Risk Management Lifecycle CGEIT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a major security incident, a company's risk team conducts a post-incident review. They identify that the incident occurred because the risk of a specific vulnerability was underestimated during the risk analysis phase. What is the most appropriate action to support continuous improvement in risk management?

   • AUpdate the risk assessment methodology to incorporate lessons learned from the incident
   • BBlame the risk analyst for the underestimation and move on
   • CRemove the risk from the register because it has already occurred
   • DIncrease the risk appetite to accommodate similar risks in the future
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does risk analysis primarily determine for each identified risk?

   • AThe risk appetite of the enterprise
   • BThe effectiveness of existing controls
   • CThe likelihood and impact of the risk
   • DThe risk owner and response strategy
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the risk management lifecycle, which phase directly follows risk analysis?

   • ARisk monitoring and review
   • BRisk identification
   • CRisk evaluation
   • DRisk response planning
   Reveal Solution Discussion Select an answer first
5. 9application · medium · select all that apply

   A company is in the risk identification phase for a new cloud migration project. Which of the following are appropriate activities for this phase? (Select all that apply.)

   • ABrainstorming potential risks with stakeholders from IT, security, and business units
   • BReviewing lessons learned from previous cloud migrations
   • CUsing a risk checklist tailored to cloud migration
   • DDeciding on risk response strategies for each risk
   • ECalculating the annualized loss expectancy for each identified risk
   Check answers Discussion Select an answer first
6. 10foundation · easy

   Which activity best supports continuous improvement in risk management?

   • AAvoiding changes to the risk management process
   • BFocusing only on new risks and ignoring past lessons
   • CDeleting outdated risk assessments
   • DConducting a post-incident review to identify process improvements
   Reveal Solution Discussion Select an answer first