🧭 OLUMA CERTIFICATION ZONE IT Risk FundamentalsPractice Range 100 original questions across the six IT Risk Fundamentals domains — from what risk is to how it’s governed, found, measured, treated and watched. Pick your range and find your bearings. Risk Intro & OverviewRisk Governance & ManagementRisk IdentificationRisk Assessment & AnalysisRisk ResponseRisk Monitoring & Reporting SELECT YOUR RANGE102550100 01/100 Risk Intro & Overview In risk management terms, what is 'risk'? AA type of audit✖ OFF COURSESmall detour — back on course with this:Risk combines uncertainty (likelihood) with consequence (impact) relative to what the organization is trying to achieve. BThe effect of uncertainty on objectives — a potential event and its consequence✔ RISK UNDERSTOODYou're building the foundation every risk career stands on.Risk combines uncertainty (likelihood) with consequence (impact) relative to what the organization is trying to achieve. CAny expense✖ OFF COURSESmall detour — back on course with this:Risk combines uncertainty (likelihood) with consequence (impact) relative to what the organization is trying to achieve. DA guaranteed loss✖ OFF COURSESmall detour — back on course with this:Risk combines uncertainty (likelihood) with consequence (impact) relative to what the organization is trying to achieve. 02/100 Risk Intro & Overview A ransomware group targeting the healthcare sector is an example of a: AThreat✔ COURSE CONFIRMEDSolid fundamentals — that's a future CRISC talking.A threat is an actor or event with the potential to cause harm. BVulnerability✖ RECHECK THE MAPNo losses in practice. Log the lesson:A threat is an actor or event with the potential to cause harm. CRisk response✖ RECHECK THE MAPNo losses in practice. Log the lesson:A threat is an actor or event with the potential to cause harm. DControl✖ RECHECK THE MAPNo losses in practice. Log the lesson:A threat is an actor or event with the potential to cause harm. 03/100 Risk Intro & Overview An internet-facing server missing critical patches is an example of a: ARisk appetite✖ EXPOSURE MISSEDAdjust your heading with this insight:A vulnerability is a weakness that a threat can exploit. BVulnerability✔ APPETITE ALIGNEDExactly right. Risk thinking is becoming instinct.A vulnerability is a weakness that a threat can exploit. CThreat✖ EXPOSURE MISSEDAdjust your heading with this insight:A vulnerability is a weakness that a threat can exploit. DKRI✖ EXPOSURE MISSEDAdjust your heading with this insight:A vulnerability is a weakness that a threat can exploit. 04/100 Risk Intro & Overview Anything of value to the organization — data, systems, people, reputation — is called a(n): AThreat✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Assets are what risk management ultimately protects. BAsset✔ SCENARIO MAPPEDClear-eyed and correct. Oluma loves to see it.Assets are what risk management ultimately protects. CExposure✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Assets are what risk management ultimately protects. DMetric✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Assets are what risk management ultimately protects. 05/100 Risk Intro & Overview Why is IT risk considered a business risk rather than just a technical issue? ATechnology failures directly harm business objectives: revenue, operations, compliance, and reputation✔ IMPACT MEASUREDYou just reasoned like a risk professional.IT underpins business processes, so IT risk translates into business impact. BServers are expensive✖ REVIEW THE BASICSSmall detour — back on course with this:IT underpins business processes, so IT risk translates into business impact. CIT staff say so✖ REVIEW THE BASICSSmall detour — back on course with this:IT underpins business processes, so IT risk translates into business impact. DIt isn't✖ REVIEW THE BASICSSmall detour — back on course with this:IT underpins business processes, so IT risk translates into business impact. 06/100 Risk Intro & Overview Which is an example of IT risk creating opportunity cost (value not realized)? AA power outage✖ OFF COURSENo losses in practice. Log the lesson:IT risk includes failing to benefit from technology, not only losses from incidents. BStolen laptops✖ OFF COURSENo losses in practice. Log the lesson:IT risk includes failing to benefit from technology, not only losses from incidents. CA breach fine✖ OFF COURSENo losses in practice. Log the lesson:IT risk includes failing to benefit from technology, not only losses from incidents. DBeing too slow or risk-averse to adopt beneficial technology competitors use well✔ RESPONSE CHOSENThat's the answer a seasoned analyst would give.IT risk includes failing to benefit from technology, not only losses from incidents. 07/100 Risk Intro & Overview Likelihood answers which question about a risk? AHow bad would it be?✖ RECHECK THE MAPAdjust your heading with this insight:Likelihood is the probability dimension; impact is the consequence dimension. BWho caused it?✖ RECHECK THE MAPAdjust your heading with this insight:Likelihood is the probability dimension; impact is the consequence dimension. CHow probable is it?✔ INDICATOR GREENYou're building the foundation every risk career stands on.Likelihood is the probability dimension; impact is the consequence dimension. DWhat does it cost to fix?✖ RECHECK THE MAPAdjust your heading with this insight:Likelihood is the probability dimension; impact is the consequence dimension. 08/100 Risk Intro & Overview Impact answers which question about a risk? AHow severe would the consequences be?✔ LESSON LOGGEDSolid fundamentals — that's a future CRISC talking.Impact measures the magnitude of harm to objectives if the event occurs. BWhich team owns it?✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Impact measures the magnitude of harm to objectives if the event occurs. CWhen is the audit?✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Impact measures the magnitude of harm to objectives if the event occurs. DHow probable is it?✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Impact measures the magnitude of harm to objectives if the event occurs. 09/100 Risk Intro & Overview The combination of all risks an organization currently faces is its: ARisk transfer✖ RECALIBRATESmall detour — back on course with this:The risk profile is the current overall risk landscape/portfolio. BRisk profile✔ BEARINGS TRUEExactly right. Risk thinking is becoming instinct.The risk profile is the current overall risk landscape/portfolio. CRisk appetite✖ RECALIBRATESmall detour — back on course with this:The risk profile is the current overall risk landscape/portfolio. DRisk response✖ RECALIBRATESmall detour — back on course with this:The risk profile is the current overall risk landscape/portfolio. 10/100 Risk Intro & Overview Which of these illustrates reputational impact from an IT event? AA completed patch cycle✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Beyond direct costs, incidents can erode trust — often the most lasting damage. BA disk running hot✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Beyond direct costs, incidents can erode trust — often the most lasting damage. CCustomers losing trust after a publicized data breach✔ REGISTER CURRENTClear-eyed and correct. Oluma loves to see it.Beyond direct costs, incidents can erode trust — often the most lasting damage. DA password change✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Beyond direct costs, incidents can erode trust — often the most lasting damage. CHECKPOINT — 10 DOWN, KEEP CLIMBING 11/100 Risk Intro & Overview 'Zero risk' as a business goal is: AA standard KPI✖ OFF COURSEAdjust your heading with this insight:Risk can be reduced and managed, never eliminated; management aims for informed acceptance. BRequired by law✖ OFF COURSEAdjust your heading with this insight:Risk can be reduced and managed, never eliminated; management aims for informed acceptance. CAchievable with enough budget✖ OFF COURSEAdjust your heading with this insight:Risk can be reduced and managed, never eliminated; management aims for informed acceptance. DUnrealistic — the goal is keeping risk within acceptable levels while pursuing objectives✔ RISK UNDERSTOODYou just reasoned like a risk professional.Risk can be reduced and managed, never eliminated; management aims for informed acceptance. 12/100 Risk Intro & Overview Which statement about risk and reward is accurate? AAll risk-taking is reckless✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Organizations take risk to gain value; risk management makes that pursuit informed. BRisk only applies to IT✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Organizations take risk to gain value; risk management makes that pursuit informed. CValue creation typically requires taking some risk deliberately and managing it✔ COURSE CONFIRMEDThat's the answer a seasoned analyst would give.Organizations take risk to gain value; risk management makes that pursuit informed. DReward never involves risk✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Organizations take risk to gain value; risk management makes that pursuit informed. 