An alert generated when network bandwidth usage exceeds a predefined level is an example of a:

1. A. threat.
2. B. risk event.
3. C. lag indicator.
4. D. key risk indicator (KRI).

Correct Answer: D

Which of the following is the PRIMARY reason for an organization to monitor and review l&T-related risk periodically?

1. A. To address changes in external and internal risk factors
2. B. To ensure risk is managed within acceptable limits
3. C. To facilitate the timely identification and replacement of legacy IT assets

Correct Answer: A

Which of the following is the PRIMARY objective of vulnerability assessments?

1. A. To determine the best course of action based on the threat and potential impact
2. B. To improve the knowledge of deficient control conditions within IT systems
3. C. To reduce the amount of effort to identify and catalog new vulnerabilities

Correct Answer: B

Of the following, who is BEST suited to be responsible for continuous monitoring of risk?

1. A. Chief risk officer (CRO)
2. B. Risk analysts
3. C. Risk owners

Correct Answer: C

Which of the following is MOST likely to promote ethical and open communication of risk management activities at the executive level?

1. A. Recommending risk tolerance levels to the business
2. B. Expressing risk results in financial terms
3. C. Increasing the frequency of risk status reports

Correct Answer: B