I85PREP
⌘ K
III IC-86 study materials
III IC-86 study resources

III IC-86 practice questions

One question at a time. Build your III IC-86 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management

In risk management practice, a risk is best described as which combination?

  1. The probability of an event and the magnitude of its consequence Correct answer.
  2. The cost of a control and the schedule needed to deploy it
  3. The number of audit findings and the time to remediate them
  4. The value of an asset and the depreciation applied to it

Explanation

Risk is conventionally defined as a function of the likelihood that a threat exploits a vulnerability and the resulting impact on the organization. Controls reduce one or both components, but they are not themselves the definition of risk. Asset value and audit findings may feed the calculation but do not define it.

Question 2Risk Management

A team computes inherent risk, applies a set of controls, and then computes residual risk. Which statement correctly describes the relationship between these two values?

  1. Inherent risk is measured only after controls have been validated by audit
  2. Residual risk always equals inherent risk regardless of control performance
  3. Residual risk is the risk that remains after the asset is retired
  4. Residual risk is normally lower than inherent risk when controls are effective Correct answer.

Explanation

Inherent risk is assessed before controls are considered, while residual risk reflects the exposure remaining once controls operate. Effective controls therefore reduce residual risk below the inherent level. If controls are ineffective, residual risk can remain close to inherent risk.

Question 3Risk Management

An organization decides to purchase cyber insurance to transfer part of its financial exposure. Which risk treatment category does this represent?

  1. Risk mitigation
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk avoidance

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, and insurance is the classic example. Avoidance eliminates the activity, acceptance retains the exposure, and mitigation reduces likelihood or impact through controls. Insurance may accompany mitigation but does not itself reduce the frequency of the event.

Question 4Risk Management

Which formula expresses annualized loss expectancy (ALE) in quantitative risk analysis?

  1. ALE = asset value ÷ annualized rate of occurrence
  2. ALE = single loss expectancy × annualized rate of occurrence Correct answer.
  3. ALE = single loss expectancy + exposure factor
  4. ALE = exposure factor × annualized rate of occurrence

Explanation

Single loss expectancy is the loss from one event, and the annualized rate of occurrence estimates how often that event happens per year. Multiplying them yields the expected annual loss. Exposure factor is used earlier, to derive single loss expectancy from asset value.

Question 5Risk Management

A risk register entry lists likelihood as 'high' and impact as 'medium'. Which characteristic of this assessment should be documented alongside the rating?

  1. The complete network diagram of the affected business unit
  2. The vendor price list for every control considered during the assessment
  3. The names of all employees who have access to the risk register
  4. The qualitative scale definitions and the rationale used to assign each rating Correct answer.

Explanation

Qualitative ratings are only meaningful when the scale definitions and the reasoning behind each assignment are recorded, so that later reviewers can reproduce the judgment. Without documented criteria, ratings become subjective and inconsistent across assessments. Supporting artifacts may be referenced but are not the core requirement.

Question 6Risk Management

During risk identification for a new payment platform, which approach best reduces the chance that significant risks are overlooked?

  1. Combine structured techniques such as threat modeling, asset inventories, and facilitated workshops Correct answer.
  2. Limit the assessment to technical vulnerabilities reported by scanners
  3. Rely solely on the project manager's prior experience with similar projects
  4. Review only the findings from the most recent external audit

Explanation

Risk identification is stronger when multiple complementary techniques are combined, because each exposes different categories of risk. Threat modeling addresses design flaws, asset inventories reveal what needs protection, and workshops surface operational and business concerns. Single-source approaches leave systematic blind spots.

Question 7Risk Management

A risk owner is assigned to a specific register entry. What is the primary accountability of that role?

  1. Approving the organization's overall risk appetite statement
  2. Ensuring the risk is monitored and that an appropriate treatment decision is made and tracked Correct answer.
  3. Conducting the independent audit of the risk management program
  4. Performing the technical remediation work personally in all cases

Explanation

The risk owner is accountable for the risk being actively managed, including monitoring, selecting a treatment, and tracking progress. Execution of remediation may be delegated to technical teams. Setting enterprise risk appetite and performing independent audit are separate governance functions.

Question 8Risk Management

A risk assessment uses a 5×5 likelihood-impact matrix. Two risks both score 12, but one concerns customer data and the other concerns an internal test server. What does this situation most likely indicate?

  1. The matrix alone may not capture business context, so qualitative judgment must supplement the score Correct answer.
  2. The test server risk should be escalated to the same treatment priority as customer data
  3. The scores are invalid and the matrix must be discarded
  4. The customer data risk should be automatically downgraded to match the test server

Explanation

Numeric matrix scores compress multiple dimensions into one value and can obscure differences in business criticality and regulatory exposure. Assessors should apply contextual judgment rather than ranking purely by score. Discarding the matrix or forcing equal treatment ignores the underlying difference in consequence.

Question 9Risk Management

Which statement best characterizes risk appetite as used in enterprise risk management?

