Which of the following control functions is used to keep someone from violating a policy or committing an illegal act, whether or not they are aware that the control exists?

• Detective

• Preventive

• Corrective

• Compensating

Which of the following accurately describes the items that should be considered by the organization in control selection?

• Governance, control effectiveness, and data type

• Control effectiveness, organizational mission, and cost to implement and maintain

• Governance, control effectiveness, and cost to implement and maintain

• Cost to implement and maintain, data type, and organizational mission

Which of the following are important considerations in evaluating risk response options?

• Cost and effectiveness of response options

• Resistance by personnel to response options

• Cost and expected profit from response options.

• Governance-mandated response options

Which of the following is NOT considered one of the three types of security controls implemented to protect assets?

• Administrative

• Technical

• Physical

• Financial

Which of the following is a true statement regarding emerging risk?

• Organizations can avoid emerging risks by not adopting new technologies

• Once a particular risk has been assessed, it does not change

• The dynamic nature of risk means that it must be constantly monitored, reassessed, and reevaluated.

• Emerging risks are limited to only the implementation of new technologies

Security controls are typically assessed for all of the following except which one?

• Effectiveness

• Cost

• Risk reduction

• Compliance

Which of the following is the most important characteristic of data presented in a risk report?

• Data must be trustworthy and accurate.

• Data must align with what management expects the report to reflect.

• Data must consider management’s attitude toward risk.

• Data must be favorable toward risk analysts and risk owners

Which of the following is senior leadership’s commitment to risk management and provides an overall long-term direction for where the organization wants to be in terms of managing its risk?

• Risk management policy

• Risk management strategy

• Risk management methodology

• Risk assessment procedures

Which of the following will always remain unless the source of a risk is completely avoided?

• Risk tolerance

• Risk appetite

• Residual risk

• Qualitative risk

Which the following takes the place of a primary or desired control on a longer-term basis to mitigate risk if the desired control cannot be implemented for some reason?

• Detective

• Preventive

• Corrective

• Compensating