Free CRISC Practice Exam (2026)

Your score by topic

Get a free CRISC study plan on WhatsApp See CRISC Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Governance⚑ Flag

A software company's strategy is to be first to market with new features. Its risk appetite statement, written years ago, is very conservative, so most release risks are rated as unacceptable. What should the risk practitioner recommend?

AAsk senior management to review the appetite against the strategy BLower the risk ratings so that they fit the strategy for speed CAdd more controls to the release process to reduce every risk DDelay new releases until all risks fall within the current appetite

Correct answer: A. Ask senior management to review the appetite against the strategy
Risk appetite should reflect the organization's current strategy, and only senior management and the board can change it. Delaying releases could undermine the strategy without confirming whether the old appetite is still valid.

Question 2Governance⚑ Flag

Which of the following is the PRIMARY benefit of integrating IT risk management into enterprise risk management?

AIT controls can be tested more often by internal audit BIT staff gain full authority over risk acceptance decisions CIT risk is prioritized with other risks by business impact DIT risk assessments require fewer resources to complete

Correct answer: C. IT risk is prioritized with other risks by business impact
Integration lets management compare IT risk with strategic, financial and operational risk in the same business terms, so resources go to what matters most. Needing fewer assessment resources might be a side effect, but it is not the main purpose of integration.

Question 3Risk Assessment⚑ Flag

A cruise line identifies that its booking database could be encrypted by ransomware. The risk practitioner is now documenting the impact component of this risk. Which of the following BEST describes the impact?

ACriminal groups that deploy ransomware to extort payment from victims BUnpatched software and weak passwords on the booking database servers CThe booking database and the servers in the data center that host it DLost bookings and revenue while customers are unable to reserve cabins

Correct answer: D. Lost bookings and revenue while customers are unable to reserve cabins
Impact is the business consequence of the event, such as lost revenue and unhappy customers. The database and its servers are the asset, which is what the threat affects rather than the consequence the business feels.

Question 4Risk Assessment⚑ Flag

A water utility's IT team reports that a server vulnerability would have severe technical impact because 40 servers are affected. The risk practitioner is preparing the assessment for senior management. Which of the following is MOST important when rating impact?

AUsing the vulnerability severity score reported by the scanning tool BEstimating the hours IT staff would need to apply the fix CCounting the total number of servers and devices affected DExpressing the effect on service delivery and business objectives

Correct answer: D. Expressing the effect on service delivery and business objectives
Impact should be rated by the effect on business objectives, such as safe water delivery or regulatory compliance, so leaders can compare it with appetite. A scanner severity score describes the technical weakness but not what a disruption would mean to the business.

Question 5Risk Response & Reporting⚑ Flag

Risk transfer through insurance is MOST appropriate for which type of risk?

AFrequent events with small losses BRare events that could cause severe losses CEvents that are fully covered by existing controls DEvents that fall well within the risk appetite

Correct answer: B. Rare events that could cause severe losses
Insurance is most cost-effective for low-likelihood, high-impact events that the organization could not easily absorb. Frequent small losses are usually cheaper to mitigate or accept, because premiums would roughly equal the losses plus the insurer's margin.

Question 6Risk Response & Reporting⚑ Flag

An airline's customer service chatbot uses generative AI. It recently gave several customers incorrect refund rules that the airline then had to honor. What is the BEST risk response?

ALet the chatbot correct itself by learning from customer complaints BLimit answers to approved sources and review outputs regularly CRemove the chatbot and return to phone support only DAdd a note that customers should not trust the chatbot

Correct answer: B. Limit answers to approved sources and review outputs regularly
Grounding the chatbot in approved policy content and monitoring its answers reduces the chance of false statements while keeping the service. Removing the chatbot entirely avoids the risk but gives up its benefits when a targeted control would work.

Question 7Risk Response & Reporting⚑ Flag

A department head reports that an action plan to fix weak vendor onboarding controls is complete. The plan was meant to lower a high risk to medium. What should the risk practitioner do BEFORE updating the residual risk rating?

AClose the action in the register and notify the risk owner. BSchedule the controls for testing in next year's audit plan. CAsk the department head to sign a completion statement. DVerify with evidence that the new controls are effective.

Correct answer: D. Verify with evidence that the new controls are effective.
Residual risk should only change once there is evidence that the action was implemented and the controls are operating effectively. A signed completion statement confirms that work was done, not that the risk was actually reduced.

Question 8Technology & Security⚑ Flag

A publishing company's IT team says years of quick fixes and outdated custom code now consume most of its budget. Leadership has rejected past requests to fund cleanup. Which is the BEST way for the risk practitioner to support the request?

AList every outdated component with its age and version number BCompare the IT budget with industry averages for maintenance CShow how the technical debt threatens key business goals DRecommend a freeze on new projects until cleanup is finished

Correct answer: C. Show how the technical debt threatens key business goals
Leaders fund what they see as a threat to business goals, so linking technical debt to impacts on objectives makes the risk meaningful to them. A detailed component list is technical and does not show why the business should care.

Question 9Technology & Security⚑ Flag

A university relies almost entirely on its perimeter firewall to protect research systems. Internal networks are flat, and endpoints have minimal protection. What is the BEST recommendation?

APurchase cyber insurance to cover losses from a network breach BAdd layered controls so a single failure does not expose systems CReplace the existing firewall with a newer model from another vendor DIncrease the frequency of firewall rule reviews to once a month

Correct answer: B. Add layered controls so a single failure does not expose systems
Defense in depth uses multiple layers, such as segmentation and endpoint controls, so the failure of one safeguard does not leave systems exposed. A newer firewall is tempting, but it keeps the same single point of failure.

Question 10Governance⚑ Flag

A retail bank is drafting its five-year strategic plan. Which of the following is the BEST way for the risk function to add value during this process?

ABuild a full control framework before options are discussed BConfirm each strategic goal has an assigned IT project manager CGive input on risks and opportunities in each strategic option DReview the final plan after approval and update the risk register

Correct answer: C. Give input on risks and opportunities in each strategic option
Providing risk insight while options are still being considered helps leaders choose a strategy with a clear view of risk and reward. Reviewing the plan only after approval misses the chance to influence key decisions.

Question 11Governance⚑ Flag

A risk practitioner at an energy utility is asked to help establish an ERM program where none exists today. What should be done FIRST?

AGain senior management support and define program objectives BPurchase a governance, risk and compliance software platform CPerform a detailed risk assessment of every IT system in use DDraft treatment plans for the most visible current risks

Correct answer: A. Gain senior management support and define program objectives
An ERM program needs executive sponsorship and clear objectives before processes, tools or assessments can work well. Buying a tool first risks automating a process that has not yet been defined.

Question 12Risk Assessment⚑ Flag

A risk practitioner confirms a weakness in an internal system, but no credible threat that could exploit it exists at this time. Which of the following is the BEST way to treat this weakness?

ARemove it from review, since a risk needs both a threat and a weakness BRecord it and watch for threats that could later make it exploitable CAccept it formally on behalf of the system owner and close the item DTreat it as a high risk and require that it be fixed this quarter

Correct answer: B. Record it and watch for threats that could later make it exploitable
Without a credible threat there is little current risk, but the threat landscape changes, so the weakness should be recorded and monitored. Dropping it from review is tempting because no threat exists today, yet a new threat could appear and the weakness would then be forgotten.

Question 13Risk Assessment⚑ Flag

A government agency's new chief risk officer asks the risk practitioner to assess a citizen benefits platform that launches next quarter. What should the risk practitioner do FIRST?

ADefine the scope, context and risk criteria with stakeholders BRun a vulnerability scan of the platform's test environment CDraft risk response plans for the most likely threat events DPopulate the risk register with risks found on similar platforms

Correct answer: A. Define the scope, context and risk criteria with stakeholders
Establishing scope, context and the criteria for judging risk comes first in ISO 31000 and NIST SP 800-30 approaches, because it defines what will be assessed and how results will be rated. A vulnerability scan is a technical input that is premature until the assessment boundaries are agreed.

Question 14Risk Response & Reporting⚑ Flag

Two years ago, a utility company's operations director accepted the risk of running an unsupported control system because it was isolated from the internet. The system has since been connected to the corporate network for remote monitoring. What should the risk practitioner do FIRST?

AReport the change to the external regulator BDisconnect the system from the corporate network CReassess the risk with the operations director DLeave the acceptance in place until its review date

Correct answer: C. Reassess the risk with the operations director
A risk acceptance is based on the conditions at the time, so a significant change such as new network connectivity requires the risk to be reassessed with its owner. Disconnecting the system is an operational decision for the business, not the risk practitioner.

Question 15Risk Response & Reporting⚑ Flag

A small accounting firm with no dedicated security staff wants a short, prioritized set of safeguards to begin improving its cyber defenses. Which approach is MOST appropriate?

AAdopt the full COBIT governance system across the entire firm BImplement every control in the NIST SP 800-53 high baseline CPursue ISO/IEC 27001 certification within the next six months DBegin with CIS Controls Implementation Group 1 safeguards

Correct answer: D. Begin with CIS Controls Implementation Group 1 safeguards
CIS Controls Implementation Group 1 defines essential cyber hygiene safeguards intended for organizations with limited resources and expertise. The NIST high baseline and a rushed certification effort would overwhelm a small firm with no security staff. COBIT addresses governance rather than a prioritized list of technical safeguards.

Question 16Risk Response & Reporting⚑ Flag

A risk owner at a utility has missed three deadlines for a critical action plan. The risk practitioner has followed up in writing each time without a response. What is the BEST next step?

ARecord the risk as accepted since the owner has not responded. BComplete the remaining actions on behalf of the risk owner. CRemove the action plan from the register until resources exist. DEscalate the issue to senior management per governance rules.

Correct answer: D. Escalate the issue to senior management per governance rules.
When normal follow-up fails, the defined escalation path brings the issue to management with the authority to act. Recording the risk as accepted is not valid because only the risk owner or management can accept a risk, and silence is not a decision.

Question 17Technology & Security⚑ Flag

Which of the following BEST describes how enterprise architecture supports risk management?

AIt shows how business processes depend on technology components BIt sets the risk appetite for new technology investments CIt provides the approved list of hardware and software vendors to use DIt removes the need to keep a separate risk register for IT systems

Correct answer: A. It shows how business processes depend on technology components
Enterprise architecture maps the links between business processes, data and technology, which helps reveal dependencies, single points of failure and the impact of change. It does not set risk appetite, which is a decision for senior management and the board.

Question 18Technology & Security⚑ Flag

A consulting firm grants full internal network access to any device that connects through its VPN. Leadership wants to adopt zero trust principles. Which change BEST reflects this goal?

AUpgrade the VPN gateway so it supports more simultaneous connections BVerify identity and device posture for every request to each resource CRequire employees to change their VPN passwords every 30 days DPermit VPN connections only from countries where the firm has offices

Correct answer: B. Verify identity and device posture for every request to each resource
Zero trust removes implicit trust based on network location and checks identity and device context for each access request. Limiting VPN access by country is tempting, but once connected the device would still be trusted with broad access.

Question 19Governance⚑ Flag

Two divisions at an airline disagree. Marketing wants to share customer data with partners to grow revenue, while compliance wants to limit sharing to reduce privacy risk. What should the risk practitioner do?

