Free CRISC Practice Exam (2026)

Your score by topic

Get a free CRISC study plan on WhatsApp See CRISC Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Governance⚑ Flag

A regional bank plans to launch a digital lending service within 18 months. The CEO asks the risk practitioner to support the initiative. What should the risk practitioner do FIRST?

ARun a vulnerability scan on the existing online banking systems BSelect a lending platform vendor that holds strong security certifications CReview how the initiative fits strategic objectives and risk appetite DDraft control procedures for the new digital lending channel

Correct answer: C. Review how the initiative fits strategic objectives and risk appetite
Risk management exists to support business objectives, so the practitioner first needs to understand how the initiative relates to strategy and risk appetite. Selecting a vendor or drafting controls is premature until the risks of the initiative are understood in business terms.

Question 2Governance⚑ Flag

A retail company's IT department rates risk on a 1-to-3 scale with its own impact categories. The enterprise risk function uses a 1-to-5 scale with financial, operational and reputational criteria. Senior management cannot compare IT risk with other business risk. What is the BEST action for the risk practitioner?

AMultiply each IT risk score to convert it to a 1-to-5 scale BAlign IT risk criteria with the enterprise risk scales CAsk internal audit to validate the IT risk register entries DReplace the IT risk register with the enterprise register

Correct answer: B. Align IT risk criteria with the enterprise risk scales
Integrating IT risk into ERM requires a common language, so IT impact and likelihood criteria should be aligned with the enterprise criteria. Mechanically rescaling the scores keeps the different impact definitions, so the results still would not be comparable.

Question 3Risk Assessment⚑ Flag

In a risk register entry, which of the following BEST describes a vulnerability?

AThe financial or operational consequence after an adverse event occurs BThe estimated chance that an adverse event will occur within a year CA person, group or natural event capable of causing harm to an asset DA weakness in a process, system or control that a threat could exploit

Correct answer: D. A weakness in a process, system or control that a threat could exploit
A vulnerability is a weakness that a threat can exploit to harm an asset. The option describing a person or natural event is the threat itself, which is a separate component of the risk.

Question 4Risk Assessment⚑ Flag

A regional hospital network is rating the likelihood that ransomware will disrupt its patient scheduling system. The security team has supplied industry attack statistics. Which of the following should the risk practitioner consider MOST when estimating likelihood for this organization?

AThreat actor capability and intent against the organization's own vulnerabilities BThe total number of ransomware incidents reported across every industry sector last year CThe cost of restoring the scheduling system from the most recent backup DThe number of security tools currently licensed by the IT department

Correct answer: A. Threat actor capability and intent against the organization's own vulnerabilities
Likelihood depends on whether a capable, motivated threat source can exploit weaknesses that actually exist in this organization, which is the NIST SP 800-30 view. Industry-wide incident counts are useful context but do not reflect the hospital's own exposure, and restoration cost relates to impact rather than likelihood.

Question 5Risk Response & Reporting⚑ Flag

A regional credit union estimates that outages of its marketing website cause about $15,000 per year in expected losses. The only proposed control, a redundant hosting setup, would cost $60,000 per year. The risk is within the board-approved risk appetite. Which response is MOST appropriate?

AImplement the redundant hosting setup to remove the exposure BRecommend that the risk owner formally accept the risk CPurchase business interruption insurance for the website DShut down the marketing website to avoid the risk

Correct answer: B. Recommend that the risk owner formally accept the risk
The control costs four times the expected loss and the risk is already within appetite, so acceptance by the risk owner is the most cost-effective response. Implementing the redundant setup would spend far more on the control than the risk is expected to cost.

Question 6Risk Response & Reporting⚑ Flag

A regional credit union has adopted NIST SP 800-53 as its control catalog. The IT manager proposes implementing every control in the high baseline to be safe. What should the risk practitioner recommend FIRST?

ATailor the baseline using the results of the risk assessment BImplement the high baseline and remove controls that fail testing CBenchmark the control count against peer credit unions DAsk internal audit to approve the full high baseline

Correct answer: A. Tailor the baseline using the results of the risk assessment
Framework baselines are starting points that should be tailored to the organization's assessed risks, appetite and business needs. Implementing every high baseline control without that analysis invites over-control and wasted cost. Peer benchmarking does not reflect the credit union's own risk profile.

Question 7Risk Response & Reporting⚑ Flag

A logistics company approved a plan to replace its legacy warehouse system to reduce a high operational risk. The plan lists one owner and a single completion date 14 months away, with no interim checkpoints. What is the GREATEST concern for the risk practitioner?

AThe plan does not include a detailed vendor selection process. BThe owner may not have the technical skills to manage the project. CThe completion date is longer than the typical budget cycle. DDelays may not be detected until the final deadline is missed.

Correct answer: D. Delays may not be detected until the final deadline is missed.
Without interim milestones, progress cannot be tracked, so slippage stays hidden while the risk remains high for the full period. The owner's skills could matter, but the plan's structure prevents anyone from knowing whether it is on track at all.

Question 8Technology & Security⚑ Flag

A manufacturing company learns that vendor support for the operating system on several plant control servers ended last year. IT says the servers still run without problems, so no replacement was planned. Which is the BEST way to prevent this situation in the future?

ATrack vendor support dates in a technology roadmap and plan replacements early BRequire IT to replace all servers on a fixed three-year schedule CAsk the vendor to notify the risk function when support is about to end DPurchase extended support contracts for every system at the time it is installed

Correct answer: A. Track vendor support dates in a technology roadmap and plan replacements early
A technology roadmap that tracks lifecycle and support dates lets the enterprise plan and fund replacements before systems become unsupported. Buying extended support for everything is costly and only delays the problem instead of managing it through planning.

Question 9Technology & Security⚑ Flag

A regional grocery chain finds that an unauthorized change to its pricing database caused shelf prices to differ from checkout prices for two days. No customer data was exposed, and all systems stayed online. When recording this event in the risk register, the impact should be classified PRIMARILY as a loss of:

Aavailability Baccountability Cintegrity Dconfidentiality

Correct answer: C. integrity
The pricing data was altered without authorization, so the accuracy and trustworthiness of the information, which is integrity, was harmed. Availability is tempting because prices were wrong for two days, but the systems stayed online and the data could be accessed the whole time.

Question 10Governance⚑ Flag

At an investment firm, the business strategy focuses on rapid growth in new markets. The IT strategy, written separately, focuses mainly on cutting costs. Which of the following is the GREATEST concern?

AIT investments may not support the firm's business objectives BIT spending may rise above the approved annual budget CThe IT team may resist new projects in foreign markets DBusiness units may buy technology without IT involvement

Correct answer: A. IT investments may not support the firm's business objectives
When IT strategy is not aligned with business strategy, technology investments may fail to enable the objectives the organization is pursuing. Business units buying their own technology is a possible symptom, but the greater concern is the misalignment itself.

Question 11Governance⚑ Flag

At a regional bank, the IT security manager designs and operates access controls and reports their effectiveness directly to the board. No risk or compliance function reviews this reporting. What should the risk practitioner recommend?

AAsk the IT security manager to report to the board more often BTransfer operation of the access controls to internal audit CHave the board approve every change made to access controls DIntroduce second line review and challenge of the reporting

Correct answer: D. Introduce second line review and challenge of the reporting
In the three lines model, the second line provides expertise, monitoring and challenge, so the board does not rely only on management's self-assessment. Moving control operation to internal audit would compromise the third line's independence.

Question 12Risk Assessment⚑ Flag

A regional hospital's risk practitioner learns that patient records are stored on an unpatched file server. The server can be reached from the guest Wi-Fi network. Which statement BEST expresses this as a risk for the risk register?

AIT should patch the file server and move it to a restricted network segment within the next 30 days. BAn outside attacker could use guest Wi-Fi to exploit the server and expose patient records, leading to fines. CThe file server is missing critical patches, and the guest Wi-Fi is not separated from the clinical network. DPatient records are highly sensitive and must be protected under health privacy rules at all times.

Correct answer: B. An outside attacker could use guest Wi-Fi to exploit the server and expose patient records, leading to fines.
A useful risk statement links a threat, a vulnerability, an affected asset and a business impact. The option about missing patches and weak segmentation describes only vulnerabilities, so it does not tell management what could happen or why it matters.

Question 13Risk Assessment⚑ Flag

A retail bank's risk register shows two risks with the same likelihood and impact ratings. One is a gradual decline in branch system performance. The other is a payment fraud attack that could drain accounts within hours of starting. Which additional factor should the risk practitioner consider to tell them apart?

AThe number of controls currently mapped to each risk BThe date when each risk was first entered in the register CRisk velocity, or how fast the impact would arrive DThe business unit that originally identified each risk

Correct answer: C. Risk velocity, or how fast the impact would arrive
Risk velocity describes how quickly an event's impact is felt, and a fast-moving risk leaves less time to detect and respond, so it may need higher priority or faster controls. The number of mapped controls describes the response, not the nature of the exposure.

Question 14Risk Response & Reporting⚑ Flag

A logistics company is considering a new service that would store driver biometric data in a country with strict privacy laws. The assessment shows the risk far exceeds appetite, no insurer will cover it, and the required controls would make the service unprofitable. What should the risk practitioner recommend?

ALaunch the service with the best available controls and monitor it BAvoid the risk by not launching the service there CAccept the risk for its strategic value DShare the risk by partnering with a local technology firm

Correct answer: B. Avoid the risk by not launching the service there
When risk exceeds appetite and cannot be mitigated or transferred at a reasonable cost, avoidance is the appropriate response. Launching with partial controls would leave the organization operating above its appetite.

Question 15Risk Response & Reporting⚑ Flag

A manufacturing company maintains a risk register and a separate control inventory, but the two have never been linked. What is the PRIMARY benefit of mapping controls to the risks in the register?

AIt lets the company retire the risk register and track only controls BIt demonstrates to regulators that the company meets every legal requirement CIt reduces how often control owners must test their controls each year DIt reveals risks with weak coverage and controls that serve no risk

Correct answer: D. It reveals risks with weak coverage and controls that serve no risk
Mapping controls to risks shows where risks are not adequately covered and where controls exist without a clear risk to address. This supports better control selection and removal of redundant controls. Mapping does not by itself prove regulatory compliance or reduce the need for testing.

Question 16Risk Response & Reporting⚑ Flag

Which of the following roles is ultimately accountable for ensuring that a risk action plan is implemented?

AThe IT staff member who configures the control BThe risk owner for the related business area CThe risk practitioner who facilitated the assessment DThe internal auditor who reviews the related control

Correct answer: B. The risk owner for the related business area
The risk owner is accountable for the risk and for making sure the agreed response is carried out. The risk practitioner tracks progress and reports status, but does not own the risk or the actions.

Question 17Technology & Security⚑ Flag

A risk review finds that several departments at a logistics firm use cloud tools that IT never approved. Staff say the formal approval process takes months. Which is the MOST effective long-term response?

ABlock access to all unapproved cloud services at the firewall BRequire department heads to sign a policy against unapproved software CCreate a faster intake process to vet new tools against business needs DMove all data from the unapproved tools into on-premises systems

Correct answer: C. Create a faster intake process to vet new tools against business needs
Shadow IT often grows when the approved path is too slow to meet business needs, so a quicker, risk-based intake process removes the root cause. Blocking services treats the symptom and tends to push users toward other workarounds.

Question 18Technology & Security⚑ Flag

At a software company, all developers have standing write access to production databases so they can resolve incidents quickly. The CTO argues that removing this access would slow recovery. What is the BEST recommendation from the risk practitioner?

