IT-Risk-Fundamentals 試験問題を無料オンラインアクセス

As part of an I&T related risk assessment, which of the following should be reviewed to obtain an initial view of overall I&T related risk for the enterprise?

• A.Components of the risk universe at a high level
• B.Threats and vulnerabilities for each risk factor identified
• C.Components of the risk register with remediation plans

Which of the following is the MAIN reason to conduct a penetration test?

• A.To validate the results of a control self-assessment
• B.To validate the results of a threat assessment
• C.To validate the results of a vulnerability assessment

An enterprise has moved its data center from a flood-prone area where it had experienced significant service disruptions to one that is not a flood zone. Which risk response strategy has the organization selected?

• A.Risk mitigation
• B.Risk transfer
• C.Risk avoidance

Applying statistical analysis methods to I&T risk scenarios is MOST appropriate when:

• A.members of senior management have advanced mathematical knowledge.
• B.quantifiable historical data is available for detailed reviews.
• C.risk management professionals are unfamiliar with qualitative methods.

The MOST important reason for developing and monitoring key risk indicators (KRIs) is that they provide:

• A.information about control compliance.
• B.an early warning of possible risk materialization.
• C.measurable metrics for acceptable risk levels.