AAsk IT to design technical controls that satisfy both divisions BSide with compliance, since regulatory risk always outweighs revenue CLet marketing proceed, since revenue growth is a stated strategic goal DGive senior management a risk and benefit analysis to decide

Correct answer: D. Give senior management a risk and benefit analysis to decide
Conflicting objectives should be resolved by senior management using a clear view of risks and benefits in light of enterprise objectives and appetite. Siding with either division takes a decision the practitioner does not own.

Question 20Governance⚑ Flag

At an e-commerce company, business managers say risk management is the risk department's job, so they do not track risks in their own areas. What is the BEST way for the risk practitioner to address this?

AEscalate the managers' position to internal audit BIncrease second line testing of unit controls CClarify that managers own the risks in their areas DAssign a risk analyst to manage each unit's risks

Correct answer: C. Clarify that managers own the risks in their areas
In the three lines model, first line management owns and manages risk, while the second line supports and challenges. Assigning risk analysts to manage each unit's risks shifts ownership to the second line and blurs accountability.

Question 21Risk Assessment⚑ Flag

While preparing for a risk assessment, a risk practitioner at a media company finds that the IT asset inventory has not been updated in two years. What is the GREATEST concern?

ARisk affecting new or changed assets may not be identified. BThe inventory tool may no longer be supported by its vendor. CThe audit team may issue a finding about poor documentation. DSoftware license costs may be higher than what is budgeted.

Correct answer: A. Risk affecting new or changed assets may not be identified.
Risk identification depends on knowing which assets exist and what they support, so an outdated inventory can leave whole areas of risk unseen. An audit finding is possible, but it is a symptom, while the real concern is unidentified exposure.

Question 22Risk Assessment⚑ Flag

A multinational retailer's IT risk register holds over 300 detailed risks. The board asks for a short view of technology risk that it can compare with its risk appetite. Which approach is BEST?

APresent the complete register sorted by the highest inherent rating BReport only the ten risks with the highest technical severity CGroup related risks into categories linked to business objectives DSummarize the number of open risks held by each department

Correct answer: C. Group related risks into categories linked to business objectives
Rolling detailed risks up into categories tied to business objectives gives the board a concise view it can measure against appetite. Showing only the top ten by technical severity uses criteria the board cannot relate to objectives and hides much of the overall picture.

Question 23Risk Response & Reporting⚑ Flag

A sales director at a software firm signs a risk acceptance for storing customer contracts in an unapproved file sharing tool. The assessed risk level is well above the risk appetite approved by the board. What should the risk practitioner do?

AEscalate the decision to senior management BRemove the tool from the sales team's devices CRecord the acceptance because the director signed it DAsk the sales team to encrypt files before upload

Correct answer: A. Escalate the decision to senior management
A manager cannot accept a risk that exceeds the board-approved appetite, so the decision must go to the level with that authority. Simply recording the signed acceptance would leave the organization operating outside its appetite.

Question 24Risk Response & Reporting⚑ Flag

Which of the following is an example of a corrective control?

AAlerting the security team when malware is detected BRestoring affected servers from clean backups CPosting signs that warn against unauthorized entry DRequiring manager approval before software is installed

Correct answer: B. Restoring affected servers from clean backups
Corrective controls reduce the impact of an event after it occurs by restoring systems or data to normal. Alerting the security team is detective, because it identifies the event but does not fix it. Approval before installation is preventive, and warning signs are deterrent.

Question 25Risk Response & Reporting⚑ Flag

While preparing a monthly report, a risk practitioner notices that a KRI for malware detections dropped from about 400 to zero. No new security tools were added. What should the risk practitioner do FIRST?

AValidate that the KRI data source is working correctly. BReport the drop as an improvement in the security posture. CRemove the KRI from the report until the next review cycle. DLower the KRI thresholds to reflect the new detection level.

Correct answer: A. Validate that the KRI data source is working correctly.
A sudden, unexplained change usually points to a data collection problem, so the data must be validated before it is reported. Reporting the drop as an improvement could give management false comfort if the feed has simply stopped.

Question 26Technology & Security⚑ Flag

A telecom provider's change team relies on the configuration management database to judge the impact of each change. An internal review found that 40% of its records are out of date. Which is the GREATEST concern?

AThe database may need a costly upgrade to a newer version BAsset depreciation figures in finance may be misstated CChange impact assessments may miss affected systems DLicense counts reported to vendors may be inaccurate

Correct answer: C. Change impact assessments may miss affected systems
When configuration records are wrong, the team cannot see which systems a change touches, so changes can cause unexpected outages. License and depreciation errors are real but have a smaller impact on service availability.

Question 27Technology & Security⚑ Flag

Which of the following BEST describes the need-to-know principle?

AMultiple layers of control protect information if one layer fails BInformation is disclosed only to those whose duties require it CUsers receive only the minimum system permissions their job requires DNo single person controls all steps of a critical transaction

Correct answer: B. Information is disclosed only to those whose duties require it
Need to know limits access to specific information to people whose duties require it. Least privilege is closely related and often confused with it, but it focuses on limiting system rights and permissions rather than which information a person may see.

Question 28Governance⚑ Flag

The chief audit executive at a hospital group asks the risk function for input to next year's risk-based internal audit plan. Which of the following would be MOST useful to provide?

AA list of the controls that are cheapest to test BNames of the managers who have disagreed with past audit findings CThe full history of every incident logged in the past decade DThe current risk profile, with key risks and control reliance

Correct answer: D. The current risk profile, with key risks and control reliance
A risk-based audit plan directs assurance to the areas of greatest exposure, so the current risk profile and the controls the organization relies on most are the best input. A complete incident history is raw data that the audit team would still need to analyze and prioritize.

Question 29Governance⚑ Flag

At a bank, the IT department, the compliance team and internal audit each test the same access controls in the same quarter, using different criteria. Business units complain about repeated reviews. What is the BEST recommendation?

ACoordinate assurance activities across the three lines BReduce testing of access controls to once per year CLet business units choose which team tests their controls DStop compliance testing since internal audit covers it

Correct answer: A. Coordinate assurance activities across the three lines
Coordinating assurance, often called combined assurance, reduces duplication while keeping each line's role and independence. Stopping compliance testing removes second line oversight and assumes the audit scope fully replaces it.

Question 30Risk Assessment⚑ Flag

An e-commerce company identifies risk each year using only the incidents it suffered in the past three years. What is the GREATEST weakness of this approach?

AIt does not include the cost of current controls in the review. BIt may miss emerging threats that the company has not yet faced. CIt may overstate how often previously seen incidents will recur. DIt does not use quantitative methods to rate each past incident.

Correct answer: B. It may miss emerging threats that the company has not yet faced.
Past incidents show only threats the company has already met, while new attack methods, technologies and regulations can create very different risks. Overstating recurrence is a minor accuracy concern compared with leaving new threats out entirely.

Question 31Risk Assessment⚑ Flag

A pharmaceutical distributor's BIA was completed entirely by the IT department and lists 60 applications ranked by number of users. What is the GREATEST concern with this BIA?

ACriticality was not based on the impact to business processes BThe application inventory may not be complete or fully current CThe ranking method was not approved by internal audit DThe number of users may change over the next year

Correct answer: A. Criticality was not based on the impact to business processes
A BIA should start from business processes and the impact of their disruption, then map the applications that support them. Ranking by user count can place a widely used but noncritical tool above a low-use system that keeps regulated shipments moving. An incomplete inventory matters, but the method itself is the bigger flaw.

Question 32Risk Response & Reporting⚑ Flag

A fintech startup's hosting provider offers only a SOC 2 Type I report. Which of the following is the GREATEST limitation of relying on this report?

AIt is paid for by the provider BIt covers security but not the other trust services criteria CIt cannot be shared with the startup's own external auditors DIt does not test controls over a period of time

Correct answer: D. It does not test controls over a period of time
A Type I report addresses control design at a single point in time, while a Type II report tests whether controls operated effectively across a period. Auditor selection by the provider is normal for SOC reports and does not by itself reduce reliance.

Question 33Risk Response & Reporting⚑ Flag

A trading firm relies on a daily review of the prior day's wire transfers to identify unauthorized payments. Individual transfers can exceed one million dollars. What is the GREATEST weakness of this approach?

AFunds may be lost before an unauthorized transfer is found BReviewers may lack training on the payment system screens CThe daily review produces too much paper documentation DThe review may be skipped on days when staff are on leave

Correct answer: A. Funds may be lost before an unauthorized transfer is found
A detective control alone finds unauthorized transfers only after the money has moved, which is a serious gap for large, irreversible payments. A preventive control such as dual authorization at release would address this. Missed reviews and training gaps are concerns, but they are secondary to the design gap.

Question 34Risk Response & Reporting⚑ Flag

A ransomware attack at a peer company encrypted production systems and then deleted the online backups using stolen administrator credentials. A law firm wants to avoid the same outcome. Which control would BEST address this risk?

AMore frequent backups to the same storage system BLonger retention of backups on the primary network CBackup copies that are immutable or kept offline DAntivirus software installed on all backup servers

Correct answer: C. Backup copies that are immutable or kept offline
Immutable or offline backups cannot be changed or deleted by an attacker who gains administrator access, so recovery remains possible. More frequent backups to the same storage would still be reachable and could be deleted in the same attack.

Question 35Governance⚑ Flag

The risk owner for a key vendor risk at a telecom company has left the organization, and no replacement has been named. What should the risk practitioner do FIRST?

AAsk management to assign a new owner for the risk BTransfer the risk to the vendor's account manager CTake ownership of the risk until a new owner is found DClose the risk in the register until an owner is assigned

Correct answer: A. Ask management to assign a new owner for the risk
Every risk needs an accountable owner in the business, so management should assign a new one promptly. The practitioner should not take ownership, because that blurs the line between advising on risk and being accountable for it.

Question 36Technology & Security⚑ Flag

At an airline, the service desk handles incidents in the order they arrive. Last month a booking system outage waited two hours behind routine password reset requests. Which is the BEST recommendation?

AHire more service desk staff to clear the queue faster BLet users reset their own passwords through a self-service portal CSend all incidents directly to the system owners for handling DPrioritize incidents based on business impact and urgency

Correct answer: D. Prioritize incidents based on business impact and urgency
Prioritizing by business impact and urgency ensures that critical services are restored first. Self-service password resets would shorten the queue, but they would not stop the next critical incident from waiting behind lower-priority work.

Question 37Technology & Security⚑ Flag

A streaming service doubled its deployment frequency this year. Over the same period, the share of production changes that caused incidents or rollbacks rose from 5 percent to 22 percent. What should the risk practitioner recommend FIRST?

AStop counting rollbacks so the metric shows only real incidents BAnalyze failed changes to find gaps in testing and review CReturn to monthly releases until the failure rate falls DRequire the CTO to approve every production deployment

Correct answer: B. Analyze failed changes to find gaps in testing and review
A rising change failure rate signals weaknesses in testing, review or deployment practices, and analyzing the failed changes shows which controls need strengthening. Returning to monthly releases may reduce failures for a while but gives up business benefits without fixing the cause.

Question 38Governance⚑ Flag

The board of a telecom company asks whether the company's overall IT risk is at an acceptable level. Which of the following would BEST answer this question?

AA list of every open internal audit finding related to IT systems BA summary of all security incidents recorded over the past year CA comparison of the current risk profile with risk appetite DA benchmark of IT spending against industry peers

Correct answer: C. A comparison of the current risk profile with risk appetite
Whether risk is acceptable depends on how the current risk profile compares with the appetite the board has set. Incident summaries show past events but do not show whether current overall exposure is within appetite.