13/100 Risk Intro & Overview A flood damaging a data center is which category of threat? AAdversarial✖ EXPOSURE MISSEDSmall detour — back on course with this:Threat sources include adversarial, accidental, structural, and environmental categories. BRegulatory✖ EXPOSURE MISSEDSmall detour — back on course with this:Threat sources include adversarial, accidental, structural, and environmental categories. CCultural✖ EXPOSURE MISSEDSmall detour — back on course with this:Threat sources include adversarial, accidental, structural, and environmental categories. DEnvironmental/natural✔ APPETITE ALIGNEDYou're building the foundation every risk career stands on.Threat sources include adversarial, accidental, structural, and environmental categories. 14/100 Risk Intro & Overview An employee accidentally emailing a client list to the wrong recipient is which threat type? AHardware failure✖ RECALIBRATENo losses in practice. Log the lesson:Unintentional human error is one of the most common threat sources. BAccidental / human error✔ SCENARIO MAPPEDSolid fundamentals — that's a future CRISC talking.Unintentional human error is one of the most common threat sources. CNatural disaster✖ RECALIBRATENo losses in practice. Log the lesson:Unintentional human error is one of the most common threat sources. DAdversarial attack✖ RECALIBRATENo losses in practice. Log the lesson:Unintentional human error is one of the most common threat sources. 15/100 Risk Intro & Overview The chance a threat successfully exploits a vulnerability and harms an asset describes: AA control✖ REVIEW THE BASICSAdjust your heading with this insight:When threat meets vulnerability and impacts an asset, risk is realized as an incident/loss event. BA risk scenario materializing✔ IMPACT MEASUREDExactly right. Risk thinking is becoming instinct.When threat meets vulnerability and impacts an asset, risk is realized as an incident/loss event. CGovernance✖ REVIEW THE BASICSAdjust your heading with this insight:When threat meets vulnerability and impacts an asset, risk is realized as an incident/loss event. DAn audit✖ REVIEW THE BASICSAdjust your heading with this insight:When threat meets vulnerability and impacts an asset, risk is realized as an incident/loss event. 16/100 Risk Intro & Overview Why does every organization — not just banks or hospitals — need IT risk management? ARegulations apply identically to all✖ OFF COURSEFundamentals take reps. Here's the takeaway:Technology dependence is universal; only the scale and specifics of risk differ. BOnly large firms have risk✖ OFF COURSEFundamentals take reps. Here's the takeaway:Technology dependence is universal; only the scale and specifics of risk differ. CNearly every organization depends on technology and data to operate, so all face IT risk✔ RESPONSE CHOSENClear-eyed and correct. Oluma loves to see it.Technology dependence is universal; only the scale and specifics of risk differ. DIt's fashionable✖ OFF COURSEFundamentals take reps. Here's the takeaway:Technology dependence is universal; only the scale and specifics of risk differ. 17/100 Risk Intro & Overview Which best describes the relationship between information security and IT risk management? ASecurity is a major discipline within managing IT risk, which also covers availability, project, and strategic technology risk✔ INDICATOR GREENYou just reasoned like a risk professional.IT risk is broader than security alone — it includes any tech-related threat to objectives. BSecurity replaces risk management✖ RECHECK THE MAPSmall detour — back on course with this:IT risk is broader than security alone — it includes any tech-related threat to objectives. CRisk management is a firewall brand✖ RECHECK THE MAPSmall detour — back on course with this:IT risk is broader than security alone — it includes any tech-related threat to objectives. DThey are unrelated✖ RECHECK THE MAPSmall detour — back on course with this:IT risk is broader than security alone — it includes any tech-related threat to objectives. 18/100 Risk Governance & Management Risk governance is primarily concerned with: ADaily firewall rules✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Governance sets the framework and boundaries; management executes within them. BSetting direction, accountability, and oversight for how risk is managed✔ LESSON LOGGEDThat's the answer a seasoned analyst would give.Governance sets the framework and boundaries; management executes within them. CBuying insurance✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Governance sets the framework and boundaries; management executes within them. DWriting code✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Governance sets the framework and boundaries; management executes within them. 19/100 Risk Governance & Management Who is ultimately accountable for risk oversight in an organization? AInterns✖ RECALIBRATEAdjust your heading with this insight:Boards own oversight; management runs the program day to day. BVendors✖ RECALIBRATEAdjust your heading with this insight:Boards own oversight; management runs the program day to day. CThe board of directors / senior governance body✔ BEARINGS TRUEYou're building the foundation every risk career stands on.Boards own oversight; management runs the program day to day. DThe service desk✖ RECALIBRATEAdjust your heading with this insight:Boards own oversight; management runs the program day to day. 20/100 Risk Governance & Management The amount of risk an organization is willing to take in pursuit of its objectives is its: AResidual risk✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Appetite is the willingness boundary set by leadership. BRisk capacity✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Appetite is the willingness boundary set by leadership. CRisk appetite✔ REGISTER CURRENTSolid fundamentals — that's a future CRISC talking.Appetite is the willingness boundary set by leadership. DRisk register✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Appetite is the willingness boundary set by leadership. CHECKPOINT — 20 DOWN, KEEP CLIMBING 21/100 Risk Governance & Management Risk tolerance differs from appetite in that tolerance: AIs always zero✖ OFF COURSESmall detour — back on course with this:Tolerance operationalizes appetite at the objective/initiative level. BIs set by vendors✖ OFF COURSESmall detour — back on course with this:Tolerance operationalizes appetite at the objective/initiative level. CDefines acceptable variation around appetite for specific objectives or activities✔ RISK UNDERSTOODExactly right. Risk thinking is becoming instinct.Tolerance operationalizes appetite at the objective/initiative level. DReplaces governance✖ OFF COURSESmall detour — back on course with this:Tolerance operationalizes appetite at the objective/initiative level. 22/100 Risk Governance & Management The absolute maximum loss an organization could survive is its: ARisk appetite✖ RECHECK THE MAPNo losses in practice. Log the lesson:Capacity is the hard ceiling; appetite should be set safely below it. BRisk capacity✔ COURSE CONFIRMEDClear-eyed and correct. Oluma loves to see it.Capacity is the hard ceiling; appetite should be set safely below it. CRisk score✖ RECHECK THE MAPNo losses in practice. Log the lesson:Capacity is the hard ceiling; appetite should be set safely below it. DRisk tolerance✖ RECHECK THE MAPNo losses in practice. Log the lesson:Capacity is the hard ceiling; appetite should be set safely below it. 23/100 Risk Governance & Management In the 'three lines' model, business/operational management is: AOutside the model✖ EXPOSURE MISSEDAdjust your heading with this insight:The first line owns risks; second line oversees; third line (audit) assures independently. BThe third line✖ EXPOSURE MISSEDAdjust your heading with this insight:The first line owns risks; second line oversees; third line (audit) assures independently. CThe first line — owning and managing risk in daily operations✔ APPETITE ALIGNEDYou just reasoned like a risk professional.The first line owns risks; second line oversees; third line (audit) assures independently. DThe second line✖ EXPOSURE MISSEDAdjust your heading with this insight:The first line owns risks; second line oversees; third line (audit) assures independently. 24/100 Risk Governance & Management Internal audit's role in risk management is to: ASet risk appetite✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Audit is the third line: independent evaluation reported to governance. BOperate firewalls✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Audit is the third line: independent evaluation reported to governance. CProvide independent assurance that risk management and controls are effective✔ SCENARIO MAPPEDThat's the answer a seasoned analyst would give.Audit is the third line: independent evaluation reported to governance. DOwn all risks✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Audit is the third line: independent evaluation reported to governance. 