Sample Questions and Answers
Which of the following best describes an IT risk?
A) The potential for loss or harm related to the use, ownership, operation, or adoption of IT within an enterprise
B) A financial audit
C) Employee turnover
D) Marketing risk
Answer: A
Explanation: IT risk is related to technology assets and operations.
What is the main purpose of risk acceptance as a risk response?
A) To acknowledge a risk without taking any immediate action because it is within risk appetite
B) To eliminate the risk entirely
C) To transfer the risk to another party
D) To increase controls on the risk
Answer: A
Explanation: Risk acceptance involves consciously choosing to live with the risk if it’s within acceptable limits.
Which of the following is NOT typically included in an IT risk register?
A) Risk description
B) Risk owner
C) Risk impact rating
D) Employee salaries
Answer: D
Explanation: A risk register tracks risks, owners, and impact; it does not contain unrelated data like salaries.
Which of the following best describes the concept of “risk transference”?
A) Shifting the financial consequences of a risk to a third party, such as through insurance
B) Ignoring the risk
C) Eliminating the risk entirely
D) Creating new risks intentionally
Answer: A
Explanation: Risk transference reduces exposure by transferring responsibility.
What is the main goal of a control self-assessment (CSA) in IT risk management?
A) To enable business units to assess and improve their own controls
B) To replace audits
C) To reduce IT budgets
D) To develop new software
Answer: A
Explanation: CSA encourages ownership and continuous improvement of controls.
How often should IT risk assessments be performed?
A) Periodically and when significant changes occur in technology or business processes
B) Only once when systems are first implemented
C) Never
D) Only after a security breach
Answer: A
Explanation: Regular and event-triggered assessments maintain risk awareness and control effectiveness.
Which of the following is a common framework used for IT risk management?
A) NIST Risk Management Framework (RMF)
B) Scrum
C) Waterfall
D) ITIL Service Desk
Answer: A
Explanation: NIST RMF provides structured guidelines for managing IT risk.
What does the acronym “CIA” stand for in information security?
A) Confidentiality, Integrity, Availability
B) Central Intelligence Agency
C) Control, Identify, Assess
D) Confidentiality, Identification, Authorization
Answer: A
Explanation: CIA triad is the foundational model for security objectives.
Which type of control is designed to detect incidents after they have occurred?
A) Detective control
B) Preventive control
C) Corrective control
D) Directive control
Answer: A
Explanation: Detective controls identify and alert on incidents in progress or after occurrence.
Which of the following is an example of an administrative control?
A) Security policies and employee training
B) Firewalls
C) Encryption software
D) Biometric access controls
Answer: A
Explanation: Administrative controls are policies and procedures guiding behavior.
What is the significance of “residual risk” in IT risk management?
A) Risk that remains after implementing controls
B) Risk that has been transferred to a third party
C) Risk that has been eliminated
D) Risk that is unknown
Answer: A
Explanation: Residual risk requires ongoing monitoring and acceptance or further mitigation.
Which risk response strategy is best suited when the cost of mitigation exceeds the benefit?
A) Risk acceptance
B) Risk avoidance
C) Risk transfer
D) Risk reduction
Answer: A
Explanation: If mitigation is cost-prohibitive, organizations may choose to accept the risk.
How does segregation of duties reduce IT risk?
A) By preventing a single individual from having control over all aspects of a critical process
B) By reducing employee workload
C) By increasing IT costs
D) By centralizing authority
Answer: A
Explanation: It minimizes the chance of fraud or error through checks and balances.
What is the primary purpose of a security awareness program?
A) To educate employees on IT security risks and best practices
B) To develop new IT systems
C) To audit financial records
D) To improve marketing strategies
Answer: A
Explanation: Awareness programs reduce human error and insider risk.
Which of the following is a limitation of qualitative risk assessments?
A) Subjectivity in risk ratings
B) High cost of implementation
C) Requires numerical data
D) Cannot assess risks at all
Answer: A
Explanation: Qualitative methods rely on judgment, which can vary between assessors.
What is a key characteristic of a “risk appetite” statement?
A) It defines the types and amounts of risk an organization is willing to take to achieve objectives
B) It is a financial forecast
C) It is a project plan
D) It is a compliance checklist
Answer: A
Explanation: Risk appetite guides decision-making and aligns with strategy.
Which IT risk management activity involves continuous evaluation of risk and control effectiveness?
A) Risk monitoring
B) Risk identification
C) Risk avoidance
D) Risk acceptance
Answer: A
Explanation: Monitoring ensures timely updates and responses to changes.
What is the difference between inherent risk and residual risk?
A) Inherent risk exists before controls are applied; residual risk remains after controls are applied
B) Inherent risk is always lower than residual risk
C) Residual risk is the risk before controls
D) They are the same
Answer: A
Explanation: Inherent risk is the raw risk; residual risk is what remains after mitigation.
What type of risk does social engineering primarily exploit?
A) Human factor risk
B) Hardware failure risk
C) Software bug risk
D) Natural disaster risk
Answer: A
Explanation: Social engineering manipulates human behavior to gain unauthorized access.
What is the purpose of a control framework such as COBIT in IT risk management?
A) To provide best practices and guidelines for managing IT governance and risk
B) To write software code
C) To design hardware
D) To manage payroll
Answer: A
Explanation: COBIT offers structured controls and processes for IT governance and risk.
Which of the following best describes the “attack surface” of an IT system?
A) All points where an unauthorized user could attempt to enter or extract data
B) The physical size of the data center
C) The number of employees in the IT department
D) The amount of data stored
Answer: A
Explanation: Reducing the attack surface limits vulnerabilities.
What is the main benefit of implementing multi-factor authentication (MFA)?
A) It significantly reduces the risk of unauthorized access
B) It simplifies password management
C) It increases the number of users
D) It speeds up login processes
Answer: A
Explanation: MFA requires multiple verification methods, increasing security.
What does the “likelihood” in risk assessment refer to?
A) The probability that a threat will exploit a vulnerability
B) The financial cost of a risk
C) The time to fix a vulnerability
D) The number of affected employees
Answer: A
Explanation: Likelihood quantifies how probable a risk event is to occur.
Which of the following is a key consideration when selecting risk treatment options?
A) Cost-effectiveness and alignment with organizational objectives
B) Employee preferences
C) Avoiding all risk regardless of cost
D) Ignoring stakeholder input
Answer: A
Explanation: Effective risk treatment balances cost, benefit, and strategic goals.
Which IT risk is associated with outdated software and unpatched systems?
A) Vulnerability exploitation
B) Insider threat
C) Physical damage
D) Regulatory non-compliance
Answer: A
Explanation: Unpatched software is vulnerable to known exploits.
What is an example of a physical control in IT risk management?
A) Locked server rooms
B) Antivirus software
C) Security awareness training
D) Access control lists
Answer: A
Explanation: Physical controls protect hardware and infrastructure from physical threats.
How does IT risk management support regulatory compliance?
A) By ensuring controls meet legal and regulatory requirements
B) By avoiding all audits
C) By focusing solely on financial reporting
D) By ignoring laws
Answer: A
Explanation: Compliance frameworks mandate specific IT risk controls.
What is the primary role of IT governance in risk management?
A) To ensure that IT aligns with business goals and risk appetite
B) To manage daily IT operations only
C) To replace risk management entirely
D) To write software code
Answer: A
Explanation: Governance provides oversight, accountability, and strategic direction.
Reviews
There are no reviews yet.