Question 39Risk Assessment⚑ Flag

Which of the following BEST describes the primary purpose of threat modeling during the design of a new system?

ATo confirm that the system meets every applicable legal requirement BTo find how the system could be attacked while design changes are cheap CTo replace penetration testing that would otherwise occur before go-live DTo produce a final quantitative risk rating for the system's owner

Correct answer: B. To find how the system could be attacked while design changes are cheap
Threat modeling looks at the design to see how attackers could abuse it, so weaknesses can be fixed before they are built in. It complements later testing rather than replacing it, because testing checks what was actually built.

Question 40Governance⚑ Flag

At a credit union, the IT team is short-staffed. The enterprise risk team has started running the daily user access reviews for the core banking system. Which of the following is the GREATEST concern?

AThe risk team may lack technical skills to review access rights BIT staff may need to document the review procedure in more detail CThe access reviews may take longer than they did with the IT team DThe risk team may lose objectivity in overseeing these controls

Correct answer: D. The risk team may lose objectivity in overseeing these controls
The risk function should oversee and challenge controls run by the business, not operate them. When it runs the controls itself, it cannot objectively evaluate them, which weakens the separation between management and oversight roles.

Question 41Risk Assessment⚑ Flag

A credit union's BIA sets a 4-hour RTO for its online payments process. The process depends on a fraud screening service from a third party whose contract guarantees restoration within 24 hours. What is the GREATEST concern?

AThe fraud screening service may produce false positive alerts BA critical dependency cannot meet the process recovery objective CThe third party may raise its fees at the next contract renewal DThe payments process RTO has not been approved by internal audit

Correct answer: B. A critical dependency cannot meet the process recovery objective
A process can only recover as fast as its slowest critical dependency, so a 24-hour vendor restoration makes the 4-hour RTO unachievable. Fee changes and false positives are separate issues that do not affect whether the process can be recovered in time.

Question 42Risk Response & Reporting⚑ Flag

A bank sends a security questionnaire to a new data analytics vendor. The vendor answers yes to every control question, including encryption and multifactor authentication. What should the risk practitioner do NEXT?

AAdd the vendor to the annual monitoring schedule BApprove the vendor because all controls are in place CRequest evidence to support the key answers given DAsk the vendor to complete a longer questionnaire

Correct answer: C. Request evidence to support the key answers given
Self-reported answers are not reliable on their own, so key responses should be validated with evidence such as audit reports, configurations or test results. A longer questionnaire would still rely only on the vendor's word.

Question 43Risk Response & Reporting⚑ Flag

A healthcare company must notify regulators within 72 hours of discovering a personal data breach. Its incident response plan covers technical containment but does not involve legal or privacy staff. What is the BEST recommendation?

AAdd legal and privacy roles and notification decision steps BWait until the forensic investigation is finished before deciding on notice CRely on the cyber insurer to handle regulator contact DHave IT notify regulators of every security alert

Correct answer: A. Add legal and privacy roles and notification decision steps
Including legal and privacy staff with clear decision steps lets the company judge quickly whether an incident requires notice and meet the 72-hour deadline. Waiting for forensic work to finish would often cause the deadline to be missed.

Question 44Risk Response & Reporting⚑ Flag

Which of the following sources would provide the MOST reliable data for a KRI on system access violations?

ASurvey responses from managers about access problems BHelp desk tickets that mention possible access issues CMonthly spreadsheets compiled by system administrators by hand DLogs extracted automatically from the access control system

Correct answer: D. Logs extracted automatically from the access control system
Data extracted directly from the system of record is complete, consistent and free from manual handling errors. Manually compiled spreadsheets depend on individual effort and judgment, which adds delays and the chance of mistakes or omissions.

Question 45Governance⚑ Flag

A risk culture survey at an online retailer shows that 92 percent of staff feel comfortable raising risks. However, incident reports have fallen sharply and many risk actions are overdue. What should the risk practitioner conclude?

ASurvey results may not reflect actual risk behavior BOverdue actions show only a resourcing issue, not a culture issue CThe survey proves that the company's risk culture is strong DIncident reporting data is no longer a useful culture measure

Correct answer: A. Survey results may not reflect actual risk behavior
Risk culture is best measured by combining what staff say with how they behave, and falling incident reports with overdue actions suggest the survey answers may be optimistic. Treating the survey as proof ignores behavioral evidence that points the other way.

Question 46Technology & Security⚑ Flag

Four months after a new customer relationship management system went live at a wholesale distributor, a post-implementation review is planned. Which should be the PRIMARY focus of the review?

AWhether the project team stayed within its approved budget BWhether users like the new screens better than the old ones CWhether expected benefits were achieved and controls work DWhether the vendor met every date in the project schedule

Correct answer: C. Whether expected benefits were achieved and controls work
A post-implementation review checks whether the system delivers the business benefits it was approved for and whether its controls operate as designed. Budget performance matters for project lessons, but it says little about whether the system now meets business needs.

Question 47Technology & Security⚑ Flag

A transportation authority has developed a NIST CSF Current Profile and a Target Profile. What should the risk practitioner do NEXT to get the most value from them?

ASet the highest Implementation Tier as the goal for every category BSubmit both profiles to NIST for formal validation and approval CImplement every outcome listed in the Target Profile within this year DAnalyze the gaps and prioritize actions by risk and business impact

Correct answer: D. Analyze the gaps and prioritize actions by risk and business impact
Comparing the two profiles reveals gaps, and prioritizing them by risk and business impact turns the profiles into a practical action plan. Aiming for the highest tier everywhere is tempting, but tiers should reflect the organization's risk appetite and resources, not a blanket goal.

Question 48Risk Assessment⚑ Flag

A pharmaceutical company's risk scenarios focus mainly on outside attackers. However, incident records show that most data exposures came from staff emailing files to the wrong people. What does this MOST likely indicate?

ASecurity training should be replaced with stricter penalties for staff. BThe email system has a technical defect that the IT team needs to investigate. COutside attackers are quietly using staff email accounts to send files out. DThreat identification has overlooked accidental actions by internal staff.

Correct answer: D. Threat identification has overlooked accidental actions by internal staff.
Threat sources include non-malicious insiders, and the incident data shows they are the main cause of exposures, so the scenarios are incomplete. Assuming a technical defect ignores the clear pattern of human error in the records.

Question 49Governance⚑ Flag

Which of the following BEST indicates that risk awareness is embedded in an organization's culture?

AEvery employee completed the mandatory risk training this year BManagers routinely weigh risk when making business decisions CThe risk team updates the full risk register every quarter DThe board receives a detailed risk dashboard at every meeting

Correct answer: B. Managers routinely weigh risk when making business decisions
A strong risk culture shows when people consider risk as part of everyday business decisions. Training completion shows activity, but it does not prove that staff actually apply risk thinking in their work.

Question 50Governance⚑ Flag

Business units at an insurance company have deployed about 30 AI models for pricing, claims triage and marketing. No central function knows which models exist or who is responsible for them. What should the risk practitioner recommend FIRST?

AAsk each unit to rate its own models as low or high risk BPause all AI models until a new policy is written CBuild an inventory of models with owners and risk tiers DHave IT rebuild every model on a single platform

Correct answer: C. Build an inventory of models with owners and risk tiers
An inventory with named owners and risk tiers is the foundation of AI governance, since the company cannot oversee or monitor models it does not know about. Pausing every model would disrupt operations before anyone knows which models carry significant risk.

Question 51Risk Assessment⚑ Flag

During a review of an energy company's risk register, the risk practitioner finds several high risks marked as accepted with no approver name or acceptance date recorded. What is the GREATEST concern?

AThe risks may have been rated too high when first entered BThe register has not been shared with external auditors yet CThe register layout does not match the latest industry template DThere is no evidence the accountable owner accepted the risks

Correct answer: D. There is no evidence the accountable owner accepted the risks
Risk acceptance is a decision for an accountable owner with the authority to accept that level of risk, and the register should record who accepted it and when it will be reviewed. Without that record, high risks may be tolerated with no one accountable. A rating error is possible, but the missing accountability is the larger gap.

Question 52Risk Response & Reporting⚑ Flag

A regional hospital licenses a custom scheduling application from a small software firm with only a few employees. The hospital is concerned that the firm could go out of business. Which contract provision BEST addresses this risk?

AA discount for paying the license fee in advance BA requirement for the firm to hold cyber insurance CA source code escrow agreement DA longer warranty period for software defects

Correct answer: C. A source code escrow agreement
Source code escrow lets the hospital obtain the code if the firm fails, so the application can still be maintained. A longer warranty is worthless if the firm no longer exists to honor it.

Question 53Risk Response & Reporting⚑ Flag

Which of the following BEST describes the benefit of layering preventive, detective and corrective controls over the same risk?

ATotal control operating costs go down because each layer is cheaper BOne control failing does not leave the risk unmanaged CFewer control owners are needed to manage each risk DEach control can be tested less often than if used alone

Correct answer: B. One control failing does not leave the risk unmanaged
Defense in depth means that if a preventive control fails, detective and corrective controls can still find the problem and limit its impact. Layering usually adds cost rather than reducing it. It also does not remove the need to test each control.

Question 54Risk Response & Reporting⚑ Flag

Which of the following BEST describes how a key performance indicator differs from a key risk indicator?

AA KPI is set by internal audit, while a KRI is set by risk managers. BA KPI is reported to the board, while a KRI goes only to operations. CA KPI measures goal achievement, while a KRI signals changing exposure. DA KPI is always qualitative, while a KRI always uses financial data.

Correct answer: C. A KPI measures goal achievement, while a KRI signals changing exposure.
KPIs show how well the business is performing against its goals, while KRIs give warning that the level of risk is changing. The audience for either metric depends on its relevance, not on whether it is a KPI or a KRI.

Question 55Technology & Security⚑ Flag

Developers at a pharmacy chain copy the full production customer database, including prescription details, into the test environment. Access controls in test are weaker than in production. Which is the BEST recommendation?

AUse masked or synthetic data for testing BDelete the test copy after each project is finished CApply production-level access controls to all test servers DHave developers sign a confidentiality agreement each year

Correct answer: A. Use masked or synthetic data for testing
Masked or synthetic data removes sensitive information from the test environment, so weaker controls there no longer expose real customers. Applying production controls to test reduces exposure but still keeps real prescription data in more places than needed.

Question 56Technology & Security⚑ Flag

At a media company, five network engineers share one administrator account to manage core routers. Changes are sometimes made without anyone knowing who made them. What is the BEST control to address this risk?

ARequire engineers to record changes in a shared spreadsheet BAssign individual privileged accounts with session logging CChange the shared administrator password every week DRestrict the shared account to use from one jump server

Correct answer: B. Assign individual privileged accounts with session logging
Individual privileged accounts with logged sessions create accountability by tying each change to a specific person. A change log spreadsheet is tempting, but it depends on voluntary entries and cannot prove who actually used the shared account.

Question 57Governance⚑ Flag

At a manufacturing firm, the CEO often tells IT to skip change management to speed up requests from the executive office. Other managers have started doing the same. What is the risk practitioner's BEST course of action?

