- (Exam Topic 2)
Which of the following would MOST likely cause a risk practitioner to reassess risk scenarios?

1. A. A change in the risk management policy
2. B. A major security incident
3. C. A change in the regulatory environment
4. D. An increase in intrusion attempts

Correct Answer: C

- (Exam Topic 2)
Which of the following key risk indicators (KRIs) is MOST effective for monitoring risk related to a bring your own device (BYOD) program?

1. A. Number of users who have signed a BYOD acceptable use policy
2. B. Number of incidents originating from BYOD devices
3. C. Budget allocated to the BYOD program security controls
4. D. Number of devices enrolled in the BYOD program

Correct Answer: D

- (Exam Topic 3)
In an organization dependent on data analytics to drive decision-making, which of the following would BEST help to minimize the risk associated with inaccurate data?

1. A. Establishing an intellectual property agreement
2. B. Evaluating each of the data sources for vulnerabilities
3. C. Periodically reviewing big data strategies
4. D. Benchmarking to industry best practice

Correct Answer: B

- (Exam Topic 4)
Who should be responsible for determining which stakeholders need to be involved in the development of a
risk scenario?

1. A. Risk owner
2. B. Risk practitioner
3. C. Compliance manager
4. D. Control owner

Correct Answer: B

- (Exam Topic 4)
Recovery the objectives (RTOs) should be based on

1. A. minimum tolerable downtime
2. B. minimum tolerable loss of data.
3. C. maximum tolerable downtime.
4. D. maximum tolerable loss of data

Correct Answer: C