25/100 Risk Governance & Management A risk policy that no one follows creates: AA false sense of security — documented and actual practice diverge✔ IMPACT MEASUREDYou're building the foundation every risk career stands on.Unenforced policy hides real exposure behind paper assurance. BBetter morale✖ REVIEW THE BASICSSmall detour — back on course with this:Unenforced policy hides real exposure behind paper assurance. CStrong protection✖ REVIEW THE BASICSSmall detour — back on course with this:Unenforced policy hides real exposure behind paper assurance. DAutomatic compliance✖ REVIEW THE BASICSSmall detour — back on course with this:Unenforced policy hides real exposure behind paper assurance. 26/100 Risk Governance & Management Risk culture refers to: AServer naming✖ OFF COURSENo losses in practice. Log the lesson:Culture determines whether risk practices are lived or bypassed. BThe shared attitudes and behaviors that shape real risk decisions✔ RESPONSE CHOSENSolid fundamentals — that's a future CRISC talking.Culture determines whether risk practices are lived or bypassed. COffice décor✖ OFF COURSENo losses in practice. Log the lesson:Culture determines whether risk practices are lived or bypassed. DThe audit calendar✖ OFF COURSENo losses in practice. Log the lesson:Culture determines whether risk practices are lived or bypassed. 27/100 Risk Governance & Management Leadership publicly rewards a manager who bypassed controls to hit a deadline. The cultural signal is: ASpeed beats safety — encouraging others to bypass controls too✔ INDICATOR GREENExactly right. Risk thinking is becoming instinct.Tone at the top teaches the organization what really gets rewarded. BNothing✖ RECHECK THE MAPAdjust your heading with this insight:Tone at the top teaches the organization what really gets rewarded. CControls matter✖ RECHECK THE MAPAdjust your heading with this insight:Tone at the top teaches the organization what really gets rewarded. DAuditors are watching✖ RECHECK THE MAPAdjust your heading with this insight:Tone at the top teaches the organization what really gets rewarded. 28/100 Risk Governance & Management Assigning each significant risk a named owner ensures: AClear accountability for monitoring and treatment decisions✔ LESSON LOGGEDClear-eyed and correct. Oluma loves to see it.Ownership makes someone answerable for the risk's management. BFewer risks exist✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Ownership makes someone answerable for the risk's management. CLower salaries✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Ownership makes someone answerable for the risk's management. DMore meetings✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Ownership makes someone answerable for the risk's management. 29/100 Risk Governance & Management Why should risk management be embedded in decision-making rather than run as a separate annual exercise? ADecisions create or change risk daily — risk input belongs at decision time✔ BEARINGS TRUEYou just reasoned like a risk professional.Risk-aware decisions require risk information when choices are made, not months later. BRegulators forbid annual reviews✖ RECALIBRATESmall detour — back on course with this:Risk-aware decisions require risk information when choices are made, not months later. CIt shouldn't be✖ RECALIBRATESmall detour — back on course with this:Risk-aware decisions require risk information when choices are made, not months later. DAnnual is cheaper✖ RECALIBRATESmall detour — back on course with this:Risk-aware decisions require risk information when choices are made, not months later. 30/100 Risk Governance & Management A risk management framework (e.g., based on ISO 31000 or COBIT) provides: AFirewall settings✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Frameworks standardize practice so risk is handled systematically, not ad hoc. BFree software✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Frameworks standardize practice so risk is handled systematically, not ad hoc. CConsistent principles, processes, and vocabulary for managing risk across the organization✔ REGISTER CURRENTThat's the answer a seasoned analyst would give.Frameworks standardize practice so risk is handled systematically, not ad hoc. DLegal immunity✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Frameworks standardize practice so risk is handled systematically, not ad hoc. CHECKPOINT — 30 DOWN, KEEP CLIMBING 31/100 Risk Governance & Management Compliance requirements (laws, regulations, contracts) relate to risk appetite how? AThey replace appetite✖ OFF COURSEAdjust your heading with this insight:Legal duties are non-negotiable boundaries on acceptable risk-taking. BThey are optional inputs✖ OFF COURSEAdjust your heading with this insight:Legal duties are non-negotiable boundaries on acceptable risk-taking. CThey only apply to banks✖ OFF COURSEAdjust your heading with this insight:Legal duties are non-negotiable boundaries on acceptable risk-taking. DThey constrain appetite — obligations must be met regardless of willingness to take risk✔ RISK UNDERSTOODYou're building the foundation every risk career stands on.Legal duties are non-negotiable boundaries on acceptable risk-taking. 32/100 Risk Governance & Management Which structure typically reviews enterprise risk regularly and escalates to the board? AA single developer✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Risk committees provide management-level oversight feeding board governance. BA risk committee✔ COURSE CONFIRMEDSolid fundamentals — that's a future CRISC talking.Risk committees provide management-level oversight feeding board governance. CThe mailroom✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Risk committees provide management-level oversight feeding board governance. DThe cafeteria staff✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Risk committees provide management-level oversight feeding board governance. 33/100 Risk Governance & Management Risk management responsibilities in job descriptions and objectives serve to: APad documents✖ EXPOSURE MISSEDSmall detour — back on course with this:Embedding responsibility into roles operationalizes the governance model. BReduce clarity✖ EXPOSURE MISSEDSmall detour — back on course with this:Embedding responsibility into roles operationalizes the governance model. CSlow hiring✖ EXPOSURE MISSEDSmall detour — back on course with this:Embedding responsibility into roles operationalizes the governance model. DMake accountability real by tying it to performance expectations✔ APPETITE ALIGNEDExactly right. Risk thinking is becoming instinct.Embedding responsibility into roles operationalizes the governance model. 34/100 Risk Governance & Management The main output difference between governance and management of risk is: AManagement sets appetite alone✖ RECALIBRATENo losses in practice. Log the lesson:Direct-and-oversee versus plan-and-execute is the core split. BGovernance writes code✖ RECALIBRATENo losses in practice. Log the lesson:Direct-and-oversee versus plan-and-execute is the core split. CNone — same thing✖ RECALIBRATENo losses in practice. Log the lesson:Direct-and-oversee versus plan-and-execute is the core split. DGovernance produces direction and boundaries; management produces execution: assessments, treatments, and monitoring✔ SCENARIO MAPPEDClear-eyed and correct. Oluma loves to see it.Direct-and-oversee versus plan-and-execute is the core split. 35/100 Risk Identification The goal of risk identification is to: AFix all problems immediately✖ REVIEW THE BASICSAdjust your heading with this insight:You can only manage risks you have found and articulated. BAssign blame✖ REVIEW THE BASICSAdjust your heading with this insight:You can only manage risks you have found and articulated. CDiscover and describe risks before they materialize so they can be assessed and treated✔ IMPACT MEASUREDYou just reasoned like a risk professional.You can only manage risks you have found and articulated. DBuy tools✖ REVIEW THE BASICSAdjust your heading with this insight:You can only manage risks you have found and articulated. 36/100 Risk Identification Which is a common risk identification technique? AWaiting for incidents✖ OFF COURSEFundamentals take reps. Here's the takeaway:Structured workshops surface risks from the people who know the processes. BGuessing annually✖ OFF COURSEFundamentals take reps. Here's the takeaway:Structured workshops surface risks from the people who know the processes. CBrainstorming workshops with business and IT stakeholders✔ RESPONSE CHOSENThat's the answer a seasoned analyst would give.Structured workshops surface risks from the people who know the processes. DIgnoring near-misses✖ OFF COURSEFundamentals take reps. Here's the takeaway:Structured workshops surface risks from the people who know the processes. 