AReport the behavior's effect on control culture to the board BAdd technical controls that block any change without approval CRetrain IT staff on the change management procedure DRecord the CEO's changes as approved policy exceptions

Correct answer: A. Report the behavior's effect on control culture to the board
The CEO's behavior sets the tone for the organization, and the board is the body with authority to address it. Technical controls or retraining treat the symptoms, while the root cause is a weak tone at the top that others are copying.

Question 58Risk Assessment⚑ Flag

A city government identifies vulnerabilities for its risk assessment using only automated network scans. What is the GREATEST limitation of this approach?

AAutomated scans do not produce any evidence that auditors can review. BMissing patches on internet-facing servers will not be detected by scans. CProcess and people weaknesses, like poor segregation of duties, are missed. DScan results contain too much technical detail for the risk register.

Correct answer: C. Process and people weaknesses, like poor segregation of duties, are missed.
Vulnerabilities exist in processes, people and physical settings as well as in technology, and network scans see only technical flaws. The concern about technical detail can be solved by summarizing results, while the blind spot for non-technical weaknesses cannot.

Question 59Governance⚑ Flag

A new chief risk officer at a hospital network wants a risk communication plan. Today the board, clinical leaders and IT staff all receive the same monthly risk report. What should the plan define FIRST?

AThe color scheme, logo and layout used in each monthly report BThe software tool used to distribute risk reports CA single combined report format that all three groups can share DEach audience and the risk information it needs to act

Correct answer: D. Each audience and the risk information it needs to act
Effective risk communication starts by identifying each audience and what it must decide or do, so content and detail can match that need. A single shared format is what the hospital already has, and it fails because the groups need different information.

Question 60Risk Assessment⚑ Flag

A media company plans to retire a legacy data loss prevention tool to cut costs. Management asks which risks would increase if the tool is removed. Which of the following would BEST support this analysis?

AThe IT asset inventory showing every server where the tool runs BThe vendor's documentation describing the tool's features CA list of incidents the tool blocked in the past month DA risk register that maps each risk to its related controls

Correct answer: D. A risk register that maps each risk to its related controls
When the register links risks to the controls that mitigate them, the practitioner can quickly see which residual risks rise if a control is removed. Recent blocked incidents show activity but not which business risks depend on the control.

Question 61Risk Response & Reporting⚑ Flag

A university is renewing a contract with a vendor that processes student financial aid data. The current contract has no security incident terms. Which provision is MOST important to add?

APrompt notice of security incidents within a defined timeframe BA requirement to use the university's preferred antivirus product CAnnual meetings between the vendor and university leadership DA discount on fees if the vendor misses response time targets

Correct answer: A. Prompt notice of security incidents within a defined timeframe
Timely incident notification lets the university contain damage, meet its own legal reporting duties and inform affected students. Mandating a specific antivirus product is too technical and does not ensure the university learns about incidents.

Question 62Risk Response & Reporting⚑ Flag

The marketing department of a cosmetics company asks for help after customer lists were emailed to the wrong recipients twice. The IT team immediately proposes an advanced AI-based monitoring platform. What should the risk practitioner do FIRST?

ARequest pricing quotes from vendors of the AI platform BAgree on the control objective with the risk owner CRun a proof of concept of the monitoring platform DBlock all outbound email messages with attachments

Correct answer: B. Agree on the control objective with the risk owner
Control selection should start with a clear objective tied to the risk and business need, agreed with the risk owner, so that the chosen control fits the problem. Jumping to a specific technology may produce an expensive control that does not address the real cause. Blocking all attachments would disrupt the business without analysis.

Question 63Risk Response & Reporting⚑ Flag

A risk dashboard at an energy company tracks 120 KRIs. Executives say they no longer read it because nothing stands out. What is the BEST action for the risk practitioner?

AAdd more detail so executives can see each KRI's history. BSend the dashboard weekly instead of monthly for attention. CColor code all 120 KRIs so the dashboard is easier to read. DFocus the dashboard on fewer KRIs tied to the key risks.

Correct answer: D. Focus the dashboard on fewer KRIs tied to the key risks.
A small set of KRIs linked to the most significant risks and objectives keeps attention on what matters most. Color coding all 120 indicators makes the page brighter but does not solve the volume problem.

Question 64Governance⚑ Flag

A risk practitioner at an engineering firm is assessing vendors for a major contract. The practitioner learns that one of the vendors is owned by a close relative. What should the risk practitioner do FIRST?

ARate the vendor more harshly to avoid any sign of favoritism BWithdraw from all vendor risk work at the company CDisclose the conflict of interest to management DContinue the evaluation but take extra care to stay objective

Correct answer: C. Disclose the conflict of interest to management
Codes of ethics require prompt disclosure of conflicts of interest so management can decide how to protect the integrity of the process. Continuing while trying to stay objective still leaves a conflict that others cannot see or manage.

Question 65Technology & Security⚑ Flag

A pension fund must keep member records for 25 years. Older records are archived in a proprietary format that only one application can read, and that application will be retired next year. Which is the GREATEST concern?

AStaff may need training on the replacement application BArchived records may not be retrievable when they are needed CThe archive may contain records that should have been deleted DArchive storage costs may rise after the application is retired

Correct answer: B. Archived records may not be retrievable when they are needed
If no system can read the archive, the fund cannot produce records for members, auditors or regulators, which defeats the purpose of archiving. Storage cost is a minor issue compared with failing a legal retention requirement.

Question 66Technology & Security⚑ Flag

A security review at an engineering firm finds that accounts belonging to departed contractors often remain active for weeks. HR records show accurate end dates for every contractor. What is the BEST way to address the root cause?

ARequire contractors to return badges and laptops on their last day BShorten the password expiration period for all contractor accounts CConnect HR end dates to an automated deprovisioning process DRun a monthly report of inactive accounts and disable them manually

Correct answer: C. Connect HR end dates to an automated deprovisioning process
The end dates are already accurate, so linking them to automatic deprovisioning fixes the broken handoff in the leaver process. A monthly inactive account report is tempting, but it is a detective control that still leaves accounts open for up to a month.

Question 67Risk Assessment⚑ Flag

A shipping company's security team plans to fix vulnerabilities strictly in order of their technical severity scores. From a risk perspective, what is the BEST recommendation?

APrioritize fixes by the business importance and exposure of affected assets. BFix every vulnerability within the same time frame, whatever its score. CLet each system administrator decide which fixes to apply first on their systems. DFix the vulnerabilities that are the cheapest and fastest to repair first.

Correct answer: A. Prioritize fixes by the business importance and exposure of affected assets.
The same technical flaw can create very different risk depending on the value of the asset and how exposed it is, so business context should drive priority. Fixing the cheapest items first may show quick progress but can leave the most damaging exposures open.

Question 68Governance⚑ Flag

A board member at an airline proposes a cyber risk appetite that would allow losses larger than the company could absorb. What is the GREATEST concern with this proposal?

ABusiness units may set inconsistent tolerances for cyber risk BAppetite should not exceed the organization's risk capacity CThe appetite would be harder to express in measurable terms DInsurers may raise premiums for the company's cyber policy

Correct answer: B. Appetite should not exceed the organization's risk capacity
Risk capacity is the most risk the enterprise can bear, so an appetite above it could expose the organization to losses it cannot survive. Higher insurance premiums are a cost issue, but they are minor compared to an appetite that threatens solvency.

Question 69Risk Assessment⚑ Flag

An airline wants likelihood estimates for a new type of cyber threat that has no historical data. In past workshops, a few senior executives dominated the discussion and others deferred to them. Which technique is BEST?

AThe Delphi technique with anonymous expert rounds BMonte Carlo simulation using historical loss data CAn open brainstorming workshop led by the CIO DA bow-tie analysis of the main threat scenarios

Correct answer: A. The Delphi technique with anonymous expert rounds
The Delphi technique gathers expert judgment through anonymous, repeated rounds, which reduces the influence of dominant personalities and moves the group toward consensus. Monte Carlo simulation needs input data or estimates and does not solve the problem of biased group discussion.

Question 70Risk Response & Reporting⚑ Flag

A software company's product team works in two-week sprints. Its project risk log was created at kickoff and has not been updated in 12 sprints, even though scope and vendors have changed. What is the BEST recommendation?

AMove risk tracking to the annual enterprise assessment BFreeze the project scope so that the original risk log stays valid CReview and update project risks as part of sprint planning DRebuild the risk log only at the end of the project

Correct answer: C. Review and update project risks as part of sprint planning
In agile work, scope and dependencies change every sprint, so project risks should be reviewed at the same pace to stay current. Freezing scope defeats the purpose of agile delivery and would still not capture the vendor changes.

Question 71Risk Response & Reporting⚑ Flag

A quarterly access report at a retail pharmacy chain lists 35 users who can both receive controlled drug shipments and adjust inventory counts. What should the risk practitioner do FIRST?

ARemove the inventory rights from all 35 users immediately BValidate the conflicts with the business owners of the roles CEscalate the report to the audit committee as a major finding DAsk IT to redesign all system roles from the beginning

Correct answer: B. Validate the conflicts with the business owners of the roles
The practitioner should first confirm whether the conflicts are real, whether there is a business reason, and whether mitigating controls exist, working with the owners who understand the roles. Removing access immediately could halt store operations for legitimate users. Escalating to the audit committee before validation may overstate the issue.

Question 72Risk Response & Reporting⚑ Flag

A bank's security team proposes a KRI called 'level of security culture among staff.' No data source or calculation method has been defined. What is the GREATEST weakness of this KRI?

AIt would be of little interest to senior management. BIt focuses on people rather than on technical controls. CIt does not relate to a recognized security standard. DIt cannot be measured consistently over time.

Correct answer: D. It cannot be measured consistently over time.
A useful KRI must be measurable, with a clear data source and method so results can be compared over time. Linking it to a standard could help, but no standard makes an indicator useful if it cannot be measured.

Question 73Governance⚑ Flag

A global retailer has acquired a startup whose staff see formal risk processes as needless bureaucracy. The retailer's risk team must bring the startup into the enterprise risk program. What should the risk practitioner do FIRST?

AAssess the startup's current risk culture and practices BReplace the startup's managers with experienced parent company staff CRequire startup staff to earn a risk management certification DApply the parent company's full policy set to the startup at once

Correct answer: A. Assess the startup's current risk culture and practices
Understanding the acquired company's existing culture and practices helps the practitioner plan an integration approach that will be accepted and effective. Imposing the full policy set immediately may meet strong resistance and ignore useful practices already in place.

Question 74Technology & Security⚑ Flag

Which of the following is MOST important at the creation stage of the data life cycle?

AEncrypting the data with the strongest available algorithm BAssigning an owner and classifying the data CChoosing the storage medium with the lowest cost DSetting up backup jobs for the new data

Correct answer: B. Assigning an owner and classifying the data
Ownership and classification set at creation drive every later decision, including how the data is protected, retained and disposed of. Strong encryption may not be needed for all data, and the right level depends on the classification.

Question 75Governance⚑ Flag

A manufacturing company's email system automatically deletes messages after three years under its retention schedule. Legal counsel has just told IT about a lawsuit involving a former supplier. What should the risk practitioner recommend FIRST?

AMove every mailbox to a lower-cost cloud archive service BContinue the deletion schedule exactly as it is documented CDelete supplier emails to reduce legal exposure DSuspend deletion for records covered by the legal hold

Correct answer: D. Suspend deletion for records covered by the legal hold
A legal hold overrides normal retention rules, and destroying relevant records once litigation is expected can lead to court sanctions. Continuing the schedule as documented follows policy but ignores the higher legal duty to preserve evidence.

