Risk and Control Ownership CISM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which responsibility is typically assigned to a risk owner?

   • AConducting an independent audit of the risk management process
   • BSelecting and configuring the technical settings of a firewall
   • CApproving a risk treatment plan and accepting residual risk
   • DPerforming daily backups of critical databases
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A control owner is responsible for a firewall rule set that prevents unauthorized network access. The control owner has been asked to document the control's effectiveness for an annual review. Which action best demonstrates the control owner's responsibility?

   • AReport the firewall's effectiveness directly to the board of directors.
   • BAccept any residual risk associated with the firewall configuration.
   • CDecide whether the firewall control is sufficient to mitigate the risk.
   • DReview firewall logs and report any blocked or allowed traffic anomalies to the risk owner.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A risk owner has been managing a risk for several years. The risk has been consistently low and the controls are effective. The risk owner is considering whether to close the risk. What is the most appropriate action?

   • ATransfer the risk to the control owner because the controls are effective.
   • BKeep the risk open and continue monitoring it as part of the lifecycle.
   • CClose the risk because it has been low for several years.
   • DAccept the risk formally and stop monitoring it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary responsibility of a control owner?

   • APerforming an annual risk assessment for all business processes
   • BImplementing and maintaining the controls that mitigate a risk
   • CDeciding whether to accept a risk based on business impact
   • DDefining the organization's overall risk appetite
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A regional bank has identified a high-risk vulnerability in its customer-facing mobile banking application. The CISO has assigned a risk owner to manage this risk. The risk owner has accepted the risk and documented the rationale. Six months later, the vulnerability remains unpatched and the risk owner has moved to a different department. Which action best reflects the ongoing responsibility of the original risk owner in this situation?

   • AThe responsibility transfers to the new department head who now oversees the application team.
   • BThe responsibility remains with the original owner until the risk is formally accepted by a new owner.
   • CThe responsibility ends because the risk was formally accepted and documented.
   • DThe responsibility reverts to the CISO because the original owner is no longer available.
   Reveal Solution Discussion Select an answer first