- (Exam Topic 3)
Which of the following should be done FIRST when information is no longer required to support business objectives?

1. A. Archive the information to a backup database.
2. B. Protect the information according to the classification policy.
3. C. Assess the information against the retention policy.
4. D. Securely and permanently erase the information

Correct Answer: C

- (Exam Topic 2)
Which of the following would present the GREATEST challenge when assigning accountability for control ownership?

1. A. Weak governance structures
2. B. Senior management scrutiny
3. C. Complex regulatory environment
4. D. Unclear reporting relationships

Correct Answer: D

- (Exam Topic 3)
Which of the following is the FIRST step when conducting a business impact analysis (BIA)?

1. A. Identifying critical information assets
2. B. Identifying events impacting continuity of operations;
3. C. Creating a data classification scheme
4. D. Analyzing previous risk assessment results

Correct Answer: A

- (Exam Topic 2)
Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST

1. A. review the key risk indicators.
2. B. conduct a risk analysis.
3. C. update the risk register
4. D. reallocate risk response resources.

Correct Answer: A

- (Exam Topic 3)
When formulating a social media policy lo address information leakage, which of the following is the MOST important concern to address?

1. A. Sharing company information on social media
2. B. Sharing personal information on social media
3. C. Using social media to maintain contact with business associates
4. D. Using social media for personal purposes during working hours

Correct Answer: A