Question 76Risk Assessment⚑ Flag

A software vendor announces a critical flaw in a file transfer product, and no patch is available yet. The risk practitioner confirms the company uses the product to exchange data with partners. What is the BEST next step?

AShut down the file transfer service until the vendor releases a patch. BWait for the vendor's patch before changing the risk register entry. CAsk the security team to write a custom fix for the vendor's product. DInform the risk owner of the exposure so interim actions can be decided.

Correct answer: D. Inform the risk owner of the exposure so interim actions can be decided.
The risk owner is accountable for deciding how to respond, such as limiting access or adding monitoring until a patch arrives. Shutting down the service is a response decision with business impact that the practitioner should not make alone.

Question 77Technology & Security⚑ Flag

An online travel agency runs monthly phishing simulations. The click rate has dropped from 18 percent to 6 percent, but very few employees report the simulated emails to the security team. What should the risk practitioner conclude?

AClicking has improved, but reporting behavior still needs work BEmployees who fail to report the emails should be disciplined CThe program has met its goals and simulations can now be stopped DSimulations are too easy and should be made harder right away

Correct answer: A. Clicking has improved, but reporting behavior still needs work
A lower click rate shows progress, but reporting is what lets the security team respond quickly to real attacks, so the low reporting rate is still a gap. Concluding that the program is finished is tempting, but it ignores a key behavior the simulations are meant to build.

Question 78Governance⚑ Flag

A risk practitioner at a logistics firm finds that a regional office wrote its own backup procedure. The procedure conflicts with the corporate backup standard. Which of the following is the BEST action?

AKeep both documents, since each serves a different audience BAsk the regional office to pause backups until the conflict is fixed CAlign the procedure with the corporate standard it must support DUpdate the corporate standard so it matches the regional procedure

Correct answer: C. Align the procedure with the corporate standard it must support
Procedures exist to carry out standards, so a local procedure must comply with the corporate standard above it. If the region has a valid business need to differ, it should request a formal exception rather than change the standard from below.

Question 79Risk Assessment⚑ Flag

Which of the following BEST describes how the FAIR model analyzes risk?

AIt breaks risk into loss event frequency and probable loss magnitude BIt rates risk by placing likelihood and impact on a five-point scale CIt maps the causes, event and consequences around a central hazard DIt ranks control gaps against a maturity model for each process

Correct answer: A. It breaks risk into loss event frequency and probable loss magnitude
FAIR (Factor Analysis of Information Risk) decomposes risk into loss event frequency and loss magnitude, each broken into further factors that can be estimated quantitatively. Five-point likelihood and impact scales describe a qualitative approach, not FAIR's structured quantitative model.

Question 80Risk Response & Reporting⚑ Flag

A risk practitioner at a construction firm finds that 40 percent of business units hold exceptions to the same mobile device policy. Most of the exceptions cite the same operational need. What should the risk practitioner recommend?

ARevoke every exception and enforce the policy as written BReview whether the policy still fits business needs CRequire each unit to renew its exception monthly DAdd more staff to process exception requests

Correct answer: B. Review whether the policy still fits business needs
A high volume of exceptions citing the same need suggests the policy may be outdated or unrealistic, so its relevance should be reviewed with stakeholders. Revoking every exception ignores a legitimate business need and may disrupt operations.

Question 81Risk Response & Reporting⚑ Flag

A food processing company's manual review of production system audit logs is effective at catching unauthorized changes, but it takes three full-time staff. Risk remains within appetite. What should the risk practitioner recommend?

AStop the review because the risk is already within appetite BExplore automation that keeps the review effective CAdd a fourth reviewer to further improve detection accuracy DCut the review back to a quarterly sample to save staff time

Correct answer: B. Explore automation that keeps the review effective
The control is effective but inefficient, so the goal is to meet the same objective with fewer resources, often through automation. Stopping or scaling back the review could push risk outside appetite, since the review is part of why risk is acceptable today. Adding a reviewer makes the efficiency problem worse.

Question 82Risk Response & Reporting⚑ Flag

A pharmacy chain's prescription system has had two outages this year. During each outage, store staff did not know how to keep filling urgent prescriptions until the system returned. What is the BEST risk response?

AClose stores whenever the prescription system is down BTell customers to use other pharmacies during outages CDocument and test manual workaround procedures with staff DBuy and run a second prescription system from a different vendor

Correct answer: C. Document and test manual workaround procedures with staff
Tested manual procedures let stores continue critical service during an outage at low cost, which closes the gap shown by both incidents. A second system is expensive, may also fail and still leaves staff without a plan for working without it.

Question 83Governance⚑ Flag

The board of a consumer goods company wants its ERM program to consider risk when setting strategy and measuring performance, not only when reviewing controls. Which framework would BEST support this goal?

ANIST SP 800-30 guide BCOSO ERM framework CISO/IEC 27002 controls DPCI DSS requirements

Correct answer: B. COSO ERM framework
The COSO ERM framework, titled Integrating with Strategy and Performance in its current version, is designed to link risk management with strategy setting and performance. NIST SP 800-30 guides how to conduct risk assessments, which is too narrow for enterprise strategy.

Question 84Risk Assessment⚑ Flag

A hospital learns that its imaging system runs on an operating system the vendor no longer supports. The system works well and has had no incidents. How should the risk practitioner view this?

AAs an IT operations matter that is outside risk management's scope BAs a reason to replace the imaging system as soon as possible CAs acceptable, since the system has had no recent security incidents DAs a vulnerability to record and assess for the risk it creates

Correct answer: D. As a vulnerability to record and assess for the risk it creates
Unsupported software no longer receives security fixes, so it is a growing vulnerability even if nothing has gone wrong yet. A clean incident history is tempting reassurance, but it does not mean the weakness cannot be exploited in the future.

Question 85Technology & Security⚑ Flag

A city government runs a program of five related projects to replace its permit, payment and records systems. Each project keeps its own risk log, and delays in one project have surprised the others. Which is the BEST recommendation?

AKeep a program-level risk register that tracks dependencies BMerge the five projects into one large project with one manager CAsk each project manager to report risk to the city council DAdd extra time to every project schedule to absorb delays

Correct answer: A. Keep a program-level risk register that tracks dependencies
A program-level view captures risks that cross project boundaries, such as one project's delay affecting another. Adding buffer time to every schedule hides the issue without managing the dependencies that cause it.

Question 86Technology & Security⚑ Flag

A company's risk awareness program targets only IT staff. Business unit managers often launch new projects without consulting the risk function. What is the BEST recommendation?

AAdopt a policy that penalizes managers who bypass the risk function BExpand the technical depth of the training already given to IT staff CExtend the program to business managers and their risk owner role DRequire IT staff to review every new business project for security risk

Correct answer: C. Extend the program to business managers and their risk owner role
Business managers own the risks of their projects, so they need awareness of that role and of when to involve the risk function. Having IT review every project is tempting, but it shifts ownership away from the business and does not build risk culture where decisions are made.

Question 87Governance⚑ Flag

During a review at a retail company, a risk practitioner finds dozens of policy exceptions approved years ago with no expiry or review dates. Which of the following is the GREATEST concern?

AThe risks of these exceptions may no longer be known or accepted BStaff may request more exceptions because approval seems easy CSome exception forms may be missing required approval signatures DThe exceptions may make the policy document harder to follow

Correct answer: A. The risks of these exceptions may no longer be known or accepted
Exceptions should have expiry dates and periodic reviews so the accepted risk is reassessed as conditions change. Without reviews, old exceptions may now carry risk that no owner has knowingly accepted.

Question 88Risk Assessment⚑ Flag

A ticketing platform faces a data breach risk with a single loss expectancy of $400,000 and an ARO of 0.3. A proposed control would reduce the ARO to 0.05 and cost $60,000 per year. What is the annual net benefit of the control?

A$60,000 B$20,000 C$100,000 D$40,000

Correct answer: D. $40,000
ALE before the control is $400,000 x 0.3 = $120,000, and after it is $400,000 x 0.05 = $20,000, a reduction of $100,000. Subtracting the $60,000 annual cost gives a net benefit of $40,000. The $100,000 figure ignores the cost of the control.

Question 89Risk Response & Reporting⚑ Flag

At a food distribution company, policy exceptions are approved by email within each department, and no one has a complete list. Some of the exceptions are several years old. What is the BEST way to address this situation?

ATrack every exception in a single central register BHave internal audit search old emails for exceptions CStop granting exceptions until a new policy is written DAsk each department to send its exceptions once a year

Correct answer: A. Track every exception in a single central register
A central register gives visibility of all exceptions and supports tracking of owners, compensating controls and expiry dates. Collecting lists once a year would still leave gaps and allow stale exceptions to persist between cycles.

Question 90Risk Response & Reporting⚑ Flag

An airline is about to put a new automated fare validation control into production. Which of the following is MOST important to confirm before go-live?

AThe control generates detailed reports for executives BA user manual has been written for the fare analysts CA control owner is accountable for its operation DThe vendor offers a support contract for three years

Correct answer: C. A control owner is accountable for its operation
Every control needs an owner who is accountable for making sure it operates and for acting when it fails. Without an owner, the control can degrade unnoticed after go-live. Manuals, vendor support and reports are helpful, but they do not establish accountability.

Question 91Risk Response & Reporting⚑ Flag

A pharmaceutical company monitors all its key controls on the same annual schedule. Which of the following should MOST influence how often each control is monitored?

AThe schedule used by the external auditors for their testing BThe date the control was first designed and put in place CThe number of staff available in the risk management function DThe criticality and volatility of the related risk

Correct answer: D. The criticality and volatility of the related risk
Controls over critical or fast-changing risks need more frequent monitoring, while stable, lower risks can be checked less often. Staff availability is a practical limit, but it should not drive monitoring frequency ahead of the risk itself.

Question 92Governance⚑ Flag

A cloud services company finds that a customer contract requires it to keep logs for seven years, while a privacy law in one country requires deleting personal data after two years. What should the risk practitioner do FIRST?

ADelete the logs after two years to comply with the law BKeep the logs for seven years to satisfy the contract CEncrypt all logs so retention limits no longer apply DRefer the conflict to legal counsel and the risk owner

Correct answer: D. Refer the conflict to legal counsel and the risk owner
Conflicting legal and contractual obligations need a legal interpretation and a decision by the accountable business owner. Deleting the logs to follow the law may seem safe, but it could breach the contract without the business understanding the consequences.

Question 93Risk Assessment⚑ Flag

A risk practitioner at an energy company has produced 300 detailed risk scenarios. Senior management says the list is too long to be useful. What is the BEST way to address this?

AKeep all 300 scenarios but shorten each description to a single line. BCombine similar scenarios into a smaller set focused on key business risks. CDelete all scenarios that the IT team believes are rated below appetite. DPresent only the ten scenarios that the IT department considers most likely.

Correct answer: B. Combine similar scenarios into a smaller set focused on key business risks.
A manageable set of well-chosen scenarios is easier for management to understand and act on, and grouping keeps the coverage of the full list. Presenting only the IT department's top ten would narrow the view to one group's opinion and could drop important business risks.

Question 94Governance⚑ Flag

Directors at a regional bank admit they cannot judge whether management's cybersecurity reports are complete or accurate, and they rarely ask questions. What is the BEST way to strengthen board oversight of cyber risk?