37/100 Risk Identification Reviewing past incidents and near-misses supports identification by: AReplacing all other methods✖ RECHECK THE MAPSmall detour — back on course with this:History is evidence: past events highlight real, demonstrated exposure. BRevealing recurring weaknesses and scenarios that have already proven possible✔ INDICATOR GREENYou're building the foundation every risk career stands on.History is evidence: past events highlight real, demonstrated exposure. CReliving failures for fun✖ RECHECK THE MAPSmall detour — back on course with this:History is evidence: past events highlight real, demonstrated exposure. DAssigning blame✖ RECHECK THE MAPSmall detour — back on course with this:History is evidence: past events highlight real, demonstrated exposure. 38/100 Risk Identification An up-to-date asset inventory matters for identification because: AIt sets prices✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:You cannot identify risks to assets you don't know exist. BIt prevents phishing directly✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:You cannot identify risks to assets you don't know exist. CRisks attach to assets — unknown systems and data mean unidentified risk✔ LESSON LOGGEDSolid fundamentals — that's a future CRISC talking.You cannot identify risks to assets you don't know exist. DAuditors love spreadsheets✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:You cannot identify risks to assets you don't know exist. 39/100 Risk Identification A well-written risk scenario connects: ATwo acronyms✖ RECALIBRATEAdjust your heading with this insight:Complete scenarios link cause to consequence, making risks assessable. BA password and a username✖ RECALIBRATEAdjust your heading with this insight:Complete scenarios link cause to consequence, making risks assessable. CA vendor and a discount✖ RECALIBRATEAdjust your heading with this insight:Complete scenarios link cause to consequence, making risks assessable. DA threat, a vulnerability, an asset, and the business impact✔ BEARINGS TRUEExactly right. Risk thinking is becoming instinct.Complete scenarios link cause to consequence, making risks assessable. 40/100 Risk Identification 'Cyber risk' as a single register entry is problematic because: ARegisters only hold five entries✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Actionable identification requires specific, bounded scenarios. BCyber isn't a risk✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Actionable identification requires specific, bounded scenarios. CIt is too broad to assess, own, or treat — it must be decomposed into specific scenarios✔ REGISTER CURRENTClear-eyed and correct. Oluma loves to see it.Actionable identification requires specific, bounded scenarios. DIt is too detailed✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Actionable identification requires specific, bounded scenarios. CHECKPOINT — 40 DOWN, KEEP CLIMBING 41/100 Risk Identification Threat intelligence feeds identification by: AEncrypting data✖ OFF COURSESmall detour — back on course with this:Knowing current adversary behavior helps identify realistic scenarios. BAdvertising products✖ OFF COURSESmall detour — back on course with this:Knowing current adversary behavior helps identify realistic scenarios. CRevealing attacker techniques and campaigns relevant to your industry and technology✔ RISK UNDERSTOODYou just reasoned like a risk professional.Knowing current adversary behavior helps identify realistic scenarios. DReplacing controls✖ OFF COURSESmall detour — back on course with this:Knowing current adversary behavior helps identify realistic scenarios. 42/100 Risk Identification Interviewing business process owners during identification helps because: AThey approve budgets✖ RECHECK THE MAPNo losses in practice. Log the lesson:Process owners see impact pathways that IT staff alone may miss. BThey know process dependencies and what failures would actually disrupt✔ COURSE CONFIRMEDThat's the answer a seasoned analyst would give.Process owners see impact pathways that IT staff alone may miss. CThey write firewall rules✖ RECHECK THE MAPNo losses in practice. Log the lesson:Process owners see impact pathways that IT staff alone may miss. DIt fills calendars✖ RECHECK THE MAPNo losses in practice. Log the lesson:Process owners see impact pathways that IT staff alone may miss. 43/100 Risk Identification Which change should trigger fresh risk identification? AFixing a typo✖ EXPOSURE MISSEDAdjust your heading with this insight:Material change introduces new assets, dependencies, and exposure. BA staff birthday✖ EXPOSURE MISSEDAdjust your heading with this insight:Material change introduces new assets, dependencies, and exposure. CA new office plant✖ EXPOSURE MISSEDAdjust your heading with this insight:Material change introduces new assets, dependencies, and exposure. DAdopting a new cloud service, major system, or business process✔ APPETITE ALIGNEDYou're building the foundation every risk career stands on.Material change introduces new assets, dependencies, and exposure. 44/100 Risk Identification A near-miss (incident with no loss) should be: ACelebrated only✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Near-misses are free lessons about real weaknesses. BDeleted from records✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Near-misses are free lessons about real weaknesses. CCaptured and analyzed as evidence of a risk that nearly materialized✔ SCENARIO MAPPEDSolid fundamentals — that's a future CRISC talking.Near-misses are free lessons about real weaknesses. DIgnored — no harm done✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Near-misses are free lessons about real weaknesses. 45/100 Risk Identification Emerging risk identification looks at: AOnly current problems✖ REVIEW THE BASICSSmall detour — back on course with this:Scanning the horizon lets the organization prepare before risk fully forms. BLast century✖ REVIEW THE BASICSSmall detour — back on course with this:Scanning the horizon lets the organization prepare before risk fully forms. CSolved issues✖ REVIEW THE BASICSSmall detour — back on course with this:Scanning the horizon lets the organization prepare before risk fully forms. DDeveloping trends — new technologies, threats, and regulations that may create future exposure✔ IMPACT MEASUREDExactly right. Risk thinking is becoming instinct.Scanning the horizon lets the organization prepare before risk fully forms. 46/100 Risk Identification Shadow IT complicates identification because: AIt is always compliant✖ OFF COURSENo losses in practice. Log the lesson:Unknown services are unidentified risk carriers. BUnsanctioned tools hold data and access outside the inventory and assessment process✔ RESPONSE CHOSENClear-eyed and correct. Oluma loves to see it.Unknown services are unidentified risk carriers. CIt reduces spending✖ OFF COURSENo losses in practice. Log the lesson:Unknown services are unidentified risk carriers. DIt improves visibility✖ OFF COURSENo losses in practice. Log the lesson:Unknown services are unidentified risk carriers. 47/100 Risk Identification Vulnerability scanning contributes to identification by: ABlocking attackers✖ RECHECK THE MAPAdjust your heading with this insight:Scans surface exploitable conditions — raw material for risk scenarios. BFixing weaknesses automatically✖ RECHECK THE MAPAdjust your heading with this insight:Scans surface exploitable conditions — raw material for risk scenarios. CReplacing risk registers✖ RECHECK THE MAPAdjust your heading with this insight:Scans surface exploitable conditions — raw material for risk scenarios. DDiscovering technical weaknesses that could become risk scenarios when paired with threats✔ INDICATOR GREENYou just reasoned like a risk professional.Scans surface exploitable conditions — raw material for risk scenarios. 48/100 Risk Identification Dependency mapping (systems, vendors, data flows) helps identify: AEmail signatures✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Understanding dependencies reveals where one failure cascades. BParking issues✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Understanding dependencies reveals where one failure cascades. CSingle points of failure and third-party exposure that could disrupt business processes✔ LESSON LOGGEDThat's the answer a seasoned analyst would give.Understanding dependencies reveals where one failure cascades. DFont conflicts✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Understanding dependencies reveals where one failure cascades. 