AReplace standing access with approved, time-limited elevation that is logged BIncrease the frequency of database backups to support faster restoration CRemove all developer access and route every production fix through operations DAccept the risk because fast incident recovery is a business priority

Correct answer: A. Replace standing access with approved, time-limited elevation that is logged
Approved, time-limited and logged elevation applies least privilege while still letting developers fix incidents when needed. Removing all access is tempting, but it ignores the business need and could harm recovery objectives. Accepting the risk is a decision for the risk owner, not the practitioner.

Question 19Governance⚑ Flag

Which of the following BEST describes how enterprise risk management supports organizational strategy?

AIt gives auditors evidence that key controls are operating effectively BIt eliminates the threats that could prevent goals from being achieved CIt ensures that all business units apply the same security controls DIt enables informed decisions to pursue objectives within appetite

Correct answer: D. It enables informed decisions to pursue objectives within appetite
Risk management helps leaders weigh risk and reward so they can pursue objectives while staying within the risk appetite. It does not aim to eliminate all threats, because some risk must be taken to achieve goals.

Question 20Governance⚑ Flag

Who should be responsible for setting an enterprise's risk appetite?

AThe board, with input from senior management BBusiness process owners for each major unit CThe internal audit function, after its annual review DThe chief risk officer, with input from IT

Correct answer: A. The board, with input from senior management
Risk appetite is a governance decision made by the board, usually with input from senior management, and reflects how much risk the enterprise will accept to pursue its objectives. The chief risk officer facilitates and drafts the appetite statement but does not own the decision.

Question 21Risk Assessment⚑ Flag

A payments company receives a threat intelligence report. It says a criminal group is attacking firms in the sector through flaws in a popular remote access tool. What should the risk practitioner do FIRST?

AEscalate the report to the board as a critical risk needing emergency funds. BDisable all remote access to the network until the criminal campaign ends. CDetermine whether the company uses the tool and how exposed its systems are. DAsk the security team to install a new endpoint detection product right away.

Correct answer: C. Determine whether the company uses the tool and how exposed its systems are.
Threat intelligence is an input to risk identification, so the first step is to see whether the threat is relevant to the company's environment. Disabling remote access is a response decision that would be premature and could disrupt the business before the exposure is understood.

Question 22Risk Assessment⚑ Flag

Which of the following BEST describes risk evaluation within a risk assessment based on ISO 31000?

ASelecting and implementing options to modify the level of risk BFinding, recognizing and describing risks that could affect the objectives CDeveloping an understanding of the nature and the level of each risk DComparing analysis results with risk criteria to support decisions

Correct answer: D. Comparing analysis results with risk criteria to support decisions
In ISO 31000, risk evaluation compares the results of risk analysis with established risk criteria to decide whether and how to act. Understanding the nature and level of risk is risk analysis, which comes before evaluation, and choosing options to modify risk is risk treatment.

Question 23Risk Response & Reporting⚑ Flag

A hospital buys a cyber insurance policy that covers breach notification costs, forensic investigation and legal defense. Which of the following remains with the hospital after the policy is in place?

AThe cost of notifying affected patients BFees for an external forensic firm CLegal defense costs arising from a covered data breach DAccountability for protecting patient data

Correct answer: D. Accountability for protecting patient data
Insurance transfers part of the financial impact, but accountability for protecting data and the reputational harm of a breach stay with the organization. The notification, forensic and legal costs are exactly what the policy was bought to cover.

Question 24Risk Response & Reporting⚑ Flag

A payment processor must meet PCI DSS, ISO/IEC 27001 certification and several customer contract requirements. Each compliance team tests its own controls, and control owners complain about repeated evidence requests. What is the BEST approach?

AAssign one requirement to each control owner to manage alone BBuild a common control set mapped to all requirements CDrop the customer requirements that overlap with PCI DSS DIncrease the testing team so requests are handled faster

Correct answer: B. Build a common control set mapped to all requirements
A common control framework maps each control once to every requirement it satisfies, so one test produces evidence for many obligations. Adding testers treats the symptom and keeps the duplication. Ignoring contract requirements would create legal and customer risk.

Question 25Risk Response & Reporting⚑ Flag

A risk practitioner is combining incident data from four regional offices for a quarterly enterprise report. Two regions count only incidents that stopped operations, while the others count every reported issue. What should the risk practitioner do FIRST?

AAsk internal audit to review incident logging in each region. BReport the regional data separately with an explanatory footnote. CAgree on a common incident definition and normalize the data. DUse the higher regional counts to present a conservative view.

Correct answer: C. Agree on a common incident definition and normalize the data.
Aggregated data is only meaningful when every source measures the same thing, so a common definition must be applied before the numbers are combined. Separate reporting with a footnote avoids the problem but still gives management no reliable enterprise view.

Question 26Technology & Security⚑ Flag

At a regional bank, emergency changes have grown from 5% to 30% of all production changes over the past year. Most are implemented without any later review. Which is the GREATEST concern?

AThe change advisory board may meet less often than planned BDevelopers may spend less time on planned project work CChange records may not match the format required by policy DUnauthorized or faulty changes may reach production undetected

Correct answer: D. Unauthorized or faulty changes may reach production undetected
Without review, the emergency path becomes a way around change control, so unauthorized or faulty changes can affect production without anyone noticing. Fewer board meetings or format issues are administrative concerns with much lower business impact.

Question 27Technology & Security⚑ Flag

A small nonprofit has one finance clerk who can create vendors, enter invoices and release payments. The budget does not allow hiring more staff this year. What is the BEST way to reduce the risk created by this arrangement?

AOutsource the full accounts payable process to an external service provider BRequire the clerk to sign an annual code of conduct and conflict of interest form CHave a manager independently review vendor changes and payments each week DConfigure the finance system so the clerk can log in only during business hours

Correct answer: C. Have a manager independently review vendor changes and payments each week
When duties cannot be separated, an independent review by another person is a practical compensating control for the segregation of duties gap. Outsourcing could separate duties, but it is a large and costly change when a simple compensating control can bring the risk within tolerance.

Question 28Governance⚑ Flag

A risk assessment at a logistics company found that the fleet tracking system has no failover capability. The IT manager says the risk is acceptable. However, the system directly supports the operations division's delivery commitments to customers. Who should decide whether to accept this risk?

AThe internal audit manager responsible for IT reviews BThe operations executive who owns delivery commitments CThe IT manager who maintains the fleet tracking platform DThe risk practitioner who performed the risk assessment

Correct answer: B. The operations executive who owns delivery commitments
The risk owner is the business manager accountable for the objectives the risk affects, so the operations executive should make the acceptance decision. The IT manager may own the system or its controls but is not accountable for the business impact of an outage.

Question 29Governance⚑ Flag

A logistics company's board has stated a low appetite for service disruption. The operations director asks how much deviation from the 99.9% uptime target is acceptable for the order tracking system. Which of the following would BEST provide this guidance?

AThe service level agreement with the hosting provider BThe disaster recovery plan for the tracking system CA defined risk tolerance for system availability DA business impact analysis of the tracking system

Correct answer: C. A defined risk tolerance for system availability
Risk tolerance sets the acceptable variation around a specific objective, such as an uptime target, and turns the board's appetite into a measurable limit. The hosting agreement reflects what a vendor has committed to, not how much deviation the organization itself is willing to accept.

Question 30Risk Assessment⚑ Flag

A logistics firm's risk register lists many external cyber threats but no internal ones. In a workshop, the HR director mentions that several system administrators with broad access will be laid off next quarter. What is the risk practitioner's BEST course of action?

AAdd an insider threat scenario and review it with the affected process owners. BHave IT install user behavior monitoring on every single administrator account. CRevoke the administrators' access now, before they are told about the layoffs. DAsk HR to delay the layoffs until a full enterprise risk assessment is done.

Correct answer: A. Add an insider threat scenario and review it with the affected process owners.
The layoffs create a credible internal threat source that the register does not capture, so the practitioner should document it as a scenario and validate it with the owners. Revoking access early is a response decision for management and could disrupt operations before the risk is assessed.

Question 31Risk Assessment⚑ Flag

An insurance company's IT department has drafted a business impact analysis that lists recovery priorities for its claims and billing processes. Before the results are used to set recovery objectives, who should validate them?

AThe external consultant who facilitated the impact analysis workshops BThe business process owners of the claims and billing functions CThe IT infrastructure manager who maintains the affected systems DThe internal audit team responsible for the annual IT audit plan

Correct answer: B. The business process owners of the claims and billing functions
Process owners understand the operational, financial and customer impact of a disruption, so they are best placed to confirm the BIA results. IT managers know the systems but cannot judge business impact, and internal audit should stay independent rather than sign off on management's analysis.

Question 32Risk Response & Reporting⚑ Flag

An IT operations manager reports that a legacy server supporting the billing process cannot be patched until the vendor releases an upgrade next year. The manager wants to record the risk as accepted. Who should approve the acceptance?

AThe owner of the billing process BThe director of internal audit CThe IT operations manager who identified the issue DThe chief information security officer

Correct answer: A. The owner of the billing process
Risk acceptance should be approved by the risk owner, the business manager accountable for the process the risk affects. The chief information security officer can advise on the exposure but does not own the business consequences for billing.

Question 33Risk Response & Reporting⚑ Flag

A research lab has badge readers on its server room door, but camera footage shows employees often let others follow them in without badging. Which control would MOST effectively prevent this?

AA weekly review of camera footage by the security team BA reminder email about the badge policy sent each quarter CA mantrap that admits one authorized person at a time DA report comparing badge logs to the visitor sign-in sheet

Correct answer: C. A mantrap that admits one authorized person at a time
Tailgating is a failure at the point of entry, so a physical preventive control such as a mantrap stops it directly. Footage review and log comparisons are detective and only find the problem after access has occurred. A reminder email relies on the same staff behavior that is already failing.

Question 34Risk Response & Reporting⚑ Flag

A media company keeps separate risk spreadsheets in each department. The same vendor risk appears in three files with three different ratings and owners. Which of the following is the BEST way to improve the reliability of enterprise risk reporting?

AReport the highest rating found for each duplicated risk. BAsk department heads to certify their files before each report. CRequire each department to reconcile its file every month. DEstablish a central risk register as the authoritative source.

Correct answer: D. Establish a central risk register as the authoritative source.
A single authoritative register removes conflicting versions and gives every report the same data, ratings and owners. Monthly reconciliation of separate files treats the symptom and still leaves room for conflicting records.

Question 35Governance⚑ Flag

Which of the following is the PRIMARY risk management responsibility of the board of directors?

ASelecting controls that bring risk down to an acceptable level BMaintaining the risk register and updating each risk rating CIndependently testing the design of key risk indicators DApproving risk appetite and overseeing risk management

Correct answer: D. Approving risk appetite and overseeing risk management
The board sets direction by approving the risk appetite and overseeing how management handles risk. Selecting controls and maintaining the risk register are management and risk function activities, not board duties.

Question 36Technology & Security⚑ Flag

An online retailer suffers slowdowns during holiday sales, even though monitoring shows average server use of about 45%. Which is the BEST recommendation to improve capacity management?

ABase capacity plans on business forecasts of peak demand BRaise the alert threshold so fewer warnings are generated CReplace the monitoring tool with one that reports more metrics DDouble server capacity across all systems before each season

Correct answer: A. Base capacity plans on business forecasts of peak demand
Average utilization hides peaks, and capacity plans should be driven by business forecasts such as expected sales events. Doubling all capacity may work but is not risk-based and wastes money on systems that do not need it.

Question 37Technology & Security⚑ Flag

Which of the following BEST describes the purpose of the Govern function in NIST Cybersecurity Framework (CSF) 2.0?

