IT Risk Fundamentals Certificate

Last checked November 10, 2026 against the official ISACA exam page.

1. Question 1Risk Assessment and Analysis

   A risk analyst values a customer database at $400,000. A single breach would destroy 25 percent of that value, and threat history suggests two such breaches per year. What is the annualized loss expectancy for this scenario?

   1. A$100,000
   2. B$50,000
   3. C$200,000
   4. D$800,000
   Show answer and explanationHide answer

   Correct answer: C

   Single loss expectancy is the asset value times the exposure factor, which is $400,000 times 25 percent, or $100,000. Multiplying by the annualized rate of occurrence (2) gives an annualized loss expectancy of $200,000. The $100,000 option is the SLE without frequency applied, $50,000 halves the SLE instead of applying the rate, and $800,000 ignores the exposure factor.

2. Question 2Risk Monitoring, Reporting and Communication

   A risk team wants an early warning that a risk is moving toward its tolerance before any loss occurs. Which type of indicator should the team add to its dashboard?

   1. AA key risk indicator that tracks a measurable precursor of the risk and has a defined threshold
   2. BA key performance indicator that reports the year-to-date revenue achieved by the regional sales team
   3. CA count of incidents that already caused financial losses during the previous quarter and have since been closed
   4. DAn audit finding rating that summarizes the results of the most recent internal audit for the business unit
   Show answer and explanationHide answer

   Correct answer: A

   A key risk indicator with a threshold is designed to show rising exposure before losses happen, which is the early warning the team needs. The revenue KPI measures performance rather than risk, the closed incident count is lagging and confirms losses only after they occur, and the audit rating summarizes past findings rather than current exposure.

3. Question 3Risk Identification

   During asset identification, an analyst finds a fleet of laptops run by a team that is missing from the central asset inventory. What is the most appropriate response?

   1. ARecord the laptops only after the next annual audit, because inventory changes are reviewed exclusively at that point in the year
   2. BExclude the laptops from the risk analysis, because only assets registered in the central inventory can be assessed for risk
   3. CAdd the laptops to the inventory, assign an owner and include them in the risk identification work
   4. DAssume the laptops carry the same risk as the central fleet and skip any separate identification of their owners, data or usage
   Show answer and explanationHide answer

   Correct answer: C

   Risk identification depends on a complete asset inventory, so unregistered assets should be added with a named owner and then assessed. Excluding them leaves a blind spot, waiting for an audit delays identification, and assuming identical risk skips the owner and data details that a real assessment needs.

4. Question 4Risk Response

   A company buys a cyber insurance policy so that the insurer will cover part of the cost of any future data breach. Which risk response has the company applied?

   1. ARisk acceptance, formally recording the exposure and choosing to bear any resulting loss without further action
   2. BRisk avoidance, stopping the activity that creates the exposure so that the risk no longer applies to the business
   3. CRisk transfer, sharing the financial consequences of a loss with another party such as an insurer
   4. DRisk mitigation, reducing the likelihood or the impact of a breach through additional technical and procedural controls
   Show answer and explanationHide answer

   Correct answer: C

   Buying insurance shifts part of the financial consequence of a breach to the insurer, which is risk transfer. The company has not stopped the activity, has not chosen to bear the loss without action, and has not added controls to reduce the event itself.

5. Question 5Risk Governance and Management

   A new board member asks which body is ultimately accountable for setting the organization's risk appetite. Which answer is correct?

   1. AThe board of directors, which approves the risk appetite and oversees how management keeps risk within it
   2. BThe internal audit function, which sets the appetite each year and then tests whether the organization has met it
   3. CThe chief information security officer, who alone decides the appetite for every business unit's technology risks
   4. DExternal regulators, who publish a fixed risk appetite for each industry sector that all organizations must adopt directly
   Show answer and explanationHide answer

   Correct answer: A

   Governance places ultimate accountability for risk appetite with the board, which approves it and oversees management's risk-taking. Internal audit provides independent assurance rather than setting appetite, the CISO is a management role without authority over every business unit, and regulators set rules rather than an organization's own appetite.