- (Exam Topic 1)
Which of the following should be the PRIMARY consideration when implementing controls for monitoring user activity logs?

1. A. Ensuring availability of resources for log analysis
2. B. Implementing log analysis tools to automate controls
3. C. Ensuring the control is proportional to the risk
4. D. Building correlations between logs collected from different sources

Correct Answer: C

- (Exam Topic 4)
Which of the following is the PRIMARY benefit of stakeholder involvement in risk scenario development?

1. A. Ability to determine business impact
2. B. Up-to-date knowledge on risk responses
3. C. Decision-making authority for risk treatment
4. D. Awareness of emerging business threats

Correct Answer: A

- (Exam Topic 3)
Which of the following is the GREATEST advantage of implementing a risk management program?

1. A. Enabling risk-aware decisions
2. B. Promoting a risk-aware culture
3. C. Improving security governance
4. D. Reducing residual risk

Correct Answer: A

- (Exam Topic 3)
When of the following provides the MOST tenable evidence that a business process control is effective?

1. A. Demonstration that the control is operating as designed
2. B. A successful walk-through of the associated risk assessment
3. C. Management attestation that the control is operating effectively
4. D. Automated data indicating that risk has been reduced

Correct Answer: C

- (Exam Topic 3)
Which of the following is an IT business owner's BEST course of action following an unexpected increase in emergency changes?

1. A. Evaluating the impact to control objectives
2. B. Conducting a root cause analysis
3. C. Validating the adequacy of current processes
4. D. Reconfiguring the IT infrastructure

Correct Answer: B