ACoordinating actions and communications when a cybersecurity incident is detected BSetting, communicating and monitoring cybersecurity risk strategy and policy CImplementing safeguards that manage cybersecurity risks to the organization's assets DUnderstanding current cybersecurity risks to assets, suppliers and business processes

Correct answer: B. Setting, communicating and monitoring cybersecurity risk strategy and policy
Govern, added in CSF 2.0, covers establishing, communicating and monitoring the organization's cybersecurity risk management strategy, expectations and policy. Understanding current risks to assets and suppliers is the Identify function, which is tempting because both deal with risk, but Identify does not set strategy or policy.

Question 38Governance⚑ Flag

Which of the following BEST describes risk capacity?

AThe amount of risk the board is willing to accept to meet objectives BThe acceptable variation in performance around a specific objective CThe level of risk that remains after controls are put in place DThe maximum risk the enterprise can absorb and still survive

Correct answer: D. The maximum risk the enterprise can absorb and still survive
Risk capacity is the most risk or loss an enterprise can bear before its survival or ability to meet core obligations is threatened. The amount of risk the board is willing to accept is risk appetite, which should be set below capacity.

Question 39Risk Assessment⚑ Flag

A quarterly vulnerability scan at a manufacturing company reports 400 high-severity findings. The IT manager asks the risk practitioner to add every finding to the enterprise risk register. What is the BEST response?

ARecord only the findings that have a public exploit available on the internet. BAsk the IT manager to fix every finding before the risk register is updated. CConsolidate the findings into risks stated in terms of business impact. DAdd each finding as a separate register entry so that no issue is overlooked.

Correct answer: C. Consolidate the findings into risks stated in terms of business impact.
The enterprise risk register should express risk in business terms that leaders can act on, while detailed findings stay in the vulnerability management process. Adding 400 separate technical entries would bury the real business risks and make the register hard to use.

Question 40Governance⚑ Flag

A manufacturer is rolling out a new risk management process across its plants. Several plant managers say they are unsure who must approve risk responses and who only needs to be informed. What should the risk practitioner recommend FIRST?

ATrain each plant manager on quantitative risk analysis BDefine and communicate a RACI chart for the risk process CReport the confusion to the audit committee as a control failure DAsk the CRO to approve all risk responses until roles are clear

Correct answer: B. Define and communicate a RACI chart for the risk process
A RACI chart clearly shows who is responsible, accountable, consulted and informed for each activity, which directly resolves the confusion. Routing all approvals to the CRO removes accountability from business owners and does not fix the underlying role gap.

Question 41Risk Assessment⚑ Flag

A logistics company's BIA states that its shipment tracking process can be unavailable for no more than 24 hours before customer contracts are breached. The IT recovery plan sets a 36-hour recovery time objective for the supporting application. What is the GREATEST concern?

AThe recovery point objective has not been documented in the plan BThe application vendor may not support the recovery approach CThe recovery time objective exceeds the maximum tolerable downtime DThe recovery plan has not yet been tested in a full-scale simulation

Correct answer: C. The recovery time objective exceeds the maximum tolerable downtime
The RTO must be shorter than the maximum tolerable downtime, so a 36-hour RTO against a 24-hour limit means the business would suffer unacceptable harm even if recovery goes to plan. An untested plan is also a concern, but even a perfectly tested plan with this RTO would fail the business requirement.

Question 42Risk Response & Reporting⚑ Flag

Which of the following BEST describes the primary accountability of a control owner?

AEnsuring the control operates effectively as designed BApproving exceptions to the policy the control supports CSetting the tolerance level for the related risk DDeciding which response to apply to the related risk

Correct answer: A. Ensuring the control operates effectively as designed
A control owner is responsible for making sure the control is designed and operating effectively day to day. Choosing the risk response belongs to the risk owner, who is accountable for the risk itself.

Question 43Risk Response & Reporting⚑ Flag

A hospital runs an imaging device on an old operating system that the vendor no longer patches. Replacing the device will not be possible for two years. What is the BEST recommendation?

AAccept the risk since the vendor is responsible for it BIsolate the device on a restricted network segment CInstall the latest operating system without vendor approval DDisconnect the device until a replacement is purchased

Correct answer: B. Isolate the device on a restricted network segment
When the primary control, patching, is not feasible, a compensating control such as network segmentation reduces exposure while the device stays in service. Disconnecting the device would stop a clinical service for two years. Upgrading without vendor approval could break a regulated medical device.

Question 44Risk Response & Reporting⚑ Flag

Which of the following is the BEST example of a leading key risk indicator for the risk of a data breach?

APercentage of critical servers with overdue security patches BNumber of customer complaints received after a breach notice CNumber of data breaches reported to regulators this year DTotal cost of incident response activities last quarter

Correct answer: A. Percentage of critical servers with overdue security patches
Overdue patches point to growing exposure before a breach happens, which is what makes an indicator leading. Breach counts, response costs and complaints are lagging measures because they only show the result after the event has occurred.

Question 45Governance⚑ Flag

A mid-sized healthcare provider plans to adopt a risk management framework. The CIO prefers NIST CSF because the IT team already uses it, while the enterprise risk function follows ISO 31000. What should the risk practitioner recommend FIRST?

AAdopt ISO 31000 for all risk because it is an international standard BRun both frameworks separately and compare results after a year CDefine what the organization needs the framework to achieve DAdopt NIST CSF since the IT team is already trained to use it

Correct answer: C. Define what the organization needs the framework to achieve
Framework selection or tailoring should start from business objectives, regulatory needs and how the framework will fit with enterprise risk management. Choosing a framework because one team already knows it skips that analysis and may leave IT risk disconnected from enterprise risk.

Question 46Technology & Security⚑ Flag

A hospital's scheduling system has crashed on the first Monday of each of the last four months. Each time, the service desk restored service within an hour by restarting the server. What should the risk practitioner recommend?

AAdd a scheduled restart every Sunday night as a preventive step BRaise a problem record to identify and remove the root cause CShorten the service desk target for restoring the system DUpdate the incident runbook so restarts happen faster

Correct answer: B. Raise a problem record to identify and remove the root cause
Repeated incidents with the same symptoms point to an underlying problem, and problem management exists to find and fix the root cause. A scheduled restart may hide the symptom but leaves the real cause, and its risk, in place.

Question 47Technology & Security⚑ Flag

A logistics company pursuing ISO/IEC 27001 certification has copied every control from ISO/IEC 27002 into its policy set without further analysis. What should the risk practitioner recommend FIRST?

ABenchmark the copied control set against peer organizations in the same sector BImplement every copied control quickly so it is ready for the certification audit CAsk the certification body to confirm which of the controls are mandatory to adopt DSelect controls based on the results of the information security risk assessment

Correct answer: D. Select controls based on the results of the information security risk assessment
ISO/IEC 27001 expects controls to be chosen through risk assessment and treatment, with the Statement of Applicability justifying what is included or excluded. Implementing everything quickly wastes resources and may still leave real risks poorly addressed. A certification body audits the system but does not design it for the company.

Question 48Risk Assessment⚑ Flag

An internal audit report at an insurance company notes that user access reviews for the claims system have not been done for a year. From a risk identification view, what is the MOST important next step?

AFind the risk scenarios that depend on this control and reassess exposure. BPerform the overdue access reviews on behalf of the claims department manager. CIssue a new policy that requires quarterly access reviews for every system. DClose the audit finding after the claims manager formally accepts the issue.

Correct answer: A. Find the risk scenarios that depend on this control and reassess exposure.
A control gap is a vulnerability that can raise the exposure of every risk that depends on that control, so the practitioner should update those risks. Performing the reviews personally would take over a task that belongs to the control owner and would compromise the practitioner's independence.

Question 49Governance⚑ Flag

A fast-growing fintech company has no risk committee. Business units report risks directly to the CEO in different formats, and risks that span several units are often missed. Which of the following would BEST address this issue?

AAsking the CEO to review every business unit report in more detail BEstablishing a risk committee for enterprise-wide risk oversight CRequiring each business unit to buy its own risk management tool DAssigning internal audit to approve all newly identified risks

Correct answer: B. Establishing a risk committee for enterprise-wide risk oversight
A risk committee brings leaders together to review risks consistently across the enterprise, including risks that cross unit boundaries. Having internal audit approve risks would compromise its independence, and separate tools would make reporting even less consistent.

Question 50Governance⚑ Flag

A payment processor learns that a new data localization law will take effect in 18 months in a country where it serves customers. The company currently stores that country's customer data in another region. What should the risk practitioner do FIRST?

ABegin migrating customer data to local data centers BRequest an exemption from the regulator for existing data CUpdate the information security policy to cite the law DAssess how the law changes the current risk profile

Correct answer: D. Assess how the law changes the current risk profile
The practitioner first needs to understand the gap between current practices and the new requirement and how it changes the risk profile, so the risk owner can choose a response. Migrating the data may become the chosen response, but starting it before the impact and options are analyzed is premature.

Question 51Risk Assessment⚑ Flag

An online brokerage is updating its BIA for the trade order system. The IT team proposes nightly backups because they are the cheapest option to run. Which of the following should MOST influence the recovery point objective for this system?

AThe time IT needs to rebuild servers and restore the platform BThe storage cost of retaining backups for seven full years CThe backup technology currently under contract with the IT provider DThe amount of transaction data the business can afford to lose

Correct answer: D. The amount of transaction data the business can afford to lose
The RPO reflects how much data loss the business can tolerate, which for a brokerage is likely minutes rather than a full day. Rebuild time relates to the recovery time objective, and existing backup technology should be chosen to meet the RPO rather than define it.

Question 52Risk Response & Reporting⚑ Flag

A retail chain plans to sign a three-year contract with a new payment processing provider that will handle cardholder data. Contract terms are still being negotiated. What should the risk practitioner do FIRST?

APerform due diligence on the provider's controls BRequest the provider's insurance certificate CDraft service level penalties for processing outages DSchedule an on-site audit for six months after go-live

Correct answer: A. Perform due diligence on the provider's controls
Due diligence before signing shows whether the provider can meet the organization's security and stability requirements, and the results can shape the contract. An audit after go-live comes too late to influence the decision or the terms.

Question 53Risk Response & Reporting⚑ Flag

An insurance company's control testing team can test only 40 of its 200 controls this year. Which approach is MOST appropriate?

ATest the controls that were skipped during last year's cycle BStart with the controls that are quickest to test CFocus on key controls over the most significant risks DPick 40 controls at random so every department is covered

Correct answer: C. Focus on key controls over the most significant risks
Key controls are those whose failure would leave a significant risk outside tolerance, so they deserve testing priority when resources are limited. Random or rotation-based selection may spend scarce effort on low-value controls. Choosing by ease of testing ignores risk entirely.

Question 54Risk Response & Reporting⚑ Flag

A food manufacturer is designing a KRI for late deliveries from key ingredient suppliers. Management wants red, amber and green thresholds. What should MOST influence where the red threshold is set?

AThe level of delay the business is willing to tolerate BThe reporting limits of the supplier management system CThe average late delivery rate across the industry DThe historical average late delivery rate for the company

Correct answer: A. The level of delay the business is willing to tolerate
KRI thresholds should reflect the organization's risk appetite and tolerance, so a red status means exposure has moved beyond what the business accepts. Historical averages describe past performance, but they say nothing about the level of risk management is prepared to take.

Question 55Technology & Security⚑ Flag

A university is building a new student portal that will hold grades and financial aid data. The project plan schedules the first security review after coding is complete. Which is the BEST recommendation?

AAdd a web application firewall in front of the portal at launch BDefine security and privacy requirements before design starts CAsk the security team to review the source code after coding DSchedule a full penetration test before each release to production

Correct answer: B. Define security and privacy requirements before design starts
Building security and privacy requirements in from the start is far cheaper and more effective than fixing design flaws found after coding. A penetration test is useful but finds problems late, when changes are costly.

Question 56Technology & Security⚑ Flag

During quarterly access recertification at an insurance firm, managers approved 99 percent of user entitlements within minutes. A later audit found several users with access they no longer needed. What is the BEST way to improve the effectiveness of these reviews?

