Know How to Explain the Concept of Risk Posture and Show How to Determine an Acceptable Balance Between Opportunity and Risk (11.10, 11.11, 11.12 Including Subsections for All) ITIL-4-STRATEGIC-LEADER-MODULES Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software company is considering a major pivot to a subscription-based model. The CFO has calculated that the company can absorb a loss of up to $2 million over the next two years if the pivot fails. The board has stated that they are willing to accept a 20% chance of failure for this strategic move. The CEO, however, is only comfortable with a 5% chance of failure. Which component of risk posture is the CEO's 5% limit?

   • ARisk threshold
   • BRisk tolerance
   • CRisk appetite
   • DRisk capacity
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the first step in determining an acceptable balance between opportunity and risk?

   • AConducting a detailed risk assessment of all possible risks
   • BImplementing risk mitigation controls
   • CSelecting the riskiest opportunity available
   • DUnderstanding the organization's objectives and stakeholder expectations
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A media company has a very aggressive risk posture, which has led to rapid growth but also several public data breaches. The board has now mandated a shift to a more balanced posture. The IT department is resistant, arguing that the aggressive posture is the reason for the company's success. The marketing department is concerned that a more cautious posture will slow down their campaigns. What is the most effective way to implement this change?

   • ACommunicate the board's decision and expect all departments to comply immediately.
   • BImmediately implement strict new security policies and enforce them with penalties for non-compliance.
   • CEngage stakeholders from IT and marketing to co-create new risk tolerances that balance innovation with protection.
   • DHire a new CISO with a strong security background to enforce the new posture.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare provider has a risk appetite statement that says 'we will accept moderate risks to improve patient outcomes through digital innovation.' However, the IT department has a rule that no new system can be deployed unless it has been in production for at least six months at another organization. A new AI-based triage tool could significantly reduce wait times, but it is only available from a vendor with three successful deployments. What is the primary issue in this scenario?

   • AThe risk appetite and the risk tolerance are misaligned, creating a barrier to achieving the strategic objective.
   • BThe vendor's product is too risky because it has not been widely adopted.
   • CThe risk appetite statement is too vague to be useful for decision-making.
   • DThe IT department's rule is too strict and should be ignored to speed up innovation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of identifying gaps between desired and actual risk posture?

   • ATo compare the organization's risk posture with that of competitors
   • BTo identify areas where the organization's risk-taking is not aligned with its objectives
   • CTo eliminate all risks from the organization
   • DTo determine the exact amount of risk to take in the next quarter
   Reveal Solution Discussion Select an answer first