Risk Frameworks and Standards CGEIT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key benefit of integrating a risk framework with the overall enterprise governance structure?

   • AIt focuses only on IT risks, ignoring other business risks
   • BIt eliminates the need for separate IT governance
   • CIt guarantees that all risks are eliminated
   • DIt ensures that risk management decisions are aligned with the organization's strategic direction
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A multinational bank must comply with the EU General Data Protection Regulation (GDPR) and the Basel Committee's operational risk capital requirements. The board wants a single enterprise-wide risk language that also satisfies external auditors' expectations for a control-based framework. Which framework combination should the CGEIT advise the bank to adopt?

   • AAdopt COBIT 2019 as the only framework because it aligns IT goals with enterprise goals and includes all necessary controls.
   • BAdopt ISO 31000 as the sole framework and rely on its generic principles to satisfy Basel and GDPR simultaneously.
   • CAdopt NIST RMF as the sole framework because it covers both security and privacy controls required by GDPR.
   • DAdopt COSO ERM as the umbrella framework and map ISO/IEC 27005 processes for IT-specific risk assessments.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare provider is implementing a risk management program and must comply with HIPAA security rules. The CISO wants a framework that provides a structured, step-by-step process for categorizing systems, selecting controls, and authorizing systems to operate. Which framework should the CISO select?

   • ACOSO ERM
   • BISO 31000
   • CNIST Risk Management Framework (RMF)
   • DISO/IEC 27005
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A publicly traded company must comply with the Sarbanes-Oxley Act (SOX) for financial reporting controls and also wants to improve its IT risk management. The CFO prefers a framework that integrates internal control over financial reporting with IT risk. Which framework should the company adopt?

   • AISO/IEC 27005 as the sole framework
   • BISO 31000 as the sole framework
   • CCOSO ERM with IT control mappings to COBIT
   • DNIST RMF as the sole framework
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's IT department uses NIST RMF for system security, but the enterprise risk team uses COSO ERM. The CEO wants a single risk appetite statement that applies to both IT and enterprise risks. What is the best way to achieve this?

   • ADevelop a risk appetite statement at the enterprise level and map NIST RMF risk levels to COSO ERM risk categories.
   • BUse COSO ERM's risk categories as the IT risk appetite.
   • CUse NIST RMF's risk levels as the enterprise risk appetite.
   • DKeep separate risk appetite statements for IT and enterprise risks.
   Reveal Solution Discussion Select an answer first