A multinational corporation has a risk appetite that allows for a maximum annual loss of $1 million from IT risks. The risk team has analyzed three risks: Risk A has an ALE of $800,000, Risk B has an ALE of $600,000, and Risk C has an ALE of $900,000. The company has a limited budget for risk mitigation and can only address one risk this year. The risk manager must decide which risk to mitigate. Which risk should be prioritized?

All risks equally, because they are all below the appetite limit

Risk C, because it has the highest ALE and exceeds the appetite threshold

Risk B, because it has the lowest ALE

Risk A, because it is the most likely to occur

A risk team is analyzing a set of identified risks for a new product launch. They need to determine which risks require immediate attention. Which of the following are outputs of the risk analysis phase that support this decision? (Select all that apply.)

A likelihood rating for each risk

A prioritized list of risks based on risk score

A risk score calculated from likelihood and impact

A risk response plan for each risk

What is the purpose of applying lessons learned in risk management?

To document risks for regulatory compliance only

To replace the risk management lifecycle with a new process

To improve the risk management process and adapt to evolving threats

To eliminate all risks from the enterprise

Which of the following is an activity performed during risk monitoring and review?

Updating the risk register with new risks

Conducting a business impact analysis

Certified in the Governance of Enterprise IT

Domain 4Objective 6

Risk Management Lifecycle CGEIT Practice Questions (Page 4)

Part of the Risk Optimization domain, which accounts for 19% of the CGEIT exam.

32questions here

7free pages

8concepts

19%of the exam

Questions 16–20

16expert · hard
A multinational corporation has a risk appetite that allows for a maximum annual loss of $1 million from IT risks. The risk team has analyzed three risks: Risk A has an ALE of $800,000, Risk B has an ALE of $600,000, and Risk C has an ALE of $900,000. The company has a limited budget for risk mitigation and can only address one risk this year. The risk manager must decide which risk to mitigate. Which risk should be prioritized?
Select an answer first
17application · medium · select all that apply
A risk team is analyzing a set of identified risks for a new product launch. They need to determine which risks require immediate attention. Which of the following are outputs of the risk analysis phase that support this decision? (Select all that apply.)
Select an answer first
18foundation · easy
What is the purpose of applying lessons learned in risk management?
Select an answer first
19foundation · easy
Which risk response strategy involves reducing the likelihood or impact of a risk?
Select an answer first
20foundation · easy
Which of the following is an activity performed during risk monitoring and review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CGEIT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CGEIT” is a trademark of its owner, used for identification only.

Risk Management Lifecycle CGEIT Practice Questions (Page 4)

Questions 16–20

A risk team is analyzing a set of identified risks for a new product launch. They need to determine which risks require immediate attention. Which of the following are outputs of the risk analysis phase that support this decision? (Select all that apply.)

What is the purpose of applying lessons learned in risk management?

Which risk response strategy involves reducing the likelihood or impact of a risk?

Which of the following is an activity performed during risk monitoring and review?

Keep studying — Risk Optimization