49/100 Risk Identification Who should participate in risk identification? AOnly executives✖ RECALIBRATESmall detour — back on course with this:Diverse perspectives catch risks any single group would miss. BOnly auditors✖ RECALIBRATESmall detour — back on course with this:Diverse perspectives catch risks any single group would miss. COnly the risk team✖ RECALIBRATESmall detour — back on course with this:Diverse perspectives catch risks any single group would miss. DA cross-section: business owners, IT, security, legal, and others with relevant knowledge✔ BEARINGS TRUEYou're building the foundation every risk career stands on.Diverse perspectives catch risks any single group would miss. 50/100 Risk Identification The output of identification is typically recorded in: AA chat message✖ REVIEW THE BASICSNo losses in practice. Log the lesson:The register is the system of record feeding assessment and treatment. BThe risk register with scenario descriptions and provisional owners✔ REGISTER CURRENTSolid fundamentals — that's a future CRISC talking.The register is the system of record feeding assessment and treatment. CA private notebook✖ REVIEW THE BASICSNo losses in practice. Log the lesson:The register is the system of record feeding assessment and treatment. DNowhere✖ REVIEW THE BASICSNo losses in practice. Log the lesson:The register is the system of record feeding assessment and treatment. CHECKPOINT — 50 DOWN, KEEP CLIMBING 51/100 Risk Identification Which is an example of a project-related IT risk to identify? AA completed milestone✖ OFF COURSEAdjust your heading with this insight:Change initiatives carry delivery and disruption risk worth identifying early. BA team lunch✖ OFF COURSEAdjust your heading with this insight:Change initiatives carry delivery and disruption risk worth identifying early. CA signed contract✖ OFF COURSEAdjust your heading with this insight:Change initiatives carry delivery and disruption risk worth identifying early. DA critical system migration that could fail, overrun, or disrupt operations at cutover✔ RISK UNDERSTOODExactly right. Risk thinking is becoming instinct.Change initiatives carry delivery and disruption risk worth identifying early. 52/100 Risk Assessment & Analysis Risk assessment determines: AMarketing budgets✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Assessment turns a list of risks into a prioritized, decision-ready picture. BWho is fired✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Assessment turns a list of risks into a prioritized, decision-ready picture. CThe significance of identified risks — usually via likelihood and impact — to support prioritization✔ COURSE CONFIRMEDClear-eyed and correct. Oluma loves to see it.Assessment turns a list of risks into a prioritized, decision-ready picture. DSalaries✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Assessment turns a list of risks into a prioritized, decision-ready picture. 53/100 Risk Assessment & Analysis Qualitative assessment uses: ADescriptive scales (e.g., High/Medium/Low) and expert judgment✔ APPETITE ALIGNEDYou just reasoned like a risk professional.Qualitative methods rate risks with scales rather than calculated currency values. BMonte Carlo only✖ EXPOSURE MISSEDSmall detour — back on course with this:Qualitative methods rate risks with scales rather than calculated currency values. CStock prices✖ EXPOSURE MISSEDSmall detour — back on course with this:Qualitative methods rate risks with scales rather than calculated currency values. DMonetary formulas only✖ EXPOSURE MISSEDSmall detour — back on course with this:Qualitative methods rate risks with scales rather than calculated currency values. 54/100 Risk Assessment & Analysis Quantitative assessment expresses risk in: AAdjectives✖ RECALIBRATENo losses in practice. Log the lesson:Quantitative analysis calculates values like SLE, ARO, and ALE. BColors✖ RECALIBRATENo losses in practice. Log the lesson:Quantitative analysis calculates values like SLE, ARO, and ALE. CEmojis✖ RECALIBRATENo losses in practice. Log the lesson:Quantitative analysis calculates values like SLE, ARO, and ALE. DNumeric terms — typically expected monetary loss✔ SCENARIO MAPPEDThat's the answer a seasoned analyst would give.Quantitative analysis calculates values like SLE, ARO, and ALE. 55/100 Risk Assessment & Analysis An asset worth $500,000 would lose 40% of its value in a specific incident. The SLE is: A$500,000✖ REVIEW THE BASICSAdjust your heading with this insight:SLE = asset value × exposure factor = $500,000 × 0.40 = $200,000. B$200,000✔ IMPACT MEASUREDYou're building the foundation every risk career stands on.SLE = asset value × exposure factor = $500,000 × 0.40 = $200,000. C$125,000✖ REVIEW THE BASICSAdjust your heading with this insight:SLE = asset value × exposure factor = $500,000 × 0.40 = $200,000. D$40,000✖ REVIEW THE BASICSAdjust your heading with this insight:SLE = asset value × exposure factor = $500,000 × 0.40 = $200,000. 56/100 Risk Assessment & Analysis If SLE is $200,000 and the event is expected once every 5 years (ARO 0.2), the ALE is: A$4,000✖ OFF COURSEFundamentals take reps. Here's the takeaway:ALE = SLE × ARO = $200,000 × 0.2 = $40,000 per year. B$40,000✔ RESPONSE CHOSENSolid fundamentals — that's a future CRISC talking.ALE = SLE × ARO = $200,000 × 0.2 = $40,000 per year. C$1,000,000✖ OFF COURSEFundamentals take reps. Here's the takeaway:ALE = SLE × ARO = $200,000 × 0.2 = $40,000 per year. D$200,000✖ OFF COURSEFundamentals take reps. Here's the takeaway:ALE = SLE × ARO = $200,000 × 0.2 = $40,000 per year. 57/100 Risk Assessment & Analysis ALE is most useful for: AComparing annualized risk cost against the cost of controls✔ INDICATOR GREENExactly right. Risk thinking is becoming instinct.Annualized figures support cost-benefit decisions about treatment. BSetting passwords✖ RECHECK THE MAPSmall detour — back on course with this:Annualized figures support cost-benefit decisions about treatment. CNaming servers✖ RECHECK THE MAPSmall detour — back on course with this:Annualized figures support cost-benefit decisions about treatment. DScheduling meetings✖ RECHECK THE MAPSmall detour — back on course with this:Annualized figures support cost-benefit decisions about treatment. 58/100 Risk Assessment & Analysis Inherent risk is assessed: ANever✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Inherent risk sets the baseline; controls reduce it to residual. BAfter all controls✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Inherent risk sets the baseline; controls reduce it to residual. COnly by vendors✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Inherent risk sets the baseline; controls reduce it to residual. DBefore considering controls — the raw exposure✔ LESSON LOGGEDClear-eyed and correct. Oluma loves to see it.Inherent risk sets the baseline; controls reduce it to residual. 59/100 Risk Assessment & Analysis Residual risk is: ARisk before controls✖ RECALIBRATEAdjust your heading with this insight:Residual risk is what the organization actually lives with — compared against appetite. BA type of audit✖ RECALIBRATEAdjust your heading with this insight:Residual risk is what the organization actually lives with — compared against appetite. CThe risk remaining after controls are applied✔ BEARINGS TRUEYou just reasoned like a risk professional.Residual risk is what the organization actually lives with — compared against appetite. DAlways zero✖ RECALIBRATEAdjust your heading with this insight:Residual risk is what the organization actually lives with — compared against appetite. 60/100 Risk Assessment & Analysis A heat map plots risks by: ALikelihood and impact✔ REGISTER CURRENTThat's the answer a seasoned analyst would give.The two classic assessment dimensions form the map's axes. BTeam and office✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:The two classic assessment dimensions form the map's axes. CAge and owner✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:The two classic assessment dimensions form the map's axes. DCost and vendor✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:The two classic assessment dimensions form the map's axes. CHECKPOINT — 60 DOWN, KEEP CLIMBING 61/100 Risk Assessment & Analysis A risk rated low-likelihood but catastrophic-impact should be: AEvaluated against appetite — severe tail risks may still demand treatment✔ RISK UNDERSTOODYou're building the foundation every risk career stands on.Impact-heavy risks can be unacceptable even when unlikely. BAveraged away✖ OFF COURSESmall detour — back on course with this:Impact-heavy risks can be unacceptable even when unlikely. CDeleted✖ OFF COURSESmall detour — back on course with this:Impact-heavy risks can be unacceptable even when unlikely. DAutomatically ignored✖ OFF COURSESmall detour — back on course with this:Impact-heavy risks can be unacceptable even when unlikely. 62/100 Risk Assessment & Analysis Why do qualitative ratings need defined criteria (what 'High' means)? AFonts vary✖ RECHECK THE MAPNo losses in practice. Log the lesson:Shared definitions make judgment repeatable instead of arbitrary. BSo ratings are consistent and comparable across assessors and time✔ COURSE CONFIRMEDSolid fundamentals — that's a future CRISC talking.Shared definitions make judgment repeatable instead of arbitrary. CTo lengthen documents✖ RECHECK THE MAPNo losses in practice. Log the lesson:Shared definitions make judgment repeatable instead of arbitrary. DCriteria are decorative✖ RECHECK THE MAPNo losses in practice. Log the lesson:Shared definitions make judgment repeatable instead of arbitrary. 