ARequire each manager to sign a formal attestation when completing the review BGive reviewers context by highlighting unused and high-risk entitlements CIncrease the review frequency from quarterly to monthly for every application DMove responsibility for the reviews from line managers to the IT security team

Correct answer: B. Give reviewers context by highlighting unused and high-risk entitlements
Managers approve everything when they cannot easily tell which access matters, so highlighting unused and high-risk entitlements makes the review meaningful. Moving the reviews to IT security is tempting, but security staff do not know each user's business need, which is why managers own the decision.

Question 57Governance⚑ Flag

After a data breach at an insurance company, investigators found that employees often skipped security steps. Managers had rewarded staff based only on how quickly they processed claims. What is the MOST effective way to address the root cause?

ADiscipline the employees who skipped the steps before the breach BAdd technical controls that stop users from skipping security steps CRevise performance incentives to reward secure work, not just speed DRequire every employee to complete annual security awareness training

Correct answer: C. Revise performance incentives to reward secure work, not just speed
The root cause is an incentive structure that encouraged risky behavior, so changing incentives addresses why employees skipped the steps. Technical controls may block some shortcuts, but employees will keep seeking workarounds while they are rewarded only for speed.

Question 58Risk Assessment⚑ Flag

Which of the following BEST describes a top-down approach to developing risk scenarios?

AStarting with past incident tickets and turning each one into a new scenario BStarting with business objectives and finding events that could prevent them CStarting with a generic scenario library and tailoring it to local IT assets DStarting with vulnerability scan results and grouping them into risk themes

Correct answer: B. Starting with business objectives and finding events that could prevent them
A top-down approach begins with the organization's objectives and asks which events could threaten them. Tailoring a generic library is the bottom-up approach, which is useful but starts from a list of possible events rather than from business goals.

Question 59Governance⚑ Flag

At a software company, the sales team often signs client contracts with security commitments, such as 24-hour breach notification, without involving risk or security staff. Several commitments exceed current capabilities. What is the BEST way to address this issue?

AUpgrade incident response capabilities to meet every commitment BRequire security awareness training for the sales team CRenegotiate all existing contracts to remove those commitments DAdd a risk review of security terms to the contracting process

Correct answer: D. Add a risk review of security terms to the contracting process
Adding a risk review to contracting addresses the root cause, so new obligations are assessed and accepted by the right owner before signing. Upgrading capabilities may be needed for some contracts, but it does not stop sales from making new commitments the company cannot meet.

Question 60Risk Assessment⚑ Flag

A retail chain adds a new risk to its register: customer payment data could be exposed through its e-commerce platform. The platform is run by IT but supports revenue targets set by the head of digital sales. Who is the MOST appropriate risk owner?

AThe head of digital sales BThe risk practitioner who logged it CThe chief information security officer DThe IT platform operations manager

Correct answer: A. The head of digital sales
The risk owner should be the business leader who is accountable for the objective the risk affects and has authority to fund a response, here the head of digital sales. The CISO and the IT manager may own related controls, but they do not own the business outcome at stake.

Question 61Risk Response & Reporting⚑ Flag

A manufacturer is negotiating a contract with a cloud provider that will host its product design files. Which contract provision is MOST important for the manufacturer to be able to verify the provider's controls over the life of the contract?

AFixed pricing for the first three contract years BService credits when uptime targets are missed CA right to audit the provider's security controls DA clause that limits the provider's total liability

Correct answer: C. A right to audit the provider's security controls
A right-to-audit clause gives the manufacturer a contractual way to confirm that controls keep working after signing. Service credits compensate for outages but give no visibility into the provider's controls.

Question 62Risk Response & Reporting⚑ Flag

A retailer replaced a manual three-way match with an automated match in its ERP system. Management wants to test the automated control once and then rely on it for the full year. What is MOST important for that reliance to be justified?

AChange controls over the ERP configuration work effectively BAccounts payable staff were trained on the new matching screens CThe ERP vendor confirmed the matching logic in its release notes DThe old manual match procedure remains documented as a backup

Correct answer: A. Change controls over the ERP configuration work effectively
An automated control keeps working the same way only if its configuration cannot be changed without authorization, so effective IT general controls such as change management support relying on a single test. Vendor release notes do not show how the control is configured in this environment. Training and backup procedures do not prevent unauthorized changes.

Question 63Risk Response & Reporting⚑ Flag

An insurance company's KRI for claims fraud has shown green for two years. During that time, two large fraud schemes were discovered by external auditors. What is the MOST likely problem with the KRI?

AIt is reported to management too often to be useful. BIts thresholds were approved by the wrong committee. CIt is based on data that is too expensive to collect. DIt is not sensitive to changes in the underlying risk.

Correct answer: D. It is not sensitive to changes in the underlying risk.
A KRI that stays green while the risk materializes is not responding to changes in exposure, so it fails the sensitivity test. Approval or cost issues may exist, but they would not explain why the indicator missed real fraud events.

Question 64Governance⚑ Flag

A risk practitioner at a retail chain notices that store managers rarely report incidents, even minor ones. Interviews show that managers fear being blamed for problems in their stores. Which of the following should the risk practitioner recommend?

APromoting a no-blame reporting process backed by senior leaders BInstalling monitoring tools that detect incidents without managers CAdding incident reporting targets to store managers' reviews DHaving regional directors audit each store's incident log monthly

Correct answer: A. Promoting a no-blame reporting process backed by senior leaders
Fear of blame is a cultural barrier, and a no-blame approach visibly supported by leadership encourages open reporting. Monitoring tools may catch some events, but they leave the culture unchanged and can further reduce trust.

Question 65Technology & Security⚑ Flag

User acceptance testing of a new claims system at an insurance company found two unresolved high-severity defects. The business sponsor wants to go live on the planned date. What should the risk practitioner do FIRST?

AEscalate the open defects to the board of directors for review BRecommend delaying go-live until all defects are fixed CMake sure the sponsor understands the risk before deciding DApprove go-live on the condition that defects are fixed in a month

Correct answer: C. Make sure the sponsor understands the risk before deciding
The sponsor owns the go-live decision and must understand the residual risk of the open defects to accept it or delay. Recommending a delay may be reasonable later, but the risk practitioner advises and does not make the decision.

Question 66Technology & Security⚑ Flag

An internal audit at a hospital finds that nurses who transfer between departments keep access to patient records from their previous units. What is the MOST likely root cause?

AThe patient records system does not enforce strong password complexity rules BDepartment managers have not completed their annual privacy awareness training CAudit logging has not been enabled on the patient records application servers DThe access management process does not trigger reviews when job roles change

Correct answer: D. The access management process does not trigger reviews when job roles change
Access that builds up after transfers points to a gap in the mover part of the joiner-mover-leaver process, where a role change should prompt removal of old access. Missing audit logging is tempting because it would help detect misuse, but it does not explain why the old access was never removed.

Question 67Risk Assessment⚑ Flag

A university is building risk scenarios for its student enrollment process. The IT department has drafted ten scenarios, all based on system failures. What should the risk practitioner do NEXT?

ASelect controls for the system failure scenarios that look the most severe. BPublish the ten drafts in the risk register as the approved risk baseline. CEstimate the annual loss expectancy for each of the ten draft scenarios now. DReview the drafts with enrollment process owners to check their relevance.

Correct answer: D. Review the drafts with enrollment process owners to check their relevance.
Business process owners understand how enrollment works and what matters most, so they should help shape and confirm the scenarios. Estimating losses now would be premature because the drafts reflect only the IT view and may be incomplete.

Question 68Governance⚑ Flag

A manufacturing company is drafting its first enterprise risk management policy. Which of the following is MOST important to include?

AA ranked list of the ten highest current enterprise risks BRoles, responsibilities and accountability for managing risk CTechnical configuration standards for key systems DDetailed control procedures for every business unit and system

Correct answer: B. Roles, responsibilities and accountability for managing risk
A risk management policy sets direction and defines who is responsible and accountable, which supports consistent risk decisions across the enterprise. Detailed control procedures belong in lower-level documents and would make the policy hard to maintain.

Question 69Risk Assessment⚑ Flag

A software company acquired a smaller competitor three months ago and has started integrating its customer support systems. The enterprise risk register was last reviewed six months ago. What should the risk practitioner do FIRST?

AAdd the acquired company's register entries without further review BAsk internal audit to review the integration project controls CReassess the affected risks and update the register entries DWait for the next scheduled annual review to capture all the new changes

Correct answer: C. Reassess the affected risks and update the register entries
A major business change such as an acquisition should trigger a reassessment so the register reflects current exposure, not a six-month-old view. Copying the acquired company's entries without review risks inconsistent scales and owners, and waiting for the annual cycle leaves decisions based on stale data.

Question 70Risk Response & Reporting⚑ Flag

While reviewing a payroll provider's SOC 2 Type II report, a risk practitioner notes a section listing complementary user entity controls. What should the risk practitioner do NEXT?

ARequest a bridge letter covering the period after the report BVerify that the organization has those controls in place CAsk the provider to test those controls next year DAccept the report because the auditor issued a clean opinion

Correct answer: B. Verify that the organization has those controls in place
Complementary user entity controls are controls the customer must operate for the provider's controls to be effective. A clean opinion does not cover them, so the organization must confirm it has implemented them itself.

Question 71Risk Response & Reporting⚑ Flag

At an online marketplace, a risk practitioner estimates that a proposed fraud detection tool will cost three times more per year than the annual loss it is expected to prevent. What is the BEST next step?

AAsk the vendor to discount the tool until cost matches benefit BRecommend the tool anyway because fraud also harms the brand CGive the risk owner other response options to decide on DCancel the proposal and record the risk as formally accepted

Correct answer: C. Give the risk owner other response options to decide on
When a control costs more than the risk reduction it delivers, the risk practitioner should outline other options, such as a cheaper control, transfer or acceptance, and let the risk owner decide. Recording the risk as accepted is a decision that belongs to the risk owner, not the practitioner. Buying the tool anyway ignores the cost-benefit analysis.

Question 72Risk Response & Reporting⚑ Flag

Which of the following BEST describes a key control indicator?

AA metric that signals rising exposure to a specific risk BA metric that shows how well a specific control is operating CA metric that tracks progress toward a strategic business goal DA metric that counts loss events after they have occurred

Correct answer: B. A metric that shows how well a specific control is operating
A key control indicator measures the effectiveness of a control, such as the share of access reviews completed on time. Signaling rising risk exposure describes a key risk indicator, which focuses on the risk rather than the control.

Question 73Governance⚑ Flag

An employee at a pharmaceutical company tells the risk practitioner that a senior manager is pressuring staff to understate a compliance risk in the quarterly risk report. What should the risk practitioner do FIRST?

AConfront the senior manager directly and ask for an explanation BAsk the employee to gather more evidence before anyone takes action CEscalate it through the established ethics reporting channel DRaise the risk rating in the report based on the employee's account

Correct answer: C. Escalate it through the established ethics reporting channel
Allegations of pressure to misreport risk are ethics matters that should go through the formal channel, which protects the reporter and ensures an objective review. Changing the rating or confronting the manager acts on an unverified claim and bypasses the proper process.

Question 74Technology & Security⚑ Flag

A property management company keeps every email and tenant record indefinitely because storage is cheap. No retention schedule exists. Which is the GREATEST risk?

AExcess data increases legal and privacy exposure BBackup jobs will take longer to complete each night CStorage costs will keep rising as data grows DStaff will find it harder to locate current records

Correct answer: A. Excess data increases legal and privacy exposure
Data kept beyond its legal or business need can breach privacy laws and increases what is exposed in a breach or legal discovery. Rising storage cost is real but has a far smaller impact than regulatory and legal consequences.

