- (Exam Topic 1)
Which of the following should be the HIGHEST priority when developing a risk response?

1. A. The risk response addresses the risk with a holistic view.
2. B. The risk response is based on a cost-benefit analysis.
3. C. The risk response is accounted for in the budget.
4. D. The risk response aligns with the organization's risk appetite.

Correct Answer: D

- (Exam Topic 4)
An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of risk is MOST likely to materialize?

1. A. Confidentiality breach
2. B. Institutional knowledge loss
3. C. Intellectual property loss
4. D. Unauthorized access

Correct Answer: B

- (Exam Topic 4)
Which of the following would BEST mitigate the ongoing risk associated with operating system (OS) vulnerabilities?

1. A. Temporarily mitigate the OS vulnerabilities
2. B. Document and implement a patching process
3. C. Evaluate permanent fixes such as patches and upgrades
4. D. Identify the vulnerabilities and applicable OS patches

Correct Answer: B

- (Exam Topic 2)
A large organization needs to report risk at all levels for a new centralized visualization project to reduce cost and improve performance. Which of the following would MOST effectively represent the overall risk of the project to senior management?

1. A. Aggregated key performance indicators (KPls)
2. B. Key risk indicators (KRIs)
3. C. Centralized risk register
4. D. Risk heat map

Correct Answer: D

- (Exam Topic 2)
Which of the following indicates an organization follows IT risk management best practice?

1. A. The risk register template uses an industry standard.
2. B. The risk register is regularly updated.
3. C. All fields in the risk register have been completed.
4. D. Controls are listed against risk entries in the register.

Correct Answer: A