Free IT Risk Fundamentals Certificate practice test: 30 questions with answers

Single loss expectancy is the asset value times the exposure factor, which is $400,000 times 25 percent, or $100,000. Multiplying by the annualized rate of occurrence (2) gives an annualized loss expectancy of $200,000. The $100,000 option is the SLE without frequency applied, $50,000 halves the SLE instead of applying the rate, and $800,000 ignores the exposure factor.

Qualitative analysis uses descriptive scales such as high, medium and low, while quantitative analysis uses numeric measures such as monetary loss or probability. The option that swaps the two labels is wrong because the rating scale is qualitative and the dollar figure is quantitative. The claim that both reports use the same method is wrong, and the claim that ratings cannot sit beside a dollar estimate is wrong because both forms are routinely presented together.

The expected benefit is the reduction in annual loss expectancy, $240,000 minus $60,000, which is $180,000. That exceeds the $30,000 annual cost, so the control has positive net value. Option B is wrong because a control that cuts expected loss by more than it costs lowers total risk cost, and options C and D add conditions that a sound cost-benefit comparison does not require.

A risk scenario links a threat source and a vulnerability to an asset and the resulting business impact, so that the event can be assessed. The other options describe a controls inventory, a budget and a risk acceptance statement, and none of them captures the chain of events that a scenario is meant to describe.

Ordinal scales show only order, so a score of 4 does not mean twice the risk of a score of 2, and multiplying ordinal scores can produce rankings that look precise but are not. Option B is wrong because scores do not have to be converted into currency, option C is wrong because a 1 to 5 scale does not yield exact probabilities, and option D is wrong because whole numbers are not inherently invalid for ranking.

A key risk indicator with a threshold is designed to show rising exposure before losses happen, which is the early warning the team needs. The revenue KPI measures performance rather than risk, the closed incident count is lagging and confirms losses only after they occur, and the audit rating summarizes past findings rather than current exposure.

A threshold breach signals that the risk is outside its tolerance, so the escalation path defined in the risk policy should be used. Removing the indicator or raising the threshold hides the signal, and waiting for the annual cycle delays a response to a risk that is already outside tolerance.

KRIs are early warning measures of risk exposure, usually compared with thresholds, while KPIs measure performance against objectives. Option B swaps the two definitions, option C invents a reporting restriction that does not exist, and option D is wrong because the two measures serve different purposes even when they appear together.

Boards need concise information that links risk to appetite, shows the direction of travel, and states the decisions required. Raw data and technical detail overwhelm directors without supporting any decision, and a statement of security without evidence does not show the risk level or its trend.

The risk register is maintained over time and records each risk with its owner, rating, response and status. The audit findings list, the vendor contract template and the compliance calendar each capture at most part of the picture, but none of them is the register.

Risk identification depends on a complete asset inventory, so unregistered assets should be added with a named owner and then assessed. Excluding them leaves a blind spot, waiting for an audit delays identification, and assuming identical risk skips the owner and data details that a real assessment needs.

Threat intelligence from sector sharing groups and incident response teams describes the threat actors and attack methods that are active now. The budget report, the outdated architecture diagram and the engagement survey do not describe external threat activity, so they are not useful for identifying current threats.

Asset identification records who is accountable for the asset, how sensitive its data is, and what depends on it, all of which feed risk analysis. The cabinet color, the vendor's holiday schedule, marketing material and staff preferences have no bearing on the asset's risk exposure.

A vulnerability is a weakness that a threat could exploit, and a missing second factor on an internet-facing system is exactly that. The credential stuffing campaign and the disgruntled employee are threats, and the loss of trust and pay records is the impact if the weakness is exploited.

A threat source is an actor or event that could cause harm, such as a disgruntled insider or severe flooding. The outdated library, the unlocked cabinet and the unchanged shared password are weaknesses that a threat could exploit, so they are vulnerabilities.

Buying insurance shifts part of the financial consequence of a breach to the insurer, which is risk transfer. The company has not stopped the activity, has not chosen to bear the loss without action, and has not added controls to reduce the event itself.

Withdrawing from the activity that creates the exposure is risk avoidance. Transfer would move the obligations to another party while the feature continued, acceptance would keep the exposure unchanged, and mitigation would keep the feature running with additional controls.

When residual risk is within appetite and treatment costs more than the expected loss, formal acceptance with documentation and continued monitoring is the appropriate response. Spending more on controls than the loss they prevent, ending a strategic activity, or deleting the risk from the register each either wastes resources or hides the exposure.

Residual risk that remains after treatment must be assessed, and then either formally accepted by the accountable owner or treated further. Closing the risk, lowering its rating without evidence, or waiting for an audit all remove or defer the decision without addressing the exposure.

Compensating controls are alternative safeguards used when the preferred control is not possible, which matches segmentation and monitoring around an unpatched system. Replacing the assessment, transferring liability and applying preventive controls only after detection are each incorrect descriptions of these measures.

Governance places ultimate accountability for risk appetite with the board, which approves it and oversees management's risk-taking. Internal audit provides independent assurance rather than setting appetite, the CISO is a management role without authority over every business unit, and regulators set rules rather than an organization's own appetite.

In the three lines model, operational management is the first line and internal audit is the third line, which gives independent assurance to the governing body. Strategy and budget approval belong to the board and executives, external audits are not second line work, and the first line does report up to governance rather than bypassing the board.

COSO's enterprise risk management framework is designed to integrate risk with strategy, objectives and performance across the organization. PCI DSS is limited to cardholder data environments, ITIL focuses on IT service management, and ISO/IEC 27001 specifies an information security management system rather than enterprise risk integration.

When risk oversight reports into a line executive who is judged on revenue, the independence of the risk function is weakened, which is a core governance concern. The other options introduce claims the scenario does not support, such as skill shortages, duplicated testing or policy length rules.

Risk tolerance is the acceptable variation around a specific objective, and it should stay consistent with the broader appetite set by the board. Inherent risk, residual risk and control design each describe a different concept and do not define the acceptable range.

ISO 31000 defines risk as the effect of uncertainty on objectives, which may be positive or negative and is usually assessed through likelihood and impact. Option B describes a vulnerability, option C reduces risk to a failure probability with no link to objectives, and option D describes a financial provision rather than risk.

Inherent risk is the exposure before controls, and residual risk is what remains after controls are applied, so the two scores show the effect of the controls. The other pairs mix up risk categories, threat and impact, or appetite and tolerance, which do not describe a before and after comparison.

A control that stops unauthorized traffic before it reaches the system is preventive. Detective controls find events after they occur, corrective controls restore operation after an event, and a written policy is an administrative control rather than the technical blocking the firewall performs.

Risk management is valuable when its information shapes decisions about objectives, resources and priorities. Keeping it separate, recording ratings after the fact or limiting it to budgets above a threshold each prevent risk information from informing decisions.

A threat is any potential cause of an unwanted incident, which may be a person, an event or a condition. The weakness described in the first option is a vulnerability, the second describes residual risk, and the third describes risk appetite.