Question 75Governance⚑ Flag

A business unit at a consumer electronics company asks to be exempted from a requirement in the risk management policy because it slows product launches. What should the risk practitioner do FIRST?

AGrant the exemption to support faster product launches BReject the request because policies must always be followed CRewrite the policy to remove the requirement for all units DAssess the risk and follow the formal exception process

Correct answer: D. Assess the risk and follow the formal exception process
Policy exceptions should be risk assessed and approved through a defined process by someone with the right authority, so deviations stay within appetite. Rejecting the request outright ignores a real business need and may push the unit to bypass the policy.

Question 76Risk Assessment⚑ Flag

A mid-sized retailer obtains a library of 60 generic IT risk scenarios from an industry association. What is the MOST important consideration when using this library?

ATailoring the scenarios to the retailer's business context and objectives BAssigning a quantitative loss value to each scenario before any review CConfirming that the association has updated the library in the last year DIncluding every scenario from the library in the retailer's risk register

Correct answer: A. Tailoring the scenarios to the retailer's business context and objectives
Generic scenarios are a starting point and only become useful once they are adapted to the organization's processes, assets and objectives. Adding all 60 without tailoring would fill the register with irrelevant items and could still miss risks unique to the retailer.

Question 77Technology & Security⚑ Flag

A retail bank reports that 100 percent of employees completed annual security awareness training. The board asks whether the program is actually reducing risk. Which metric would BEST answer this question?

APercentage of new hires who finish training within 30 days BAverage score on the knowledge quiz at the end of the course CChange over time in incidents caused by employee error DNumber of training modules available on the learning platform

Correct answer: C. Change over time in incidents caused by employee error
A trend in incidents caused by employee error shows whether behavior has changed, which is what actually reduces risk. Quiz scores are tempting, but they measure what people remember right after training, not how they act on the job.

Question 78Governance⚑ Flag

Which of the following BEST describes the relationship between policies and standards?

APolicies and standards are two names for the same type of governance document BStandards are optional recommendations that staff may follow at their discretion CStandards state management intent, and policies give step-by-step instructions DPolicies state management intent, and standards set mandatory rules to meet it

Correct answer: D. Policies state management intent, and standards set mandatory rules to meet it
Policies are high-level statements of management intent, and standards define mandatory requirements that put those policies into practice. Optional recommendations are guidelines, not standards.

Question 79Risk Assessment⚑ Flag

A university values its research data repository at $800,000. A storage failure is expected to destroy 25% of the asset's value, and such a failure is estimated to occur once every five years. What is the annualized loss expectancy (ALE)?

A$200,000 B$160,000 C$50,000 D$40,000

Correct answer: D. $40,000
The single loss expectancy is $800,000 x 0.25 = $200,000, and one event every five years gives an ARO of 0.2. ALE = $200,000 x 0.2 = $40,000. The $200,000 figure is the SLE alone, which ignores how often the event occurs.

Question 80Risk Response & Reporting⚑ Flag

A software company learns that its customer support vendor moved part of its ticket handling to a subcontractor in another country without telling anyone. The subcontractor can view customer records. What is the BEST way to address this risk in vendor contracts going forward?

APerform annual penetration tests on each vendor's network BRequire approval before vendors use subcontractors CProhibit vendors from operating outside the company's home country DRequire each vendor to carry higher cyber insurance limits

Correct answer: B. Require approval before vendors use subcontractors
A clause requiring approval of subcontractors gives the company visibility of fourth parties and a chance to assess them before data is shared. A blanket geographic ban is overly restrictive and still does not reveal who the subcontractors are.

Question 81Risk Response & Reporting⚑ Flag

After a regulatory finding, a logistics firm added five approval steps to its shipment release process. Shipments are now delayed, and the latest assessment shows the related risk is far below the firm's appetite. What should the risk practitioner recommend?

AAsk the board to raise risk appetite so the delays are acceptable BRationalize the steps that add little risk reduction CHire more approvers so shipments are released more quickly DKeep every step in place because a regulator raised the finding

Correct answer: B. Rationalize the steps that add little risk reduction
When residual risk is well below appetite and controls are hurting operations, the firm is likely over-controlled, so redundant steps should be streamlined while still meeting the regulatory requirement. Keeping every step ignores the cost to the business. Hiring more approvers adds cost without fixing the excess control.

Question 82Risk Response & Reporting⚑ Flag

A regional bank wants to detect unauthorized changes to its payment system settings as soon as they occur. Today, changes are reviewed in a quarterly sample by the operations team. Which monitoring approach is BEST?

AIncreasing the quarterly sample size reviewed by operations BAdding the payment system to the annual internal audit plan CA monthly control self-assessment by the payment team leads DAutomated alerts on changes from the approved baseline

Correct answer: D. Automated alerts on changes from the approved baseline
Automated continuous monitoring detects deviations close to real time, which matches the goal of catching changes as they occur. A larger quarterly sample improves coverage but still finds problems weeks or months after the fact.

Question 83Governance⚑ Flag

At a growing insurance company, the risk management function reports to the CIO. The function often reviews IT projects that the CIO sponsors. What is the GREATEST concern?

AThe risk function may focus on technology over business risk BBusiness units may be unsure how to contact the risk function CThe risk function's objectivity on IT matters may be impaired DThe CIO may not have time to review risk reports in detail

Correct answer: C. The risk function's objectivity on IT matters may be impaired
When the risk function reports to the executive whose projects it evaluates, it may hesitate to raise concerns, which weakens objective risk reporting. A technology-heavy focus is also a concern, but it is less serious than losing objectivity on the risks the function reviews.

Question 84Risk Assessment⚑ Flag

A risk practitioner at a water utility drafts this scenario: 'Systems could fail and cause service problems.' What is the GREATEST weakness of this scenario?

AIt does not identify the control owner who is responsible for the systems. BIt does not name the actor, the specific event, the asset or the timing. CIt has not yet been reviewed and approved by the board of directors. DIt does not include a quantitative estimate of the financial impact.

Correct answer: B. It does not name the actor, the specific event, the asset or the timing.
A well-formed scenario describes who or what causes the event, what happens, which asset is affected and when or for how long. A financial estimate comes later in risk analysis, and it cannot be made reliably until the scenario itself is specific.

Question 85Technology & Security⚑ Flag

A consulting firm is returning 300 leased laptops to the leasing company at the end of the contract. Which is the MOST important control?

AMake sure users have copied their files to the network drive BConfirm the laptops are counted and match the lease schedule CVerify every drive is securely wiped and documented DRemove asset tags and stickers before the laptops are shipped

Correct answer: C. Verify every drive is securely wiped and documented
Leased devices leave the firm's control, so verified and documented sanitization is what prevents client data from being exposed. Matching the inventory matters for the lease but does nothing to protect the data on the drives.

Question 86Technology & Security⚑ Flag

A manufacturing company gives all staff the same annual awareness course. Recent incidents involved administrators misusing powerful accounts and finance staff falling for payment fraud emails. What is the BEST recommendation?

AAdd targeted training that addresses the risks of each job role BReplace the annual course with a monthly security newsletter CDouble the length of the general course for the entire workforce DIntroduce disciplinary measures for employees involved in incidents

Correct answer: A. Add targeted training that addresses the risks of each job role
The incidents come from risks tied to specific roles, so role-based training targets the behaviors that matter most for each group. A longer general course is tempting, but it still does not address the specific duties of administrators or finance staff.

Question 87Governance⚑ Flag

A department at a university requests an exception to the password standard. A legacy research system it depends on cannot support complex passwords. What should the risk practitioner do FIRST?

AAsk IT to replace the legacy research system immediately BAssess the risk and identify compensating controls CChange the password standard to match the system's limits DApprove the exception, since the system cannot be changed

Correct answer: B. Assess the risk and identify compensating controls
An exception should be granted only after its risk is understood and compensating controls are considered, so the risk owner can make an informed decision. Approving the exception right away skips this analysis, and the practitioner does not hold approval authority.

Question 88Risk Assessment⚑ Flag

The CFO of a payment processor will approve a $2 million fraud detection upgrade only if the risk team shows the expected reduction in annual losses. The company has five years of reliable fraud loss data. Which approach is BEST for this analysis?

AQuantitative analysis using historical loss data BA control self-assessment completed by fraud analysts CA Delphi panel of senior managers rating the risk DQualitative analysis using a high, medium and low scale

Correct answer: A. Quantitative analysis using historical loss data
The CFO needs results in monetary terms to compare against the investment, and reliable loss history makes quantitative analysis feasible. Qualitative scales would rank the risk but could not show a dollar reduction in expected losses.

Question 89Risk Response & Reporting⚑ Flag

A media company relies on a single software-as-a-service platform for all subscriber billing. The contract renews automatically and contains no termination assistance or data return terms. Which of the following is the GREATEST concern?

AThe contract may not include service availability targets BThe provider could raise subscription prices at the next renewal date CBilling data may not be recoverable if the contract ends DThe provider might change the user interface without giving notice

Correct answer: C. Billing data may not be recoverable if the contract ends
Without exit terms, the company has no assurance it can retrieve its billing data and move to another provider, which threatens a critical process. Price increases can be negotiated or budgeted, while lost access to data cannot be easily fixed.

Question 90Risk Response & Reporting⚑ Flag

A distribution company is designing user roles for a new procurement system. Which role design would BEST reduce the risk of fraudulent purchases?

AAssign one shared role to all procurement staff for consistent access BGive buyers full access and keep a detailed log of every action taken CLet senior buyers approve their own orders up to a set dollar limit DSplit vendor setup, order approval and payment among roles

Correct answer: D. Split vendor setup, order approval and payment among roles
Segregating incompatible duties means no single person can create a fake vendor, approve a purchase and release the payment. Logging every action is a detective measure that does not stop fraud from happening. Self-approval and shared roles remove the separation that the control depends on.

Question 91Risk Response & Reporting⚑ Flag

A retail chain reports control effectiveness to its board using only the results of control self-assessments completed by store managers. No other review of these results takes place. What is the GREATEST concern?

ASelf-assessments take store managers away from sales. BThe board may receive too much detail on store controls. CStore managers may not understand the control objectives. DThe results have not been independently validated.

Correct answer: D. The results have not been independently validated.
Self-assessments build ownership and awareness, but managers rating their own controls may be biased, so results need independent validation before the board relies on them. Lack of understanding is possible, but independent review is what would detect it and any other weakness.

Question 92Governance⚑ Flag

A conglomerate has five business units that each assess IT risk separately. Each unit's ransomware risk is within its own tolerance, but all units depend on the same backup platform. What is the MOST important action for the risk practitioner?

AAggregate the risk to see the combined exposure BRecommend a separate backup platform for each business unit CAccept the risk because each unit is within its tolerance DAsk each business unit to lower its ransomware tolerance

Correct answer: A. Aggregate the risk to see the combined exposure
Risks that are acceptable individually can exceed enterprise appetite when they share a common dependency, so an aggregated view is needed. Recommending separate backup platforms is a response that is premature before the combined exposure is understood.

Question 93Risk Assessment⚑ Flag

After a series of workshops, a telecom company's risk practitioner rates a network outage scenario as low impact. The head of customer operations disagrees. She says a single outage would breach service level agreements with major clients. What should the risk practitioner do FIRST?

AEscalate the disagreement to the board risk committee for a decision. BReview the contracts and outage data to validate the rating with her. CKeep the original rating because it was agreed during the workshops. DRaise the rating to high to reflect the operations head's concern.

Correct answer: B. Review the contracts and outage data to validate the rating with her.
Scenario validation should rely on evidence, and the contracts and outage history will show whether the impact rating is realistic. Raising the rating without evidence simply swaps one opinion for another and may distort priorities.

