. Controls are mapped to key risk scenarios.

Which of the following is the MOST important outcome of reviewing the risk management process?

A. Improving the competencies of employees who performed the review
B. Assuring the risk profile supports the IT objectives
C. Determining what changes should be made to IS policies to reduce risk
D. Determining that procedures used in risk assessment are appropriate

Management has required information security awareness training to reduce the risk associated with credential compromise. What is the BEST way to assess the effectiveness of the training?

A. Conduct social engineering testing.
B. Perform a vulnerability assessment.
C. Audit security awareness training materials.
D. Administer an end-of-training quiz.