63/100 Risk Assessment & Analysis Control effectiveness influences assessment because: AControls are irrelevant✖ EXPOSURE MISSEDAdjust your heading with this insight:Real mitigation depends on controls actually operating as intended. BEffectiveness is unmeasurable✖ EXPOSURE MISSEDAdjust your heading with this insight:Real mitigation depends on controls actually operating as intended. CWeak or failing controls mean residual risk is higher than the paper design suggests✔ APPETITE ALIGNEDExactly right. Risk thinking is becoming instinct.Real mitigation depends on controls actually operating as intended. DControls only affect budgets✖ EXPOSURE MISSEDAdjust your heading with this insight:Real mitigation depends on controls actually operating as intended. 64/100 Risk Assessment & Analysis A business impact analysis (BIA) primarily identifies: AServer brands✖ RECALIBRATEFundamentals take reps. Here's the takeaway:BIA grounds availability-related assessment and recovery objectives (RTO/RPO). BSalary bands✖ RECALIBRATEFundamentals take reps. Here's the takeaway:BIA grounds availability-related assessment and recovery objectives (RTO/RPO). CCritical processes and the consequences of their disruption over time✔ SCENARIO MAPPEDClear-eyed and correct. Oluma loves to see it.BIA grounds availability-related assessment and recovery objectives (RTO/RPO). DMarketing slogans✖ RECALIBRATEFundamentals take reps. Here's the takeaway:BIA grounds availability-related assessment and recovery objectives (RTO/RPO). 65/100 Risk Assessment & Analysis Which factor increases the likelihood of a risk scenario? AStrong compensating controls✖ REVIEW THE BASICSSmall detour — back on course with this:Likelihood grows when capable threats meet accessible weaknesses. BEffective patching✖ REVIEW THE BASICSSmall detour — back on course with this:Likelihood grows when capable threats meet accessible weaknesses. CNetwork segmentation✖ REVIEW THE BASICSSmall detour — back on course with this:Likelihood grows when capable threats meet accessible weaknesses. DAn active threat, high exposure, and an exploitable vulnerability✔ IMPACT MEASUREDYou just reasoned like a risk professional.Likelihood grows when capable threats meet accessible weaknesses. 66/100 Risk Assessment & Analysis Assessments should be repeated when: AOnly after a breach✖ OFF COURSENo losses in practice. Log the lesson:Risk moves; stale assessments misinform decisions. BThe register is full✖ OFF COURSENo losses in practice. Log the lesson:Risk moves; stale assessments misinform decisions. CSignificant change occurs or periodically as threats and business conditions evolve✔ RESPONSE CHOSENThat's the answer a seasoned analyst would give.Risk moves; stale assessments misinform decisions. DNever✖ OFF COURSENo losses in practice. Log the lesson:Risk moves; stale assessments misinform decisions. 67/100 Risk Assessment & Analysis Single-point estimates ('this will cost exactly $1M') can mislead because: AEstimates are always right✖ RECHECK THE MAPAdjust your heading with this insight:Expressing uncertainty prevents false precision from driving bad decisions. BNumbers are evil✖ RECHECK THE MAPAdjust your heading with this insight:Expressing uncertainty prevents false precision from driving bad decisions. CExecutives prefer decimals✖ RECHECK THE MAPAdjust your heading with this insight:Expressing uncertainty prevents false precision from driving bad decisions. DThey hide uncertainty — ranges or scenarios represent possible outcomes more honestly✔ INDICATOR GREENYou're building the foundation every risk career stands on.Expressing uncertainty prevents false precision from driving bad decisions. 68/100 Risk Assessment & Analysis The primary output of assessment is: AA new logo✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Assessment ends with prioritization that response planning consumes. BA firewall rule✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Assessment ends with prioritization that response planning consumes. CA prioritized view of risks with ratings that inform response decisions✔ LESSON LOGGEDSolid fundamentals — that's a future CRISC talking.Assessment ends with prioritization that response planning consumes. DA press release✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:Assessment ends with prioritization that response planning consumes. 69/100 Risk Response The four classic risk response options are: AAccept, avoid, mitigate, transfer✔ BEARINGS TRUEExactly right. Risk thinking is becoming instinct.Treatment choices: accept, avoid, mitigate (reduce), transfer (share). BLog, alert, block, report✖ RECALIBRATESmall detour — back on course with this:Treatment choices: accept, avoid, mitigate (reduce), transfer (share). CDeny, delay, defer, delete✖ RECALIBRATESmall detour — back on course with this:Treatment choices: accept, avoid, mitigate (reduce), transfer (share). DPlan, do, check, act✖ RECALIBRATESmall detour — back on course with this:Treatment choices: accept, avoid, mitigate (reduce), transfer (share). 70/100 Risk Response Implementing MFA to reduce account compromise likelihood is: AMitigation✔ REGISTER CURRENTClear-eyed and correct. Oluma loves to see it.Controls that reduce likelihood or impact are mitigation. BAcceptance✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Controls that reduce likelihood or impact are mitigation. CTransfer✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Controls that reduce likelihood or impact are mitigation. DAvoidance✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Controls that reduce likelihood or impact are mitigation. CHECKPOINT — 70 DOWN, KEEP CLIMBING 71/100 Risk Response Cancelling a project because its risk exceeds its value is: AAvoidance✔ RISK UNDERSTOODYou just reasoned like a risk professional.Avoidance eliminates exposure by not doing the risky thing. BMitigation✖ OFF COURSEAdjust your heading with this insight:Avoidance eliminates exposure by not doing the risky thing. CTransfer✖ OFF COURSEAdjust your heading with this insight:Avoidance eliminates exposure by not doing the risky thing. DAcceptance✖ OFF COURSEAdjust your heading with this insight:Avoidance eliminates exposure by not doing the risky thing. 72/100 Risk Response Purchasing cyber insurance is: ATransfer / sharing✔ COURSE CONFIRMEDThat's the answer a seasoned analyst would give.Insurance shifts part of the financial consequence to another party. BAcceptance✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Insurance shifts part of the financial consequence to another party. CMitigation✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Insurance shifts part of the financial consequence to another party. DAvoidance✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Insurance shifts part of the financial consequence to another party. 73/100 Risk Response Documenting a decision to live with a minor risk is: AAcceptance✔ APPETITE ALIGNEDYou're building the foundation every risk career stands on.Acceptance is a conscious, recorded decision to retain risk within appetite. BTransfer✖ EXPOSURE MISSEDSmall detour — back on course with this:Acceptance is a conscious, recorded decision to retain risk within appetite. CAvoidance✖ EXPOSURE MISSEDSmall detour — back on course with this:Acceptance is a conscious, recorded decision to retain risk within appetite. DMitigation✖ EXPOSURE MISSEDSmall detour — back on course with this:Acceptance is a conscious, recorded decision to retain risk within appetite. 74/100 Risk Response Risk acceptance should be made by: AAn outside vendor✖ RECALIBRATENo losses in practice. Log the lesson:Acceptance authority must match the potential impact being retained. BThe newest hire✖ RECALIBRATENo losses in practice. Log the lesson:Acceptance authority must match the potential impact being retained. CAn owner with authority appropriate to the risk's size✔ SCENARIO MAPPEDSolid fundamentals — that's a future CRISC talking.Acceptance authority must match the potential impact being retained. DAnyone available✖ RECALIBRATENo losses in practice. Log the lesson:Acceptance authority must match the potential impact being retained. 75/100 Risk Response After outsourcing a process, accountability for its risks: ARemains with the organization even though activities transferred✔ IMPACT MEASUREDExactly right. Risk thinking is becoming instinct.You can delegate work, not accountability to customers and regulators. BDisappears✖ REVIEW THE BASICSAdjust your heading with this insight:You can delegate work, not accountability to customers and regulators. CBelongs to the regulator✖ REVIEW THE BASICSAdjust your heading with this insight:You can delegate work, not accountability to customers and regulators. DMoves entirely to the vendor✖ REVIEW THE BASICSAdjust your heading with this insight:You can delegate work, not accountability to customers and regulators. 