AShorten cyber reports to a single overall score BAsk the external auditor to approve the cyber strategy CProvide board education and access to independent expertise DDelegate all oversight of cyber risk to the CIO and security team

Correct answer: C. Provide board education and access to independent expertise
Directors need enough understanding, and access to independent advice, to challenge management and hold it accountable for cyber risk. Delegating oversight to the CIO removes the board's independent check on the people who manage the risk.

Question 95Technology & Security⚑ Flag

A streaming media company now builds all of its cloud environments from shared infrastructure as code templates. Which is the GREATEST risk of this approach?

AEngineers may forget how to configure servers by hand BOne flawed template can repeat a weakness everywhere CCloud costs may become harder to forecast each month DTemplates may make environments look too similar for testing

Correct answer: B. One flawed template can repeat a weakness everywhere
Automation repeats whatever is in the template, so a single misconfiguration can be copied into every environment at once. That is why templates need review, testing and version control like application code, while cost forecasting is a minor concern by comparison.

Question 96Technology & Security⚑ Flag

A telecom provider's marketing team wants to analyze customer support call recordings to design targeted advertising. Customers were told the recordings were for quality and training purposes. What is the GREATEST concern?

ABackground noise in the recordings may distort the analysis results BStorage costs will rise as more call recordings are kept longer CThe new use goes beyond the purpose stated when data was collected DMarketing analysts may not have the skills to analyze audio data

Correct answer: C. The new use goes beyond the purpose stated when data was collected
Purpose limitation means personal data should not be reused for purposes incompatible with what people were told at collection. Storage cost is a real issue, but it is minor compared with the legal and reputational risk of misusing customer data.

Question 97Risk Assessment⚑ Flag

A coastal food processor has suffered 3 flood events in the past 15 years. Each event caused about $250,000 in damage and lost production. Assuming the pattern continues, what is the annualized loss expectancy for flooding?

A$750,000 B$50,000 C$16,667 D$250,000

Correct answer: B. $50,000
Three events in 15 years gives an ARO of 3 / 15 = 0.2. ALE = SLE x ARO = $250,000 x 0.2 = $50,000. The $750,000 figure is the total loss over 15 years, not the expected loss per year.

Question 98Risk Response & Reporting⚑ Flag

An energy company has identified eight risks above appetite but has budget to address only three of them this year. Which is the BEST way to decide which risk responses to fund first?

ASplit the budget evenly across all eight risks BFund the responses that can be implemented most quickly CRank by exposure and the benefit of each response DFund the responses requested by the largest business units

Correct answer: C. Rank by exposure and the benefit of each response
Limited funds should go to the responses that reduce the greatest exposure relative to appetite at a reasonable cost. Funding the quickest responses first may leave the most serious risks untreated.

Question 99Risk Response & Reporting⚑ Flag

Three months after a hotel chain required a hardware token for its reservation system, the risk practitioner learns that front desk staff share one token per shift to avoid check-in delays. What should the risk practitioner do FIRST?

ADetermine why staff find the control hard to use BReplace the tokens with a stronger biometric control CReport the control as effective since it is deployed DDiscipline the staff who shared the hardware tokens

Correct answer: A. Determine why staff find the control hard to use
Users bypassing a control is a sign of a usability or process problem, and understanding the cause lets the business fix it in a way staff will accept. Discipline alone may not stop the workaround if the delays remain. A stronger control could create the same resistance without solving the root cause.

Question 100Governance⚑ Flag

A product manager at an online gaming company wants to accept the risk of not complying with a new consumer protection rule. The manager argues that the expected fines are lower than the cost of compliance. What should the risk practitioner do FIRST?

ABegin implementing controls to achieve compliance BReport the product manager's decision to the regulator CRecord the risk as accepted in the enterprise risk register DConfirm the manager has authority to accept this risk

Correct answer: D. Confirm the manager has authority to accept this risk
Noncompliance with a law carries legal, reputational and licensing impacts beyond fines, so accepting it usually requires senior management authority and review against appetite. Recording the risk as accepted would formalize a decision the product manager may not be allowed to make.

Question 101Risk Response & Reporting⚑ Flag

A business unit manager at a shipping company asks the risk practitioner to show a red risk as amber in the board report because remediation has started. The remediation will not be complete for six months. What is the BEST response?

AReport the current red rating and note the remediation status. BLeave the risk out of the report until remediation is finished. CAsk the board to decide which rating should appear in the report. DShow the risk as amber since remediation is now in progress.

Correct answer: A. Report the current red rating and note the remediation status.
Reports must reflect the actual current level of risk, and noting the remediation progress gives the board the full picture. Showing amber before the controls are in place would understate exposure and could lead to poor decisions.

Question 102Governance⚑ Flag

Which of the following is MOST important to the long-term success of a business continuity program?

AAn automated tool to maintain continuity plan documents BAn alternate recovery site in a different geographic region CSenior management support and business ownership DDetailed technical recovery runbooks for every server

Correct answer: C. Senior management support and business ownership
Continuity programs need senior management support for funding and priority, and business ownership so plans reflect real operational needs. A remote recovery site is useful, but without leadership support the program will not be kept current or tested.

Question 103Risk Assessment⚑ Flag

A scenario workshop at an airline produces only catastrophic, worst-case scenarios, such as a total loss of all flight systems. What should the risk practitioner do?

AReplace the scenarios with a ranked list of the airline's vulnerabilities. BAsk the board to choose which catastrophic scenarios the airline keeps. CKeep only the extreme scenarios because they show the greatest impact. DAdd plausible, more frequent events alongside the extreme scenarios.

Correct answer: D. Add plausible, more frequent events alongside the extreme scenarios.
A useful scenario set covers a realistic range of events, including those that happen more often with moderate impact. Keeping only extreme cases can distort priorities and lead management to overlook the risks most likely to occur.

Question 104Technology & Security⚑ Flag

A food processing company's primary and backup data centers are 5 miles apart, and both sit in the same river flood plain. Which is the GREATEST concern?

AInsurance costs for the sites may be higher than average BNetwork latency between the sites may slow replication CStaff may need longer to travel between the two sites DA single regional event could disable both sites

Correct answer: D. A single regional event could disable both sites
An alternate site must not share the same major hazards as the primary site, or one flood could take out both and leave no recovery option. Latency over such a short distance is minimal and is not the main issue.

Question 105Technology & Security⚑ Flag

An online learning platform relies on user consent to send personalized course recommendations by email. Giving consent takes one click, but withdrawing it requires calling customer support. What should the risk practitioner recommend?

ARecord all support calls to prove withdrawals were honored BMake withdrawing consent as easy as giving it CStop all recommendations until a full legal review is completed DAdd the support phone number to each marketing email

Correct answer: B. Make withdrawing consent as easy as giving it
Valid consent requires that people can withdraw it as easily as they gave it, so the withdrawal process should be simple, such as an unsubscribe link. Stopping all recommendations is tempting, but it is an overreaction when the process gap can be fixed directly.

Question 106Governance⚑ Flag

The IT department of a software company is drafting an IT risk management policy. Which of the following is MOST important for the policy to be consistent with?

AThe IT department's annual budget BThe enterprise risk management policy CCurrent practices in the IT department DPolicies published by industry peers

Correct answer: B. The enterprise risk management policy
An IT risk policy should support the enterprise risk policy so IT risk is managed with the same appetite, terms and accountability as other risk. Peer policies may offer useful ideas, but they do not reflect this organization's objectives or appetite.

Question 107Risk Assessment⚑ Flag

A property management firm's register shows a low residual rating for a supplier fraud risk. The rating assumes two new approval controls that are scheduled for next year but are not yet in place. What is the GREATEST concern?

AThe approval controls may cost more than the original budget BThe supplier fraud risk lacks a key risk indicator CThe register does not record the inherent risk rating DReported exposure understates the risk that exists today

Correct answer: D. Reported exposure understates the risk that exists today
Current risk should reflect the controls actually operating, so counting planned controls gives management a false sense that the risk is within appetite today. A possible budget overrun matters to the project, but the immediate issue is that decisions are being made on understated exposure.

Question 108Risk Response & Reporting⚑ Flag

A health insurer discovers that its claims system, member portal and email all run on the same cloud provider in a single region. What should the risk practitioner do FIRST?

AReview the uptime history of the provider's region BMove the member portal to a second cloud provider right away CAssess the combined impact of a provider outage DAsk the provider to increase service credits for outages

Correct answer: C. Assess the combined impact of a provider outage
Concentration risk must first be understood by assessing the combined effect on business processes if the provider fails. Moving services immediately is a response chosen before the exposure is known, and past uptime alone does not show the business impact.

Question 109Risk Response & Reporting⚑ Flag

A security operations team at an e-commerce firm reports the number of alerts it closes each month. Management wants a metric that shows whether its ability to find real attacks is improving. Which metric is BEST?

ATotal number of alerts generated by monitoring tools BAverage time from a compromise to its detection CNumber of analysts working in the security center DPercentage of alerts closed within one business day

Correct answer: B. Average time from a compromise to its detection
Mean time to detect directly measures how quickly real attacks are found, and a falling value shows that detection is improving. The share of alerts closed quickly measures workload speed, which can improve even while real attacks are missed.

Question 110Risk Response & Reporting⚑ Flag

Senior management at a university asks the risk practitioner which risks in the register need their attention most. What is the BEST basis for prioritizing risks in the report?

AThe length of time each risk has been listed in the register BThe total cost of the controls already in place for each risk CHow far each residual risk exceeds the risk appetite DThe number of business units that have reported each risk

Correct answer: C. How far each residual risk exceeds the risk appetite
Risks whose residual level is furthest outside the appetite are the ones that most need management decisions. Control cost or how long a risk has been listed may be interesting, but neither shows whether exposure is acceptable.

Question 111Governance⚑ Flag

The board of a logistics company asks how its risk management program compares with good practice and wants a roadmap for improvement. What should the risk practitioner do FIRST?

AAssess current capabilities against a maturity model BBuy and deploy a new enterprise risk management software platform CDouble the number of KRIs reported to the board DHire an external firm to certify the program against a standard

Correct answer: A. Assess current capabilities against a maturity model
A maturity assessment shows where the program stands today and what a realistic target looks like, which gives a basis for a prioritized roadmap. Buying new software before knowing the gaps may only automate weak processes.

Question 112Risk Assessment⚑ Flag

Which of the following is the PRIMARY benefit of using risk scenarios to identify risk?

AThey allow the risk practitioner to accept risk on behalf of the business. BThey turn abstract risk into concrete events that managers can relate to. CThey remove the need for judgment when estimating likelihood and impact. DThey provide an exact prediction of losses the organization will suffer.

Correct answer: B. They turn abstract risk into concrete events that managers can relate to.
Scenarios describe specific, believable events, which helps business leaders understand risk and take part in assessing it. They still rely on expert judgment, so the idea that they remove judgment is a common misunderstanding.

Question 113Governance⚑ Flag

A newly formed risk function at a media company struggles to get information from business units, which say the function has no authority to request it. Which of the following would BEST resolve this issue?

AA charter that defines the function's authority BA service level agreement with each business unit CA risk awareness campaign for business staff DA memo from the CRO to all department heads

Correct answer: A. A charter that defines the function's authority
An approved charter formally sets the risk function's mandate, scope, authority and access to information, which gives it standing across the organization. A memo from the CRO carries no more authority than the CRO already has, so units may still refuse.

