Business Risk, Exposures and Threats CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A technology startup is considering a new partnership that would share customer data with a third-party analytics firm. The startup's risk appetite is aggressive for growth but conservative for data privacy. The partnership could increase revenue by 30% but also increases the risk of a data breach. How should the startup's governance team evaluate this opportunity?

   • AAccept the partnership because the revenue growth aligns with the aggressive growth appetite
   • BReject the partnership because the data privacy risk exceeds the stated risk appetite
   • CDefer the decision until the risk appetite is revised to be more aggressive
   • DAccept the partnership but require the analytics firm to sign a liability waiver
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A utility company is updating its threat assessment. The risk team notes that a recent geopolitical conflict has increased the risk of cyberattacks on critical infrastructure. The company's control systems are air-gapped from the internet. Which threat should the team consider as the most plausible?

   • AInsider threat from an employee with access to the control systems
   • BPhysical attack on the facility by a terrorist group
   • CDirect remote cyberattack from an external actor
   • DSupply chain compromise of a software vendor
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which risk category is primarily associated with the failure of a third-party supplier to deliver critical components?

   • AOperational risk
   • BCompliance risk
   • CFinancial risk
   • DStrategic risk
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional bank is expanding its mobile banking app to include peer-to-peer transfers. The IT director notes that the new feature will rely on a third-party payment processor. The board asks for an assessment of the potential financial loss if the processor suffers a prolonged outage. Which type of business risk exposure should the IT governance team prioritize in this assessment?

   • AOperational risk from dependency on an external service provider
   • BStrategic risk from entering a new market segment
   • CReputational risk from customer dissatisfaction with the new feature
   • DCompliance risk from regulatory requirements for payment services
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of an external source of risk exposure?

   • AA data center power outage
   • BA new government regulation affecting the industry
   • COutdated internal processes
   • DInadequate employee training
   Reveal Solution Discussion Select an answer first