76/100 Risk Response A control costing $300k/year that prevents $50k/year of expected loss is: AA bargain✖ OFF COURSEFundamentals take reps. Here's the takeaway:Cost-benefit analysis keeps treatment proportionate to exposure. BMandatory✖ OFF COURSEFundamentals take reps. Here's the takeaway:Cost-benefit analysis keeps treatment proportionate to exposure. CDisproportionate — response cost should be weighed against risk reduction✔ RESPONSE CHOSENClear-eyed and correct. Oluma loves to see it.Cost-benefit analysis keeps treatment proportionate to exposure. DFree✖ OFF COURSEFundamentals take reps. Here's the takeaway:Cost-benefit analysis keeps treatment proportionate to exposure. 77/100 Risk Response When residual risk still exceeds appetite after treatment, the organization should: ADeclare success✖ RECHECK THE MAPSmall detour — back on course with this:Above-appetite residual risk demands more action or a deliberate, authorized acceptance. BRedefine math✖ RECHECK THE MAPSmall detour — back on course with this:Above-appetite residual risk demands more action or a deliberate, authorized acceptance. CApply further treatment or escalate for explicit senior acceptance✔ INDICATOR GREENYou just reasoned like a risk professional.Above-appetite residual risk demands more action or a deliberate, authorized acceptance. DHide the result✖ RECHECK THE MAPSmall detour — back on course with this:Above-appetite residual risk demands more action or a deliberate, authorized acceptance. 78/100 Risk Response Combining responses (mitigate + transfer + accept the remainder) is: ACommon and sensible for significant risks✔ LESSON LOGGEDThat's the answer a seasoned analyst would give.Layered treatment tailors each portion of the risk to the best-fit response. BForbidden✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Layered treatment tailors each portion of the risk to the best-fit response. COnly for small firms✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Layered treatment tailors each portion of the risk to the best-fit response. DRandom✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Layered treatment tailors each portion of the risk to the best-fit response. 79/100 Risk Response An action plan for mitigation should include: AA named owner, actions, resources, and target dates✔ BEARINGS TRUEYou're building the foundation every risk career stands on.Executable plans have accountability, steps, means, and deadlines. BOnly a budget code✖ RECALIBRATEAdjust your heading with this insight:Executable plans have accountability, steps, means, and deadlines. CNothing written✖ RECALIBRATEAdjust your heading with this insight:Executable plans have accountability, steps, means, and deadlines. DVague hopes✖ RECALIBRATEAdjust your heading with this insight:Executable plans have accountability, steps, means, and deadlines. 80/100 Risk Response A compensating control is used when: ARisk is zero✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Compensating controls deliver comparable risk reduction by another route. BAuditors are absent✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Compensating controls deliver comparable risk reduction by another route. CNothing else exists to do✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Compensating controls deliver comparable risk reduction by another route. DThe preferred control is infeasible, so an alternative achieving similar protection is applied✔ REGISTER CURRENTSolid fundamentals — that's a future CRISC talking.Compensating controls deliver comparable risk reduction by another route. CHECKPOINT — 80 DOWN, KEEP CLIMBING 81/100 Risk Response Ignoring a known risk without a decision differs from acceptance because: AIgnoring is cheaper and fine✖ OFF COURSESmall detour — back on course with this:Unconscious risk retention bypasses governance — the opposite of managed acceptance. BThey are identical✖ OFF COURSESmall detour — back on course with this:Unconscious risk retention bypasses governance — the opposite of managed acceptance. CAcceptance is illegal✖ OFF COURSESmall detour — back on course with this:Unconscious risk retention bypasses governance — the opposite of managed acceptance. DAcceptance is informed, authorized, and documented; ignoring is unmanaged exposure✔ RISK UNDERSTOODExactly right. Risk thinking is becoming instinct.Unconscious risk retention bypasses governance — the opposite of managed acceptance. 82/100 Risk Response Accepting a risk that violates a legal requirement is: AStandard practice✖ RECHECK THE MAPNo losses in practice. Log the lesson:Legal duties constrain response choices; noncompliance can't be 'accepted.' BThe regulator's problem✖ RECHECK THE MAPNo losses in practice. Log the lesson:Legal duties constrain response choices; noncompliance can't be 'accepted.' CA valid business choice✖ RECHECK THE MAPNo losses in practice. Log the lesson:Legal duties constrain response choices; noncompliance can't be 'accepted.' DNot a legitimate option — compliance obligations must be met✔ COURSE CONFIRMEDClear-eyed and correct. Oluma loves to see it.Legal duties constrain response choices; noncompliance can't be 'accepted.' 83/100 Risk Response After implementing a response, the organization should: ADelete the register entry✖ EXPOSURE MISSEDAdjust your heading with this insight:Validation confirms the treatment achieved the intended reduction. BVerify the control operates effectively and reassess residual risk✔ APPETITE ALIGNEDYou just reasoned like a risk professional.Validation confirms the treatment achieved the intended reduction. CStop monitoring✖ EXPOSURE MISSEDAdjust your heading with this insight:Validation confirms the treatment achieved the intended reduction. DAssume it works forever✖ EXPOSURE MISSEDAdjust your heading with this insight:Validation confirms the treatment achieved the intended reduction. 84/100 Risk Response Risk avoidance has a hidden cost when: AIt never does✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Over-avoidance trades away benefit; response choice should weigh opportunity, not just danger. BValue is irrelevant✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Over-avoidance trades away benefit; response choice should weigh opportunity, not just danger. CThe avoided activity would have created significant value — excessive avoidance sacrifices opportunity✔ SCENARIO MAPPEDThat's the answer a seasoned analyst would give.Over-avoidance trades away benefit; response choice should weigh opportunity, not just danger. DAvoidance is free✖ RECALIBRATEFundamentals take reps. Here's the takeaway:Over-avoidance trades away benefit; response choice should weigh opportunity, not just danger. 85/100 Risk Monitoring & Reporting The purpose of risk monitoring is to: AClose the risk program✖ REVIEW THE BASICSSmall detour — back on course with this:Monitoring keeps the risk picture current between formal assessments. BCreate paperwork✖ REVIEW THE BASICSSmall detour — back on course with this:Monitoring keeps the risk picture current between formal assessments. CTrack whether risk levels, controls, and treatments remain effective as conditions change✔ IMPACT MEASUREDYou're building the foundation every risk career stands on.Monitoring keeps the risk picture current between formal assessments. DReplace assessments✖ REVIEW THE BASICSSmall detour — back on course with this:Monitoring keeps the risk picture current between formal assessments. 86/100 Risk Monitoring & Reporting A Key Risk Indicator (KRI) provides: AA firewall rule✖ OFF COURSENo losses in practice. Log the lesson:KRIs are forward-looking metrics tied to risk drivers. BAn org chart✖ OFF COURSENo losses in practice. Log the lesson:KRIs are forward-looking metrics tied to risk drivers. CEarly warning that exposure to a specific risk is changing✔ RESPONSE CHOSENSolid fundamentals — that's a future CRISC talking.KRIs are forward-looking metrics tied to risk drivers. DA password✖ OFF COURSENo losses in practice. Log the lesson:KRIs are forward-looking metrics tied to risk drivers. 87/100 Risk Monitoring & Reporting Which is a reasonable KRI for phishing risk? ATrend in employees clicking simulated phishing links✔ INDICATOR GREENExactly right. Risk thinking is becoming instinct.Click-rate trends signal changing human-layer exposure. BPrinter ink levels✖ RECHECK THE MAPAdjust your heading with this insight:Click-rate trends signal changing human-layer exposure. CHoliday count✖ RECHECK THE MAPAdjust your heading with this insight:Click-rate trends signal changing human-layer exposure. DNumber of desks✖ RECHECK THE MAPAdjust your heading with this insight:Click-rate trends signal changing human-layer exposure. 88/100 Risk Monitoring & Reporting A KRI differs from a KPI in that a KRI measures: AEmployee satisfaction only✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:KPIs track performance; KRIs track risk signals. BRevenue only✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:KPIs track performance; KRIs track risk signals. CChanging risk exposure / early warning of potential problems✔ LESSON LOGGEDClear-eyed and correct. Oluma loves to see it.KPIs track performance; KRIs track risk signals. DAchievement of performance goals✖ EXPOSURE MISSEDFundamentals take reps. Here's the takeaway:KPIs track performance; KRIs track risk signals. 