Question 1

Which of the following is MOST important when defining an organization's risk scope?

Options :

A : Understanding the impacts of the risk environment to the organization

B : Developing a top-down approach to risk management

C : Developing requirements for risk reporting to executive management

Answer: A

Question 2

Which statement about controls is true?

Options :

A : Controls are not essential for risk mitigation

B : Controls can only be categorized as technical in a control matrix

C : Controls prevent, detect, and correct damage resulting from an incident but do not enable recovery

D : Controls are essential for risk mitigation and include both proactive and reactive measures

Answer: D

Question 3

What is the focus of penetration tests?

Options :

A : Implementing new controls

B : Validating vulnerability assessments

C : Conducting risk reporting

D : Adjusting existing controls

Answer: B

Question 4

What does KPI stand for?

Options :

A : Key Privacy Indicator

B : Key Performance Indicator

C : Key People Indicator

D : Key Promise Indicator

Answer: B

Question 5

How can metrics on training effectiveness and needs for additional training be gathered?

Options :

A : Questionnaires, testing, help desk activity, operational errors

B : Management interviews only

C : Audits only

D : Incident reporting only

Answer: A

Free IT-Risk-Fundamentals Mock Exam – Practice Online Confidently