Question 114Technology & Security⚑ Flag

A school district backs up its student information system every night, and all jobs report success. The backups have never been restored. Which is the BEST way to confirm the backups will support recovery?

AReview the backup job logs for errors each week BStore a second copy of each backup at another location CPerform periodic test restores of the backup data DSwitch to a backup product with stronger reporting

Correct answer: C. Perform periodic test restores of the backup data
Only an actual restore proves that backups are complete, readable and usable within the required time. Job logs show that the backup ran, but they cannot show that the data can be recovered.

Question 115Technology & Security⚑ Flag

A new social media app sets every user profile to public by default, and users must change several settings to make their profiles private. Which privacy principle is MOST clearly not being followed?

AData accuracy BData portability CStorage limitation DPrivacy by default

Correct answer: D. Privacy by default
Privacy by default requires the most protective settings to apply automatically, without users having to take action. Storage limitation is tempting because it also restricts personal data, but it concerns how long data is kept, not how widely it is exposed.

Question 116Governance⚑ Flag

A regional insurer moved its claims system to a cloud provider. The insurer's business continuity plan assumes the provider will restore service within the required time, but no one has confirmed this. Which of the following is the GREATEST concern?

AIT staff may lose skills in managing on-premises systems BThe cloud contract may not include the preferred billing terms CThe provider may charge additional fees for disaster recovery tests DThe provider may not recover within the insurer's required time

Correct answer: D. The provider may not recover within the insurer's required time
Outsourcing a system does not outsource accountability, so the insurer must confirm that the provider's recovery capability meets its business requirements. Extra testing fees are a cost issue, while an unverified recovery assumption could leave claims processing down far longer than the business can tolerate.

Question 117Risk Assessment⚑ Flag

A logistics firm's customer portal is built with dozens of open-source libraries, and the development team cannot say which versions are in use. A critical flaw is announced in a widely used library. What information would MOST help the risk practitioner assess exposure?

AA software bill of materials listing components and versions BThe total number of developers who have contributed to the portal CA list of commercial tools the development team prefers DThe portal's average page load time over the past quarter

Correct answer: A. A software bill of materials listing components and versions
A software bill of materials shows exactly which components and versions each application uses, so the firm can quickly confirm whether the flawed library is present. The number of contributors says nothing about which vulnerable code is actually deployed.

Question 118Risk Response & Reporting⚑ Flag

Which of the following BEST describes the difference between a risk and an issue?

AA risk is reported to the board, while an issue is not reported BA risk may occur in the future, while an issue has already occurred CA risk affects technology, while an issue affects business processes DA risk is owned by the business, while an issue is owned by IT

Correct answer: B. A risk may occur in the future, while an issue has already occurred
A risk is an uncertain event that may happen, while an issue is a current condition that needs action now. Both can involve technology or business processes, so the distinction is about certainty, not subject area.

Question 119Risk Response & Reporting⚑ Flag

Which of the following is the PRIMARY benefit of continuous control monitoring?

AControl owners no longer need to follow up on exceptions BThe cost of designing new controls is greatly reduced CIndependent periodic testing is no longer ever required DControl failures are found soon after they occur

Correct answer: D. Control failures are found soon after they occur
Continuous control monitoring tests controls automatically and frequently, so failures surface quickly rather than at the next periodic test. It supports independent assurance but does not replace it. Exceptions still need follow-up by control owners.

Question 120Risk Response & Reporting⚑ Flag

Which of the following BEST describes the main advantage of a risk dashboard over a periodic narrative risk report?

AIt provides more detailed analysis of each individual risk. BIt replaces the need for regular risk assessments. CIt gives a current, at-a-glance view of key indicators. DIt removes the need for risk owners to explain variances.

Correct answer: C. It gives a current, at-a-glance view of key indicators.
A dashboard presents key indicators visually and close to real time, so users can quickly see status and spot issues. Narrative reports usually give deeper analysis, so more detail is not the dashboard's strength.

Question 121Risk Assessment⚑ Flag

During a scenario validation workshop at a food manufacturer, a senior vice president dismisses every concern raised by junior staff. Several of those staff work directly with the affected systems. What should the risk practitioner do?

AUse a structured technique, such as anonymous input, to capture all views. BEnd the workshop and validate the scenarios with the IT team alone. CReport the vice president's behavior to the human resources department. DAccept the vice president's views because she has the most authority.

Correct answer: A. Use a structured technique, such as anonymous input, to capture all views.
Validation depends on hearing from people with direct knowledge, and structured methods such as anonymous voting reduce the effect of seniority on the results. Deferring to the vice president is tempting because of her rank, but it would leave the scenarios missing frontline insight.

Question 122Governance⚑ Flag

A global retailer has risk managers in each business unit who report only to the unit heads. The CRO finds that unit risk reports often downplay significant issues. What is the BEST recommendation?

AIncrease how often each unit submits its risk report BMove every unit risk manager into the internal audit team CAdd a reporting line from unit risk managers to the CRO DRequire unit heads to sign off on each risk report

Correct answer: C. Add a reporting line from unit risk managers to the CRO
A reporting line to the CRO gives unit risk managers the independence to raise issues without pressure from the managers they monitor. Requiring unit head sign-off adds more control by the same people who may be downplaying the issues.

Question 123Governance⚑ Flag

A risk practitioner at a biotech firm is determining the value of a research database for risk analysis. Which of the following is the BEST basis for its value?

AThe impact on the business if the data were lost or exposed BThe purchase price of the database software license CThe replacement cost of the hardware that hosts the database DThe number of employees who use the database each day

Correct answer: A. The impact on the business if the data were lost or exposed
An asset's value for risk purposes depends on the business impact of losing its confidentiality, integrity or availability. License and hardware costs are often small compared with the value of years of research data.

Question 124Technology & Security⚑ Flag

A commercial real estate firm plans to install thousands of smart lighting and HVAC sensors connected to its building networks. From a risk perspective, which is MOST important to evaluate before approving the rollout?

AWhether the sensors work with the existing building software BWhether the devices can be patched and secured over their life CThe number of staff needed to install the sensors on schedule DThe expected energy savings over the first three years

Correct answer: B. Whether the devices can be patched and secured over their life
Many IoT devices ship with weak defaults and no update path, so confirming they can be patched and secured throughout their life is key before connecting thousands of them. Compatibility with existing software matters for operations, but it does not address the security risk the devices add.

Question 125Technology & Security⚑ Flag

A law firm's new data loss prevention tool blocks so many legitimate emails that partners are demanding it be turned off. What should the risk practitioner do FIRST?

AAnalyze the blocked events with data owners to refine the rules BSwitch the tool permanently to monitor-only mode for all users CExempt partners from all data loss prevention rules going forward DDisable the tool until a replacement product has been selected

Correct answer: A. Analyze the blocked events with data owners to refine the rules
High false positive rates usually mean the rules do not reflect how the business actually uses data, so reviewing blocked events with data owners is the right first step. Disabling the tool is tempting to calm the complaints, but it removes protection without understanding the problem.

Question 126Risk Assessment⚑ Flag

After controls are applied, the residual risk of a payroll system outage at a construction firm still exceeds the risk appetite approved by the board. The risk practitioner has documented the analysis. What should the risk practitioner do NEXT?

ALower the risk rating so that it aligns with the appetite BAccept the risk on behalf of the business to avoid delays CPresent the results to the risk owner to decide on a response DSelect and fund additional controls through the annual IT budget

Correct answer: C. Present the results to the risk owner to decide on a response
The risk practitioner advises, but the risk owner is accountable for choosing whether to mitigate, transfer, avoid or formally accept the risk through the proper approval path. Selecting and funding controls through IT skips the owner's decision and may not be the most cost-effective response.

Question 127Risk Response & Reporting⚑ Flag

To reduce malware risk, a factory plans to block all removable media on its plant floor computers. Engineers currently use USB drives to load updates onto production machines. What is MOST important to do before the control is implemented?

AConfigure the block through central device management BAssess any new risks the block may create for operations CBuy encrypted USB drives for all plant engineers DTrain engineers on the new removable media policy

Correct answer: B. Assess any new risks the block may create for operations
A risk response can create secondary risks, such as delayed machine updates or unsafe workarounds, that must be assessed before implementation. Training and technical configuration come later, once the response is confirmed to be sound.

Question 128Risk Response & Reporting⚑ Flag

A tester observes a security guard checking employee badges at a warehouse entrance for one morning and sees no exceptions. What is the GREATEST limitation of this evidence?

ABadge checks are a physical rather than technical control BThe warehouse manager did not approve the observation CObservation cannot be documented in working papers DThe guard may behave differently when not observed

Correct answer: D. The guard may behave differently when not observed
Observation shows how a control operated only while it was watched, and people often perform better when they know they are being observed. It should be combined with other evidence, such as access logs over time. Observations can be documented, and the type of control does not limit the evidence.

Question 129Risk Response & Reporting⚑ Flag

A chief risk officer wants the risk function to identify emerging risks earlier instead of learning about them after they affect the business. Which of the following is the BEST approach?

ARegularly scan external sources and gather business input. BWait for internal audit to report new risks in its findings. CAdd a new column for emerging risks in the current register. DReview the register in detail once a year with each risk owner.

Correct answer: A. Regularly scan external sources and gather business input.
Emerging risks come from changes in technology, regulation, markets and threats, so ongoing horizon scanning combined with input from the business gives early warning. An annual review of the existing register mainly looks at known risks and happens too rarely to catch new ones in time.

Question 130Risk Assessment⚑ Flag

A transport company validated its risk scenarios with stakeholders last year. Since then, it has started offering a new ride-sharing service in three cities. What should the risk practitioner do?

AAsk the IT team to update the scenarios without involving the business. BRevalidate the scenarios with stakeholders to reflect the new service. CWait for the next annual review cycle before changing any scenarios. DCopy the scenarios of a competitor that already runs ride-sharing.

Correct answer: B. Revalidate the scenarios with stakeholders to reflect the new service.
A major business change can introduce new assets, threats and obligations, so scenarios should be revalidated when it happens rather than on a fixed date. Waiting for the annual cycle would leave the new service's risks unidentified for months.

Question 131Governance⚑ Flag

A university's risk register holds 400 risks. More than half have not been reviewed in two years, and several relate to systems that were retired. What is the BEST action for the risk practitioner?

AHave owners review each risk and close those no longer valid BAdd a disclaimer to reports that the register may be outdated CLeave the register as is until the next full assessment DDelete every risk that has not been updated recently

Correct answer: A. Have owners review each risk and close those no longer valid
Owners are best placed to confirm whether each risk still exists, update its rating and close risks that no longer apply, which restores trust in the register. Deleting entries in bulk could remove risks that are still real but simply have not been reviewed.

Question 132Governance⚑ Flag

A consumer goods company is classifying its data for the first time. Who should determine the classification level of a dataset that contains employee salary information?

AThe database administrator who maintains the system BThe information security manager for the company CThe internal auditor who reviews payroll controls DThe HR director who owns the salary data

Correct answer: D. The HR director who owns the salary data
The data owner, a business manager accountable for the data, decides its classification based on sensitivity and business needs. The database administrator is a custodian who protects the data according to the classification but does not set it.

Question 133Technology & Security⚑ Flag

The finance team at a construction company built several software bots to post invoices. No one is assigned to maintain them. When a supplier changed its invoice layout, a bot posted wrong amounts for a week before anyone noticed. Which is the BEST recommendation?