89/100 Risk Monitoring & Reporting KRIs need thresholds because: AColors look nice✖ RECALIBRATESmall detour — back on course with this:An indicator without an action trigger is just a chart. BAuditors count them✖ RECALIBRATESmall detour — back on course with this:An indicator without an action trigger is just a chart. CMetrics expire✖ RECALIBRATESmall detour — back on course with this:An indicator without an action trigger is just a chart. DThresholds define when escalation and action are triggered✔ BEARINGS TRUEYou just reasoned like a risk professional.An indicator without an action trigger is just a chart. 90/100 Risk Monitoring & Reporting A KRI breaches its threshold and nothing happens for months. The failure is in: AThe response process — monitoring must connect to accountable action✔ REGISTER CURRENTThat's the answer a seasoned analyst would give.Monitoring without response is theater; escalation paths must work. BThe threshold being too visible✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Monitoring without response is theater; escalation paths must work. CNothing✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Monitoring without response is theater; escalation paths must work. DThe metric's font✖ REVIEW THE BASICSNo losses in practice. Log the lesson:Monitoring without response is theater; escalation paths must work. CHECKPOINT — 90 DOWN, KEEP CLIMBING 91/100 Risk Monitoring & Reporting The risk register during the monitoring phase should be: AFrozen after creation✖ OFF COURSEAdjust your heading with this insight:A current register is the backbone of meaningful reporting. BPrivate to one person✖ OFF COURSEAdjust your heading with this insight:A current register is the backbone of meaningful reporting. CDeleted annually✖ OFF COURSEAdjust your heading with this insight:A current register is the backbone of meaningful reporting. DA living record — updated as treatments progress, risks change, and new risks appear✔ RISK UNDERSTOODYou're building the foundation every risk career stands on.A current register is the backbone of meaningful reporting. 92/100 Risk Monitoring & Reporting Risk reporting to senior leadership should be framed in: ARiddles✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Executives act on business meaning, not packet captures. BDeep technical jargon✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Executives act on business meaning, not packet captures. CRaw log files✖ RECHECK THE MAPFundamentals take reps. Here's the takeaway:Executives act on business meaning, not packet captures. DBusiness terms — impact on objectives, trends, and decisions needed✔ COURSE CONFIRMEDSolid fundamentals — that's a future CRISC talking.Executives act on business meaning, not packet captures. 93/100 Risk Monitoring & Reporting Trend information in risk reports matters because: ADirection shows whether exposure is improving or worsening and whether treatments work✔ APPETITE ALIGNEDExactly right. Risk thinking is becoming instinct.A snapshot without trajectory hides whether things are getting better or worse. BIt fills slides✖ EXPOSURE MISSEDSmall detour — back on course with this:A snapshot without trajectory hides whether things are getting better or worse. CTrends are decorative✖ EXPOSURE MISSEDSmall detour — back on course with this:A snapshot without trajectory hides whether things are getting better or worse. DStatus is always sufficient✖ EXPOSURE MISSEDSmall detour — back on course with this:A snapshot without trajectory hides whether things are getting better or worse. 94/100 Risk Monitoring & Reporting An out-of-cycle (immediate) risk report is warranted when: ANothing changes✖ RECALIBRATENo losses in practice. Log the lesson:Material changes can't wait for the scheduled deck. BThe quarter ends✖ RECALIBRATENo losses in practice. Log the lesson:Material changes can't wait for the scheduled deck. CA printer jams✖ RECALIBRATENo losses in practice. Log the lesson:Material changes can't wait for the scheduled deck. DA material event occurs — major incident, KRI breach, or significant new threat✔ SCENARIO MAPPEDClear-eyed and correct. Oluma loves to see it.Material changes can't wait for the scheduled deck. 95/100 Risk Monitoring & Reporting Monitoring control effectiveness means: AReading vendor brochures✖ REVIEW THE BASICSAdjust your heading with this insight:Controls decay; periodic verification keeps residual-risk estimates honest. BCounting controls✖ REVIEW THE BASICSAdjust your heading with this insight:Controls decay; periodic verification keeps residual-risk estimates honest. CAssuming controls work✖ REVIEW THE BASICSAdjust your heading with this insight:Controls decay; periodic verification keeps residual-risk estimates honest. DTesting and observing whether controls operate as designed over time✔ IMPACT MEASUREDYou just reasoned like a risk professional.Controls decay; periodic verification keeps residual-risk estimates honest. 96/100 Risk Monitoring & Reporting Lessons from incidents should feed monitoring and reporting by: AUpdating risk ratings, revealing control gaps, and improving KRIs✔ RESPONSE CHOSENThat's the answer a seasoned analyst would give.Incidents are ground truth that recalibrates the risk picture. BAssigning blame only✖ OFF COURSEFundamentals take reps. Here's the takeaway:Incidents are ground truth that recalibrates the risk picture. CClosing the register✖ OFF COURSEFundamentals take reps. Here's the takeaway:Incidents are ground truth that recalibrates the risk picture. DBeing forgotten✖ OFF COURSEFundamentals take reps. Here's the takeaway:Incidents are ground truth that recalibrates the risk picture. 97/100 Risk Monitoring & Reporting Reporting that shows only successes and hides worsening risks causes: ABetter morale forever✖ RECHECK THE MAPSmall detour — back on course with this:Honest reporting is the whole point; filtered good news breaks governance. BLeadership decisions based on a false picture — the core failure of risk reporting✔ INDICATOR GREENYou're building the foundation every risk career stands on.Honest reporting is the whole point; filtered good news breaks governance. CFaster audits✖ RECHECK THE MAPSmall detour — back on course with this:Honest reporting is the whole point; filtered good news breaks governance. DNothing✖ RECHECK THE MAPSmall detour — back on course with this:Honest reporting is the whole point; filtered good news breaks governance. 98/100 Risk Monitoring & Reporting Who consumes risk reports? ANobody✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Reporting is tiered: detail for operators, aggregated insight for governance. BOnly regulators✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Reporting is tiered: detail for operators, aggregated insight for governance. CMultiple audiences — operational owners, management, committees, and the board — each needing appropriate detail✔ LESSON LOGGEDSolid fundamentals — that's a future CRISC talking.Reporting is tiered: detail for operators, aggregated insight for governance. DOnly auditors✖ EXPOSURE MISSEDNo losses in practice. Log the lesson:Reporting is tiered: detail for operators, aggregated insight for governance. 99/100 Risk Monitoring & Reporting Continuous monitoring tools (dashboards fed by scans, logs, and configs) add value by: AProviding timely, consistent risk-state data at a scale manual checks cannot match✔ BEARINGS TRUEExactly right. Risk thinking is becoming instinct.Automation enables the currency and coverage that periodic manual checks lack. BEliminating human judgment✖ RECALIBRATEAdjust your heading with this insight:Automation enables the currency and coverage that periodic manual checks lack. CReplacing governance✖ RECALIBRATEAdjust your heading with this insight:Automation enables the currency and coverage that periodic manual checks lack. DLooking modern✖ RECALIBRATEAdjust your heading with this insight:Automation enables the currency and coverage that periodic manual checks lack. 100/100 Risk Monitoring & Reporting The risk management lifecycle is circular because: ACircles are elegant✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Risk management is continuous: monitor, learn, reassess, re-treat. BIt ends after response✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Risk management is continuous: monitor, learn, reassess, re-treat. CRegulators require circles✖ REVIEW THE BASICSFundamentals take reps. Here's the takeaway:Risk management is continuous: monitor, learn, reassess, re-treat. DMonitoring findings feed back into identification and assessment as conditions change✔ REGISTER CURRENTClear-eyed and correct. Oluma loves to see it.Risk management is continuous: monitor, learn, reassess, re-treat. JOURNEY COMPLETE — FUNDAMENTALS LOCKED INEvery expert was once a beginner who kept practicing. Oluma is proud to walk this road with you. RISKS MANAGED REVIEWED These are original practice questions written for the Oluma community. IT Risk Fundamentals™ is a certificate program of ISACA. Oluma is not affiliated with or endorsed by ISACA. No official exam content is reproduced here.