Question 94Governance⚑ Flag

An energy company's information security policy was last updated four years ago. Since then, the company has moved most of its workloads to cloud services. Which of the following is the GREATEST concern?

AEmployees may not have signed a policy acknowledgment recently BThe policy format may not match the current corporate template CThe policy may list outdated names for department contacts DThe policy may no longer reflect current risks and operations

Correct answer: D. The policy may no longer reflect current risks and operations
Policies must be reviewed regularly and after major changes so they keep addressing the organization's actual risks. A missing acknowledgment is a compliance issue, but an outdated policy fails to direct how cloud risks should be managed.

Question 95Technology & Security⚑ Flag

A software company moved to two-week Agile sprints, but security reviews still happen only once a year before a major release. Several security flaws have reached customers. Which is the BEST way to address this risk?

AHold a security review every quarter instead of once a year BHave the product owner approve all code before each release CAdd security criteria to each sprint's definition of done DReturn to a waterfall model for all security-related features

Correct answer: C. Add security criteria to each sprint's definition of done
Building security criteria into the definition of done makes security part of every sprint, matching the Agile pace. Quarterly reviews are more frequent but still lag far behind releases every two weeks.

Question 96Technology & Security⚑ Flag

A fitness app startup plans to collect each user's full date of birth, home address and employer at sign-up. The service only needs to confirm that users are over 18. What is the BEST recommendation?

ACollect only the data needed to confirm age eligibility BEncrypt all sign-up data fields stored in the database CUpdate the privacy notice to list every data field collected DObtain explicit consent for collecting the additional fields

Correct answer: A. Collect only the data needed to confirm age eligibility
Data minimization means collecting only what the stated purpose requires, which removes the risk rather than managing it. Obtaining consent is tempting, but consent does not make collecting unnecessary data appropriate, and the extra data still creates exposure.

Question 97Risk Assessment⚑ Flag

Which of the following BEST describes the value of bow-tie analysis in risk assessment?

AIt calculates the probability distribution of losses through repeated simulation BIt ranks risks by plotting likelihood and impact on a colored grid CIt links causes and consequences of an event to preventive and recovery controls DIt builds expert consensus through anonymous rounds of questionnaires

Correct answer: C. It links causes and consequences of an event to preventive and recovery controls
A bow-tie diagram places a risk event in the center, with causes and preventive controls on one side and consequences and mitigating controls on the other. Repeated simulation describes Monte Carlo analysis, which quantifies outcomes but does not map controls to causes and consequences.

Question 98Risk Response & Reporting⚑ Flag

A software company wants a key control indicator for its change approval control. Which of the following would BEST serve this purpose?

APercentage of production changes without a matching approval BNumber of developers trained on the change process CAverage time the team takes to build and release each new feature DTotal number of changes deployed to production each month

Correct answer: A. Percentage of production changes without a matching approval
A key control indicator shows how well a specific control is operating, and changes reaching production without approval directly measure failures of the approval control. Training completion shows effort, not whether the control actually works.

Question 99Risk Response & Reporting⚑ Flag

A mortgage lender plans to deploy a data loss prevention tool that will block outbound email containing loan account numbers. The business relies heavily on email with brokers and title companies. What should be done BEFORE full deployment?

AHave the security team approve the rules on its own BRun the tool in a pilot with user acceptance testing CDeploy it to all users and tune rules after complaints DEnable the vendor's standard rule set without changes

Correct answer: B. Run the tool in a pilot with user acceptance testing
A pilot with user acceptance testing confirms the control blocks the right traffic without disrupting legitimate business communication. Deploying to everyone first and tuning later could halt critical processes. Security approval alone leaves out the business users who must accept the change.

Question 100Governance⚑ Flag

A risk practitioner at an online travel agency is preparing the annual update of the enterprise IT risk profile. Which of the following would provide the MOST useful input?

AChanges in business strategy and the threat landscape BThe number of controls tested by internal audit CThe IT department's proposed operating budget for next year DVulnerability scan results from the last quarter

Correct answer: A. Changes in business strategy and the threat landscape
The risk profile is the current overall picture of risk the enterprise faces, so it must reflect changes in business objectives and threats. Vulnerability scan results are useful detail, but they are too narrow and technical to drive an enterprise-level profile.

Question 101Risk Response & Reporting⚑ Flag

A KRI for failed customer logins at an online retailer has stayed below its amber threshold but has risen for six months in a row. What should the risk practitioner do FIRST?

AAsk the IT team to add stronger login controls right away. BLower the amber threshold so the KRI changes color sooner. CAnalyze the cause of the trend and inform the risk owner. DWait until the KRI crosses the threshold before acting on it.

Correct answer: C. Analyze the cause of the trend and inform the risk owner.
A steady upward trend can signal growing exposure even before a threshold is crossed, so the cause should be understood and shared with the risk owner. Adding controls right away is premature because the cause is not yet known and the response decision belongs to the risk owner.

Question 102Governance⚑ Flag

A risk practitioner drafted a new enterprise risk management policy for a telecom company. Which of the following should approve the policy so that it carries the right authority?

AThe risk practitioner who led the drafting BSenior management, with board oversight CThe chair of the IT steering committee DThe chief audit executive

Correct answer: B. Senior management, with board oversight
Policies express management intent, so senior management, under board oversight, should approve them to give them authority across the organization. The chief audit executive must stay independent and should not approve policies that audit will later assess.

Question 103Risk Assessment⚑ Flag

Which of the following provides the BEST evidence that an approved set of risk scenarios still reflects the organization's real exposure?

AThe number of controls mapped to each scenario in the register BThe date each scenario was last edited in the risk register tool CA survey of IT staff opinions about the organization's top risks DRecent incident and near-miss records compared with the scenarios

Correct answer: D. Recent incident and near-miss records compared with the scenarios
Actual incidents and near misses show what is really happening, so comparing them with the scenarios reveals gaps and outdated assumptions. A staff opinion survey is useful input, but it is subjective and narrower than objective event data.

Question 104Technology & Security⚑ Flag

A fintech startup uses a CI/CD pipeline that lets any developer push code to production. The team is small, so separate approvers are not practical. Which is the BEST control?

AMake peer review and automated tests required pipeline gates BRemove production deployment rights from all developers CHave the CTO review the deployment log at the end of each year DLimit production deployments to one fixed day per month

Correct answer: A. Make peer review and automated tests required pipeline gates
Mandatory peer review and automated testing in the pipeline give independent checks without slowing a small team. Removing all deployment rights ignores the business constraint, and a yearly log review detects problems far too late.

Question 105Technology & Security⚑ Flag

A city government is designing a smart parking system that will capture license plate images. The project team plans to perform a privacy impact assessment after the system goes live. What is the GREATEST concern with this approach?

AThe project budget may not cover an assessment after go-live BPrivacy risks may be built into the design and be costly to fix CAssessors may have trouble getting access to the live system DThe assessment may have to be repeated as usage grows over time

Correct answer: B. Privacy risks may be built into the design and be costly to fix
A privacy impact assessment is most valuable early, when its findings can still shape design choices at low cost. Budget or access issues after launch are real but minor compared with discovering that the core design collects or exposes personal data in ways that are hard to change.

Question 106Governance⚑ Flag

Which of the following BEST describes ISO 31000?

AGuidelines for managing risk that any organization can adapt BA catalog of security and privacy controls for information systems CA framework of governance objectives for enterprise IT DA certifiable standard for an information security management system

Correct answer: A. Guidelines for managing risk that any organization can adapt
ISO 31000 provides principles and guidelines for managing any type of risk and is meant to be adapted to each organization's context. It is not a certifiable standard, unlike ISO/IEC 27001, which covers an information security management system.

Question 107Risk Assessment⚑ Flag

A bank's risk committee uses a 5x5 heat map to prioritize technology risks. Two risks appear in the same high-high cell, but one could cost $2 million and the other $40 million. Which of the following is the GREATEST limitation this reveals?

AThe heat map does not identify which department reported each risk BThe committee has too many members to agree on final ratings CThe color scheme may be difficult for some members to interpret DBroad rating bands can group risks with very different exposures

Correct answer: D. Broad rating bands can group risks with very different exposures
Heat maps use ordinal bands, so risks with very different financial exposure can fall in the same cell and look equal. Not showing the reporting department is a minor presentation issue and does not distort how risks are prioritized.

Question 108Risk Response & Reporting⚑ Flag

A bank is launching control self-assessments for branch managers. In a pilot, managers rated controls using their own judgment, and similar controls received very different ratings. What should the risk practitioner do FIRST?

ADefine rating criteria and the evidence needed for each rating BReplace all of the self-assessments with full internal audit reviews CAverage the ratings across branches for each control DLet each region design its own self-assessment form

Correct answer: A. Define rating criteria and the evidence needed for each rating
Clear rating criteria and evidence requirements make self-assessment results consistent and comparable across branches. Replacing them with full audits would be costly and gives up the ownership benefits that self-assessment is meant to build.

Question 109Risk Response & Reporting⚑ Flag

A software company implemented multifactor authentication for remote access to reduce the risk of account takeover. The project team has formally closed the project. What is MOST important for the risk practitioner to do next?

AUpdate the project closure report with lessons learned BCalculate how much the implementation cost per user CConfirm that residual risk is now within risk appetite DAsk users how satisfied they are with the new login process

Correct answer: C. Confirm that residual risk is now within risk appetite
A post-implementation review should confirm that the new control actually reduced the risk to an acceptable level, which is the reason it was implemented. Lessons learned and cost data are useful but do not show whether the risk was addressed. User satisfaction affects adoption, but it does not measure risk reduction.

Question 110Risk Response & Reporting⚑ Flag

Executives at a hospital group receive a quarterly risk heat map. They say the same risks appear in red every quarter, and they cannot tell whether things are getting better or worse. What is the BEST improvement to the report?

AShow each risk's movement since the previous period. BRemove risks that have stayed red for several quarters. CReplace the heat map with a detailed list of all risks. DUse more colors to create finer risk rating levels.

Correct answer: A. Show each risk's movement since the previous period.
A heat map shows a point-in-time position, so adding direction-of-travel indicators lets executives see whether exposure is improving or worsening. More colors add granularity but still show only a snapshot with no sense of change.

Question 111Governance⚑ Flag

A food distributor is developing its first business continuity plan. The project lead wants to start by writing recovery procedures for each department. What should the risk practitioner recommend be done FIRST?

AWrite recovery procedures for the systems with the most users BSign a contract with an alternate processing site provider CSchedule a tabletop exercise for department recovery steps DPerform a business impact analysis to find critical processes

Correct answer: D. Perform a business impact analysis to find critical processes
A business impact analysis identifies critical processes, the impact of disruption and recovery priorities, which then shape the plan. Writing procedures first may spend effort on processes that matter little while missing the most critical ones.

Question 112Risk Assessment⚑ Flag

A bank's marketing team has signed a contract with a vendor to build a mobile app that collects customer location data. Risk management was not involved, and the app goes live in two months. What should the risk practitioner do FIRST?

AAsk the vendor to stop all work until a full risk assessment is done. BMeet with the project sponsor to identify the risks the app introduces. CRecommend cancelling the app because location data is too sensitive. DReport the marketing team to internal audit for bypassing the policy.

Correct answer: B. Meet with the project sponsor to identify the risks the app introduces.
The priority is to understand the new risk while there is still time to act, and the sponsor is accountable for the project. Asking the vendor to stop work is a decision for the business and is premature before the risks are known.

Question 113Governance⚑ Flag

The board of a fintech start-up approved a risk appetite statement saying the company has a moderate appetite for technology risk. Business managers say they cannot use the statement to make decisions. What should the risk practitioner recommend?

