Risk Management Strategies

The PRIMARY focus of managing IT-related business risk is to protect:

• information

• hardware

• applications

• databases

The MAIN objective of IT risk management is to:

• prevent loss of IT assets.

• provide timely management reports.

• ensure regulatory compliance.

• enable risk-aware business decisions.

Who is MOST likely responsible for data classification?

• Data user

• Data owner

• Data custodian

• System administrator

When assessing the capability of the risk management process, a regulatory body would place the GREATEST reliance on:

• a peer review

• an internal review

• an external review

• a process capability review

Who MUST give final sign-off on the IT risk management plan?

• IT auditors performing the risk assessment

• Business process owners

• Senior managers

• IT security administrators

Which of the following is MOST important to determine when defining risk management strategies?

• Risk assessment criteria

• IT architecture complexity

• Enterprise disaster recovery plan

• Business objectives and operations

Which of the following is MOST beneficial to improvement of an enterprise's risk management process?

• Key risk indicators

• External benchmarking

• Latest risk assessment

• A maturity model

Which of the following BEST describes the role of management in implementing a risk management strategy?

• Ensure that the planning, budgeting and performance of information security components are appropriate.

• Assess and incorporate the results of risk management into the decision-making process.

• Identify, evaluate and minimize risk to lT systems that support the mission of the enterprise.

• Understand the risk management process so that appropriate training materials and programs can be developed.

Which of the following roles is responsible for evaluating the effectiveness of existing internal information security controls within an enterprise?

• Data owner

• Senior management

• End users

• System auditor

Shortly after performing the annual review and revision of corporate policies, a risk practitioner becomes aware that a new law may affect security requirements for the human resources system. The risk practitioner should:

• analyze what systems and technology-related processes may be impacted

• ensure necessary adjustments are implemented during the next review cycle

• initiate an ad hoc revision of the corporate policy

• notify the system custodian to implement changes