AAssign an accountable owner and monitoring to each bot BHave IT rebuild all bots using a more advanced platform CStop using bots and return to manual invoice posting DAsk suppliers to give notice before changing invoice layouts

Correct answer: A. Assign an accountable owner and monitoring to each bot
Bots need a clear owner who monitors their output and maintains them when inputs change, so errors are caught quickly. Asking suppliers for notice helps a little but depends on third parties and does not fix the missing accountability.

Question 134Technology & Security⚑ Flag

During ISO/IEC 27001 implementation at a payments company, the information security manager approved the risk treatment plan and accepted the residual risks for all business units. What is the GREATEST concern?

AThe security manager may not have time to monitor every identified risk BThe treatment plan has not been mapped to NIST CSF categories and outcomes CBusiness risk owners did not approve the plan or accept residual risk DExternal certification auditors have not yet reviewed the treatment plan

Correct answer: C. Business risk owners did not approve the plan or accept residual risk
ISO/IEC 27001 expects risk owners to approve the risk treatment plan and accept residual risk, and those owners are the business managers accountable for the risk. Auditor review is tempting, but it happens later and cannot replace the accountability of the people who own the risk.

Question 135Risk Assessment⚑ Flag

A large teaching hospital rates two risks separately: failure of its electronic health record system and loss of its pharmacy dispensing system. Analysis shows the pharmacy system cannot operate without data from the health record system. Which of the following is MOST important when assessing these risks?

AAccount for the cascading effect of one failure on the other BRemove the pharmacy risk because it duplicates the other CAssign both risks to the same IT system administrator DRate each risk using a separate impact scale for each department

Correct answer: A. Account for the cascading effect of one failure on the other
When one risk event can trigger another, assessing them in isolation understates the true impact, so the analysis should reflect the dependency and the combined consequences. Removing the pharmacy risk loses sight of a distinct impact on patient care, even though its cause is linked.

Question 136Risk Response & Reporting⚑ Flag

Internal audit reports that a retailer's warehouse system lacks segregation of duties. The warehouse manager disagrees with the finding and does not plan to remediate it. What should the risk practitioner ensure?

AInternal audit designs a remediation plan for the manager BThe risk team implements the missing control directly CThe finding is removed from the final audit report DThe risk owner formally accepts and documents the risk

Correct answer: D. The risk owner formally accepts and documents the risk
If management chooses not to remediate a finding, the risk owner with proper authority must formally accept and document the resulting risk. Having internal audit design the fix would compromise its independence and does not resolve who owns the decision.

Question 137Risk Response & Reporting⚑ Flag

Testing confirms that a bank's daily limit check on teller cash withdrawals operated every day last year without exception. However, losses from cash fraud by tellers continued to rise. What is the MOST likely explanation?

AThe testers used a sample that was too small to rely on BThe control design does not address how the fraud occurs CThe control owner falsified records of the daily limit checks DThe losses are within the bank's stated risk tolerance

Correct answer: B. The control design does not address how the fraud occurs
When a control operates consistently but the risk still materializes, the problem is usually design effectiveness, meaning the control does not target the way the risk actually occurs. Operating effectiveness and design effectiveness are separate questions. A small sample could miss failures, but testing found none, so a design gap is the more likely cause.

Question 138Risk Response & Reporting⚑ Flag

A furniture retailer has moved most of its sales from physical stores to an online platform over the past year. Most of its KRIs still focus on in-store theft and store safety. What should the risk practitioner do FIRST?

AAsk the platform vendor to provide its own set of indicators. BAdd online sales performance metrics to the current KRI set. CReassess whether the KRIs still fit the risk profile. DRetire all in-store KRIs since stores now matter less.

Correct answer: C. Reassess whether the KRIs still fit the risk profile.
A major change in the business model shifts the risk profile, so the KRIs must first be reviewed to confirm they still track the most relevant risks. Adding online sales metrics may measure performance rather than risk and skips the needed review.

Question 139Risk Assessment⚑ Flag

Staff at a law firm have begun pasting client documents into a public generative AI tool to draft summaries. No policy covers this use. What should the risk practitioner do FIRST?

ABlock access to all generative AI websites from the firm's network. BFind out how the tool is used and what client data may be exposed. CDraft a firm-wide policy that bans all generative AI tools at once. DAsk the AI provider to delete every firm document it has received.

Correct answer: B. Find out how the tool is used and what client data may be exposed.
The practitioner needs to understand the scope of use and the sensitivity of the data before management can choose a response. Blocking all AI sites is a quick reaction, but it is a decision for management and may push staff toward less visible workarounds.

Question 140Governance⚑ Flag

A university's ERM program produces a detailed annual risk report, but major decisions such as new IT investments are made without considering risk. What is the BEST way to improve the program?

AProduce the enterprise risk report quarterly instead BAdd more detailed IT risks to the annual report CRequire IT approval of all new technology investments DEmbed risk review into investment decision processes

Correct answer: D. Embed risk review into investment decision processes
ERM adds value when risk is considered as part of strategic and investment decisions, not only reported once a year. Producing the report more often improves timeliness but still leaves risk disconnected from the decisions that create it.

Question 141Governance⚑ Flag

At a construction company, all reports to the ethics hotline go directly to the CFO, who decides which ones to investigate. Some recent reports concerned the finance department. What is the GREATEST concern?

ACallers may find the hotline number hard to locate BReports involving senior finance staff may be suppressed CInvestigations may take longer than staff expect DThe hotline may receive too many minor and unrelated complaints

Correct answer: B. Reports involving senior finance staff may be suppressed
Hotline reports should go to a party independent of management, such as the audit committee, because a recipient who may be implicated can block an investigation. A high volume of minor complaints is a workload issue that triage can handle.

Question 142Technology & Security⚑ Flag

A payment processor's machine learning fraud model performed well at launch. Over the past year, the share of fraud it misses has slowly increased as customer behavior changed. Which is the BEST response?

AReplace the model with fixed fraud rules written by analysts BAdd more staff to review transactions the model approves CMonitor performance and retrain the model as it drifts DAsk the vendor to build a completely new model from scratch

Correct answer: C. Monitor performance and retrain the model as it drifts
Models lose accuracy as real-world patterns change, so ongoing performance monitoring with retraining keeps the model aligned with current behavior. Replacing it with fixed rules gives up the model's benefits, and those rules would also go stale.

Question 143Technology & Security⚑ Flag

Engineers at a biotech company often install a commercial database product on new virtual servers without telling procurement. The vendor's contract includes audit rights and licenses the product by processor core. What is the BEST way to reduce the related risk?

ATrack installations against entitlements through asset management BAsk engineers to estimate their database usage once a year CRemove the audit rights clause at the next contract renewal DReplace every commercial database with open-source products right away

Correct answer: A. Track installations against entitlements through asset management
Software asset management compares actual installations with purchased entitlements, so overuse is found and corrected before a vendor audit leads to unbudgeted fees. Removing the audit clause is unlikely to be accepted and does not stop the company from exceeding its licenses.

Question 144Risk Assessment⚑ Flag

A chemical manufacturer's draft BIA measures the impact of a process control system outage only in lost sales per hour. What is the GREATEST concern with this approach?

ALost sales per hour may be difficult for finance to calculate BThe BIA does not list all the hardware used by the control system CSales figures may change if product prices rise next year DSafety, regulatory and reputational impacts may be understated

Correct answer: D. Safety, regulatory and reputational impacts may be understated
A BIA should capture non-financial impacts such as health and safety, regulatory penalties and reputation, which can outweigh lost revenue for a chemical plant. Difficulty calculating sales figures is a practical issue, but leaving out major impact categories would make the system look less critical than it is.

Question 145Risk Response & Reporting⚑ Flag

A logistics firm's cyber insurance policy requires multifactor authentication on all remote access. A recent internal review found three remote access paths that do not use it. Which of the following is the GREATEST concern?

AThe insurer could deny a claim after a breach BThe premium may increase at the next renewal CThe review may need to be repeated next quarter DThe firm may need to buy extra remote access licenses

Correct answer: A. The insurer could deny a claim after a breach
Insurers often make coverage depend on stated security controls, so a gap like missing multifactor authentication could void a claim when the firm needs it most. A higher premium is a manageable cost compared with losing coverage for a major incident.

Question 146Risk Response & Reporting⚑ Flag

An engineering firm is moving its purchase approval process from email to a new workflow platform. What should the risk practitioner recommend regarding the existing controls over approvals?

AKeep the existing controls since the risks are unchanged BRetest the existing controls at the next annual cycle CReassess control design against the changed process DLet the platform vendor decide which controls to keep

Correct answer: C. Reassess control design against the changed process
A significant process change can make existing controls obsolete or leave new gaps, so control design should be reassessed against the new process and its risks. Assuming the risks are unchanged ignores how the platform alters the way approvals happen. Waiting for the annual cycle could leave gaps unaddressed for months.

Question 147Risk Response & Reporting⚑ Flag

A risk practitioner has identified an emerging risk from new quantum computing methods that could weaken current encryption. There is not enough data to estimate likelihood or impact with confidence. What is the BEST way to handle this in reporting?

AAssign it the highest rating to make sure it gets attention. BReport it only to the IT security team as a technical issue. CLeave it out of reports until reliable figures become available. DReport it with a qualitative rating and stated assumptions.

Correct answer: D. Report it with a qualitative rating and stated assumptions.
Emerging risks often lack data, so a qualitative view with clear assumptions keeps management informed while monitoring continues. Waiting for reliable figures may mean the risk is reported only when it is too late to prepare.

Question 148Risk Assessment⚑ Flag

At a regional insurer, one senior engineer is the only person who understands the batch jobs that calculate monthly premiums. None of the jobs are documented. During risk identification, which of the following is the GREATEST concern?

AOther engineers may feel excluded from the batch processing work BThe batch jobs may need much more server capacity as the number of policies grows CThe engineer may ask for a higher salary in the coming year DPremium calculations could fail if the engineer becomes unavailable

Correct answer: D. Premium calculations could fail if the engineer becomes unavailable
Key person dependency means a critical process relies on knowledge held by one individual, so illness, resignation or absence could stop premium billing. A salary request is a manageable HR matter, while losing undocumented knowledge could halt a core process.

Question 149Governance⚑ Flag

A government contractor uses NIST RMF for a new case management system. The control assessment found some residual risk. Who should decide whether the system is allowed to operate?

AThe independent assessor who tested the controls BA senior official serving as the authorizing official CThe information system security officer for the system DThe system administrator who configured the system

Correct answer: B. A senior official serving as the authorizing official
In NIST RMF, the authorizing official is a senior official who formally accepts the risk of operating the system, which reflects that risk acceptance belongs to accountable management. The independent assessor provides findings that inform the decision but does not make it.

Question 150Governance⚑ Flag

An electronics maker classified a new product's specifications as confidential before launch. The product has now launched, and the full specifications are published on the company website. Which of the following is the BEST action?

AApply encryption to the documents for added protection BKeep the original label, since classifications should never change CReclassify the documents to reflect their current sensitivity DDelete the documents, since the details are now public

Correct answer: C. Reclassify the documents to reflect their current sensitivity
Classification should be reviewed over time because the sensitivity of information can change. Keeping an outdated label adds needless protection costs and handling limits, while deleting records may violate retention requirements.