AAsk the board to change the appetite from moderate to low BLet each manager interpret the statement for their own area CExpress the appetite through measurable tolerances DReplace the statement with a list of prohibited activities

Correct answer: C. Express the appetite through measurable tolerances
Appetite becomes usable when it is expressed through measurable limits, such as tolerances and key risk indicators, that managers can check decisions against. Changing the level from moderate to low would not help, because the statement would still be too vague to apply.

Question 114Technology & Security⚑ Flag

A credit card processor's annual disaster recovery test restored all servers at the backup site within the four-hour RTO. Application owners did not take part, and no transactions were processed at the backup site. Management reports the test as a full success. What is the GREATEST concern?

AThe test report was written by the infrastructure team itself BBusiness recovery of the services has not been demonstrated CThe test took place outside normal business hours DThe backup site has more capacity than production needs

Correct answer: B. Business recovery of the services has not been demonstrated
Restoring servers shows only that infrastructure came back, and without application owners confirming that transactions work, the business cannot rely on meeting its recovery objective. A report written by the infrastructure team is a minor objectivity issue compared with untested business functionality.

Question 115Technology & Security⚑ Flag

A company based in the European Union wants to move its customer database to a lower-cost cloud provider that stores data in another country. What should the risk practitioner do FIRST?

ANegotiate a lower price in exchange for a longer contract term BRequire the provider to encrypt the database while it is at rest CPerform a penetration test of the provider's hosting environment DIdentify the legal requirements for transferring data abroad

Correct answer: D. Identify the legal requirements for transferring data abroad
Cross-border transfers of personal data can be restricted by law, so the practitioner must first understand which requirements apply before the move is approved. Encryption is a useful control, but choosing controls is premature before knowing the legal obligations and whether the transfer is allowed at all.

Question 116Governance⚑ Flag

An online travel agency's business impact analysis set a four-hour recovery time objective for its booking platform. The current disaster recovery plan can restore the platform in about 24 hours. What should the risk practitioner do FIRST?

AChange the recovery time objective in the analysis to 24 hours BReport the gap and its business impact to the risk owner CAsk IT to redesign the disaster recovery plan right away DBuy a hot site that can restore the platform within four hours

Correct answer: B. Report the gap and its business impact to the risk owner
The risk owner needs to understand the gap and its business impact to decide how to respond, such as investing in faster recovery or accepting the risk. Buying a hot site is a response decision that should not be made before the owner weighs the options.

Question 117Risk Assessment⚑ Flag

A health insurer estimates the inherent annualized loss from claims fraud at $300,000. A new analytics control is expected to reduce the frequency of fraud events by 80% with no change in loss per event. The board's risk appetite for this risk is $75,000 per year. Which statement is correct?

AResidual risk is $60,000, which exceeds appetite BResidual risk is $225,000, which exceeds appetite CResidual risk is $60,000, which is within appetite DResidual risk is $240,000, which exceeds appetite

Correct answer: C. Residual risk is $60,000, which is within appetite
Reducing frequency by 80% leaves 20% of the inherent exposure, so residual risk is $300,000 x 0.20 = $60,000. That is below the $75,000 appetite. The $240,000 figure is the loss avoided by the control, not the risk that remains.

Question 118Risk Response & Reporting⚑ Flag

A hotel group buys a cyber insurance policy and plans to report its ransomware risk as transferred. The policy excludes attacks attributed to state-sponsored actors and caps payouts at $2 million. What should the risk practitioner do FIRST?

ACompare exclusions and limits with the loss scenarios BLower the likelihood rating for ransomware attacks CReport the ransomware risk as fully transferred to the insurer DCancel the policy and look for a new insurer

Correct answer: A. Compare exclusions and limits with the loss scenarios
Exclusions and payout limits determine how much loss the insurer will actually cover, so comparing them with realistic scenarios shows the exposure the group still carries. Reporting the risk as fully transferred overstates the protection the policy provides.

Question 119Risk Response & Reporting⚑ Flag

During a walkthrough at a utility company, a tester confirms that the procedure for approving journal entries is well designed and that one entry was approved correctly. What should the tester do NEXT to conclude that the control is effective?

AAsk the control owner to sign a statement of compliance BRedesign the approval form to make it easier to review CReport the control as effective based on the walkthrough DTest a sample of entries from across the review period

Correct answer: D. Test a sample of entries from across the review period
A walkthrough supports design effectiveness, but operating effectiveness requires evidence that the control worked consistently over the period, usually through a sample. A single instance cannot show the control operated all year. A signed statement from the owner is self-reported and weak evidence.

Question 120Risk Response & Reporting⚑ Flag

Board members at a telecom company say the quarterly risk report is 80 pages of system-level metrics and control test results. They struggle to find what they need. Which of the following is the BEST way to improve the report?

ASummarize the top risks and the decisions they require. BHold a training session on reading the technical metrics. CAdd an index so members can find each technical section. DMove the detailed metrics into a separate appendix volume.

Correct answer: A. Summarize the top risks and the decisions they require.
Board reporting should be brief and strategic, focusing on the most significant risks, their direction and the decisions the board must make. Training the board on technical metrics keeps the focus on detail that belongs with management and operations.

Question 121Risk Assessment⚑ Flag

A healthcare company plans to acquire a smaller clinic network that runs different IT systems and serves patients in two other states. What should the risk practitioner do FIRST?

ARecommend delaying the deal until every clinic system has been replaced. BPlan to move the clinics onto the parent company's systems right after closing. CIdentify the risks that the clinic network's systems and obligations bring. DApply the parent company's current risk ratings directly to the clinics.

Correct answer: C. Identify the risks that the clinic network's systems and obligations bring.
An acquisition brings new assets, processes, regulations and threats, so the first step is to identify the risk the clinic network adds. Applying the parent's existing ratings assumes the two environments are alike, which the different systems and state rules make unlikely.

Question 122Governance⚑ Flag

A university board wants a framework focused on the governance and management of enterprise information and technology, aligned with institutional goals. Which framework would BEST meet this need?

AISO/IEC 27001 BPCI DSS CNIST SP 800-30 DCOBIT

Correct answer: D. COBIT
COBIT is a framework for the governance and management of enterprise information and technology that links IT objectives to enterprise goals. ISO/IEC 27001 focuses on an information security management system, which is narrower than enterprise IT governance.

Question 123Governance⚑ Flag

A municipal water utility updated its business continuity plan after a major reorganization. The updated plan has not yet been tested. Which of the following is the GREATEST risk?

AThe plan may not follow the latest continuity industry framework BAuditors may report the untested plan as a finding next year CStaff may need extra time to read the updated plan document DThe plan may not work as intended during an actual disruption

Correct answer: D. The plan may not work as intended during an actual disruption
Testing confirms that a plan will work when needed, and reorganizations often change roles, contacts and dependencies. An audit finding is a secondary consequence, while plan failure during a real event directly affects essential services.

Question 124Technology & Security⚑ Flag

A utility company has just written its first disaster recovery plan. Management wants to check that the plan is complete and that staff understand their roles, without affecting operations. Which test is BEST to start with?

AA parallel test running systems at the alternate site BA tabletop walkthrough with the recovery team CAn unannounced failover of the main production systems DA full interruption test that shuts down the primary site

Correct answer: B. A tabletop walkthrough with the recovery team
A tabletop walkthrough is a low-cost, non-disruptive way to find gaps in a new plan and confirm roles before more demanding tests. A parallel test does not stop operations, but it is costly and premature until the plan itself has been validated.

Question 125Technology & Security⚑ Flag

A pharmaceutical company bought a data loss prevention tool, but the security team cannot agree on which data the tool should protect. What should have been done FIRST?

ATrain all employees on the acceptable use policy for company data BDeploy the tool's endpoint agents to every laptop and workstation CEstablish a data classification scheme and identify sensitive data DConfigure the tool to block every outbound email that has an attachment

Correct answer: C. Establish a data classification scheme and identify sensitive data
A data loss prevention tool can only protect data that the organization has identified and classified, so classification is the foundation for its rules. Deploying agents everywhere is tempting, but without knowing what is sensitive the tool will either miss important data or block normal work.

Question 126Risk Assessment⚑ Flag

Which of the following is the BEST reason for a risk practitioner to assess inherent risk in addition to residual risk?

ATo provide the exact figure used in the annual financial statements BTo replace the risk owner's judgment with an objective risk score CTo remove the need for testing existing controls during the assessment DTo show how heavily the organization depends on its controls

Correct answer: D. To show how heavily the organization depends on its controls
Comparing inherent and residual risk shows how much exposure the controls absorb, which highlights the controls whose failure would hurt most. Assessing inherent risk does not remove the need to test controls, because residual risk is only accurate if controls work as designed.

Question 127Risk Response & Reporting⚑ Flag

After a new data loss prevention tool is deployed at an insurance firm, the residual risk of customer data leakage is still above the tolerance the risk owner set. What should the risk practitioner do NEXT?

ARecord the risk as accepted since a control was deployed BRaise the tolerance to match the new residual risk level CReport the remaining gap and options to the risk owner DBuy a second data loss prevention tool from another vendor

Correct answer: C. Report the remaining gap and options to the risk owner
When residual risk remains above tolerance, the risk owner must decide on further action, so the practitioner should report the gap along with options such as more mitigation or transfer. Recording the risk as accepted without the owner's decision bypasses accountability.

Question 128Risk Response & Reporting⚑ Flag

A tester is evaluating a monthly bank reconciliation performed by a senior accountant at a property management firm. Which testing method provides the MOST reliable evidence that the control operates effectively?

AInterviewing the accountant about the steps followed BReperforming selected reconciliations and comparing results CReviewing the written reconciliation procedure DConfirming the reconciliation files exist on the shared drive

Correct answer: B. Reperforming selected reconciliations and comparing results
Reperformance gives the tester direct, independent evidence that the reconciliation was done correctly. Interviews and procedure reviews show how the control should work, not that it did. Seeing that files exist does not prove differences were investigated and resolved.

Question 129Risk Response & Reporting⚑ Flag

A KRI for unplanned downtime of a manufacturer's production systems has crossed its tolerance threshold. The risk practitioner has confirmed the data is accurate. What should the risk practitioner do NEXT?

AInclude the breach in the next scheduled quarterly report. BRaise the threshold to reflect recent production volumes. CEscalate to the risk owner using the agreed process. DApprove a temporary compensating control with plant staff.

Correct answer: C. Escalate to the risk owner using the agreed process.
A breach of tolerance means exposure has moved beyond what the business accepts, so it must be escalated promptly to the risk owner through the defined process. Waiting for the next scheduled report delays the decision, and choosing a compensating control belongs to the risk owner.

Question 130Risk Assessment⚑ Flag

A software firm is moving its customer support platform to a public cloud service. The firm's IT team assumes the cloud provider will handle all security. What should the risk practitioner do FIRST?

AClarify which security duties stay with the firm under the service model. BRequest the cloud provider's most recent independent assurance report. CRecommend encrypting all customer data before any of it is migrated. DAsk the legal team to add unlimited liability terms to the cloud contract.

Correct answer: A. Clarify which security duties stay with the firm under the service model.
Under the shared responsibility model, the customer keeps some security duties, such as access management and data settings, so the team's assumption leaves risk unidentified. The provider's assurance report is helpful, but it covers only the provider's controls and will not reveal the gaps the firm owns.

Question 131Governance⚑ Flag

A hospital's ERM committee includes finance, legal and operations leaders, but no one represents IT. Recent IT outages disrupted patient services and did not appear on the enterprise risk report. What is the BEST way to improve the ERM program?

AAsk internal audit to review the recent IT outages BAdd IT risk representation to the ERM committee CCreate a separate IT risk committee reporting to the CIO DHave the CIO report IT outages directly to the board

Correct answer: B. Add IT risk representation to the ERM committee
IT risk affects business objectives such as patient care, so it should be considered within the same ERM structure as other enterprise risk. A separate IT committee reporting to the CIO keeps IT risk in a silo and away from enterprise decisions.

Question 132Governance⚑ Flag

A risk practitioner at a media company is asked to assess risk to customer data. The company does not have a complete inventory of the systems that store this data. What should the risk practitioner do FIRST?

AIdentify and document the assets that hold customer data BRun penetration tests on the customer-facing web applications CBuy a data loss prevention tool to monitor customer data flows DEncrypt every database known to contain customer information

Correct answer: A. Identify and document the assets that hold customer data
Risk cannot be assessed for assets that are not known, so the practitioner should first work with the business to identify where customer data resides. Encryption and testing are control activities that would leave unknown systems unprotected.

Question 133Technology & Security⚑ Flag

The HR department of a hotel group has chosen a SaaS provider to host employee records and wants to sign the contract this month. What should the risk practitioner do FIRST?

ANegotiate the right to audit into the contract BRequire the provider to encrypt all employee data CAssess the risk of the move against the risk appetite DApprove the move if the provider holds a security certification

Correct answer: C. Assess the risk of the move against the risk appetite
Before contract terms or controls are set, the risk of placing employee data with the provider must be understood and compared with the enterprise's risk appetite. Negotiating audit rights is useful, but it comes after the risk is assessed and the business decides to proceed.

Question 134Technology & Security⚑ Flag

During a review of a payroll system, the risk practitioner learns that the database is encrypted, but the encryption key is stored in a configuration file on the same server. What is the GREATEST concern?

ABackup copies may not be encrypted using the same key BThe encryption algorithm may not meet current industry standards CDatabase performance may degrade because of encryption overhead DAn attacker who compromises the server can also decrypt the data

Correct answer: D. An attacker who compromises the server can also decrypt the data
Keeping the key next to the encrypted data means one compromise exposes both, which largely defeats the purpose of encryption. Algorithm strength is tempting to focus on, but even a strong algorithm offers little protection when the key is easy to obtain.

Question 135Risk Assessment⚑ Flag

A commodities trader sets daily hedge positions using a complex spreadsheet built by the trading desk. The spreadsheet has no version history and no input checks, and it has never been independently tested. Which of the following is the GREATEST concern?

AThe spreadsheet file may grow too large to open on older laptops BLicensing for the spreadsheet software may lapse CThe spreadsheet may run slowly as data volumes grow DUndetected formula errors could drive costly trading decisions

Correct answer: D. Undetected formula errors could drive costly trading decisions
End-user computing tools that feed key decisions need change control and testing, because a single formula error can go unnoticed and cause large financial losses. A large or slow file is an inconvenience that does not threaten the accuracy of decisions.

Question 136Risk Response & Reporting⚑ Flag

Two controls are proposed to reduce fraud risk in an online marketplace, and both would bring the risk within appetite. One costs less to buy but needs more staff to operate. The other costs more to buy but is largely automated. Which is the BEST basis for choosing between them?

AThe total cost of ownership of each control BThe control preferred by the IT department CThe control most widely used in the industry DThe purchase price of each control

Correct answer: A. The total cost of ownership of each control
When both options meet the appetite, the better choice is the one with the lower cost over its full life, including staffing and maintenance. The purchase price alone ignores operating costs that may make the cheaper control more expensive.

Question 137Risk Response & Reporting⚑ Flag

A retailer has ended its contract with a digital marketing agency that had remote access to its customer database. Which of the following is MOST important to complete?

ANotify customers that the agency no longer works with the retailer BRevoke access and confirm the data was returned or destroyed CSend the agency a satisfaction survey about the relationship DArchive copies of the agency's past marketing campaigns

Correct answer: B. Revoke access and confirm the data was returned or destroyed
When a vendor relationship ends, leftover accounts and retained customer data create exposure that the retailer no longer controls. Notifying customers is not required here and does nothing to remove the agency's access.

Question 138Risk Response & Reporting⚑ Flag

A government has published a draft law that would limit how a fintech company can use customer data for marketing. The law may take effect in two years. What is the BEST action for the risk practitioner?

AAsk the legal team to decide whether the risk needs reporting. BImplement controls now to meet every requirement in the draft. CWait until the law is final before taking any further action. DAssess the likely impact and report it as an emerging risk.

Correct answer: D. Assess the likely impact and report it as an emerging risk.
An emerging risk should be assessed and reported early so management can plan a response with enough lead time. Building controls for a draft that may still change is premature and may waste resources.

Question 139Risk Assessment⚑ Flag

A retail chain plans to outsource payroll processing to a specialist provider. The finance director says payroll risk will no longer be the chain's concern once the contract is signed. Which of the following is the risk practitioner's BEST response?

AThe provider's assurance report will fully cover the chain's payroll risk. BPayroll risk ownership moves to the provider's management under the contract. CThe chain stays accountable for payroll risk even when the work is outsourced. DPayroll risk can be removed from the register once the contract is signed.

Correct answer: C. The chain stays accountable for payroll risk even when the work is outsourced.
An organization can outsource a process but not its accountability, so payroll risk must stay in the register with a business owner. Moving ownership to the provider is the tempting view, but the provider only performs the work while the chain still bears the consequences.

Question 140Governance⚑ Flag

Management at a credit union asks the internal audit team to design and implement a new IT risk assessment process. The audit team would then audit that process next year. What is the GREATEST concern?

AAudit staff may lack enough technical IT knowledge BInternal audit's independence would be impaired CThe audit schedule may be delayed by the project DThe process may not align with the risk framework

Correct answer: B. Internal audit's independence would be impaired
If internal audit designs and implements a process and then audits it, it reviews its own work, which undermines the independent assurance the third line provides. A lack of technical knowledge can be fixed with training or outside experts, while impaired independence reduces the value of the audit itself.

Question 141Governance⚑ Flag

A hospital's asset inventory lists many clinical applications without a named owner. Which of the following is the GREATEST concern?

AThe inventory may contain duplicate entries for some applications BIT may need extra time to track software version updates CNo one is accountable for protecting these applications DLicensing costs for these applications may be hard to monitor

Correct answer: C. No one is accountable for protecting these applications
Asset owners are accountable for decisions about protection, access and risk, so unowned assets may not be properly protected. Duplicate entries and licensing issues are administrative problems with far less impact on patient care and data.

Question 142Technology & Security⚑ Flag

A credit union plans to use a machine learning model to approve small business loans. The model will be trained on 10 years of past loan decisions made by staff. Which is the GREATEST risk to address before deployment?

AThe model may repeat biases found in past decisions BThe vendor may release updates to the model too often CThe model may need more computing power than planned DLoan officers may resist using the new model at first

Correct answer: A. The model may repeat biases found in past decisions
Historical decisions can contain unfair patterns, and a model trained on them will repeat those biases, creating legal, regulatory and reputational risk. Staff resistance is a change management issue that is much easier to handle.

Question 143Technology & Security⚑ Flag

A commodities trading firm must ensure that traders cannot later deny submitting high-value orders through its internal platform. Which control BEST supports this requirement?

AEncryption of order data while in transit across the network BDigital signatures using keys issued to each individual trader CShared team accounts with strong, frequently rotated passwords DDaily reconciliation of submitted orders against settlement records

Correct answer: B. Digital signatures using keys issued to each individual trader
Digital signatures tied to individual keys provide nonrepudiation because only the key holder could have signed the order. Encryption in transit is tempting, but it protects confidentiality and does not prove who sent the order.

Question 144Risk Assessment⚑ Flag

A shipping firm's experts can only estimate cyber loss as a range, such as $1 million to $8 million per event, along with a most likely value. Executives want to know the chance that annual losses will exceed $10 million. Which technique is MOST appropriate?

AMonte Carlo simulation of the estimated ranges BA qualitative heat map built from expert ratings CBow-tie analysis of the main loss scenarios DA business impact analysis of shipping processes

Correct answer: A. Monte Carlo simulation of the estimated ranges
Monte Carlo simulation samples repeatedly from input ranges to produce a distribution of outcomes, which answers how likely losses are to exceed a threshold. A heat map ranks risks on ordinal scales and cannot express the probability of exceeding a dollar amount.

Question 145Risk Response & Reporting⚑ Flag

A pharmaceutical company has more than 600 active vendors and a small third-party risk team. Every vendor currently receives the same annual questionnaire. What is the BEST way to improve ongoing vendor monitoring?

AMonitor only the vendors with the largest contract values BOutsource all vendor monitoring to a consulting firm CScale monitoring depth to each vendor's risk tier DSend the questionnaire to every vendor twice a year

Correct answer: C. Scale monitoring depth to each vendor's risk tier
Tiering vendors by criticality and access to data lets a small team focus deeper monitoring where the risk is highest. Contract value is a weak proxy, because a low-cost vendor may still have access to sensitive systems.

Question 146Risk Response & Reporting⚑ Flag

Which of the following BEST describes a directive control?

AA control that records events for later review and analysis BA control that states expected behavior, such as a policy CA control that discourages violations through visible warnings DA control that blocks an unauthorized action before it occurs

Correct answer: B. A control that states expected behavior, such as a policy
Directive controls tell people what they must or must not do, typically through policies, standards and procedures. A deterrent control discourages violations, for example through warning signs, but does not itself define required behavior. Blocking an action before it happens describes a preventive control.

Question 147Risk Response & Reporting⚑ Flag

A cloud payroll provider's monthly reports show it meeting its 99.9 percent availability target. However, HR staff often report that the service is unavailable during business hours. What should the risk practitioner do FIRST?

ATerminate the contract and choose a new provider BAsk HR staff to stop reporting outages informally CAccept the provider's reports since they meet the SLA DReview how the SLA defines and measures availability

Correct answer: D. Review how the SLA defines and measures availability
Providers may exclude maintenance windows or partial outages from availability figures, so checking the SLA definitions against the company's own monitoring shows whether the reports reflect real service. Accepting the reports without question ignores clear evidence of a gap.

Question 148Risk Assessment⚑ Flag

A health research foundation plans to publish an anonymized patient dataset. Names and ID numbers are removed, but ZIP code, birth date and diagnosis are kept. During risk identification, what is the GREATEST concern?

AIndividuals could be re-identified by linking it with public data BOther institutions may publish similar datasets first CResearchers may find the dataset too limited for their studies DThe file may be too large for most researchers to download and process

Correct answer: A. Individuals could be re-identified by linking it with public data
Combinations of quasi-identifiers such as ZIP code, birth date and diagnosis can be matched with public records to identify individuals, which would breach privacy obligations. Limited research usefulness is a business concern, not a privacy exposure.

Question 149Governance⚑ Flag

A pharmaceutical company operates in 12 countries. Last year it was fined because staff missed a new privacy rule in one country. What is the BEST way to prevent this from happening again?

AApply the strictest privacy rule found anywhere to all countries BEstablish a process to monitor and assess regulatory changes CIncrease the budget for external legal counsel in each country DHire a dedicated privacy officer in every country of operation

Correct answer: B. Establish a process to monitor and assess regulatory changes
A formal regulatory change process makes sure new requirements are identified, assessed for impact and assigned to owners in time. Applying the strictest rule everywhere may reduce some exposure, but it does not ensure that new or different requirements are detected.

Question 150Governance⚑ Flag

A consulting firm wants to apply security controls to its data in a consistent and cost-effective way. Which of the following should be done FIRST?

AEncrypt all data stored on laptops and portable media BDeploy strict access controls on all shared file repositories CTrain staff to handle confidential documents securely DClassify data by its sensitivity and business value

Correct answer: D. Classify data by its sensitivity and business value
Classification tells the firm which data needs the most protection, so controls can match the value and sensitivity of each data type. Encrypting everything without classification may waste resources and still leave handling rules unclear.