  1. The maximum budget allocated to security controls in a fiscal year
  2. The total number of risks recorded in the enterprise risk register
  3. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  4. The list of vulnerabilities that remain unpatched after a scan

Explanation

Risk appetite expresses the level of risk the organization chooses to pursue or retain in order to meet its goals. It guides treatment decisions and tolerance thresholds. Register counts, budgets, and unpatched findings are operational metrics rather than statements of appetite.

Question 10Risk Management

An analyst must estimate the likelihood of a rare but severe supply-chain compromise. Historical data for the organization is sparse. Which approach is most appropriate?

  1. Assign the highest possible likelihood to ensure the risk is funded
  2. Defer the assessment until the organization accumulates its own incident history
  3. Assume the likelihood is zero because the organization has never experienced it
  4. Use calibrated expert elicitation combined with external industry incident data Correct answer.

Explanation

When internal data is sparse, calibrated expert judgment supplemented by external loss data provides a defensible estimate. Assuming zero likelihood because an event has not yet occurred ignores base rates and is a known cognitive bias. Deferral leaves a material risk unmanaged.

Question 11Risk Management

Which control type is designed to reduce the impact of an event after it has occurred?

  1. Detective control
  2. Preventive control
  3. Corrective control Correct answer.
  4. Deterrent control

Explanation

Corrective controls act after an event to limit damage and restore normal operations, such as backups and incident response procedures. Preventive controls stop events from occurring, detective controls identify them, and deterrent controls discourage attempts. Each type addresses a different point in the event timeline.

Question 12Risk Management

A business unit wants to accept a risk that exceeds the organization's defined risk tolerance. What is the correct governance action?

  1. Close the risk entry so that it no longer appears in reporting
  2. Escalate the acceptance decision to the authority empowered to approve exceptions above tolerance Correct answer.
  3. Allow the business unit to accept it because local ownership implies local authority
  4. Silently record the risk in the register and take no further action

Explanation

Acceptance is only valid when made by someone with the authority to do so within the approved tolerance. Risks exceeding tolerance require escalation to a higher authority who can formally accept or mandate treatment. Local ownership does not confer authority to exceed enterprise limits.

Question 13Risk Management

Which metric best indicates whether a risk treatment plan is achieving its intended effect over time?

  1. The number of meetings held by the risk committee during the year
  2. The average length of the risk description text in the register
  3. A key risk indicator tracked against defined thresholds before and after treatment Correct answer.
  4. The total count of risks entered into the register since inception

Explanation

Key risk indicators provide measurable signals of changing exposure and can be compared against thresholds to show whether treatment is working. Activity counts such as meetings or register entries measure effort, not effect. Descriptive length has no bearing on risk outcomes.

Question 14Risk Management

A third-party vendor hosts a critical service. Which risk practice most directly addresses the organization's dependency on that vendor?

  1. Treat the vendor relationship as an IT procurement matter only
  2. Remove the vendor from scope because responsibility has been outsourced
  3. Include the vendor in the risk register with defined monitoring, contractual obligations, and contingency plans Correct answer.
  4. Rely on the vendor's own public marketing statements about security

Explanation

Outsourcing a service does not outsource accountability; the dependency remains an organizational risk that must be registered and monitored. Contracts, assurance activities, and contingency plans reduce and manage that exposure. Marketing claims are not adequate assurance, and procurement alone does not manage the risk.

Question 15Risk Management

In a bow-tie risk analysis, what do the left and right sides of the diagram represent?

  1. Preventive budget on one side and corrective budget on the other
  2. Financial loss on one side and reputational loss on the other
  3. Threats and their causes on one side, and consequences on the other, with controls on each path Correct answer.
  4. Inherent risk on one side and residual risk on the other

Explanation

The bow-tie model places a central event between causes on the left and consequences on the right, with preventive barriers on the cause side and mitigative barriers on the consequence side. It makes explicit where controls interrupt each pathway. It is not a financial or budget comparison diagram.

Question 16Risk Management

Which statement about the difference between risk tolerance and risk appetite is most accurate?

  1. Appetite is the general level of risk sought, while tolerance defines acceptable deviation around it Correct answer.
  2. Tolerance is set by regulators, while appetite is set only by the IT department
  3. Appetite and tolerance are interchangeable terms with no practical distinction
  4. Appetite applies to financial risk only, while tolerance applies to operational risk only

Explanation

Risk appetite sets the broad level of risk the organization is willing to pursue, and risk tolerance defines the acceptable range or deviation from that level before action is required. They are related but distinct concepts used together in governance. Neither is limited to a single risk category or a single department.

Question 17Risk Management

An analyst calculates single loss expectancy as 200,000 and estimates the annualized rate of occurrence at 0.05. What is the annualized loss expectancy?

  1. 4,000,000
  2. 200,050
  3. 10,000 Correct answer.
  4. 0.05

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence, so 200,000 × 0.05 = 10,000. This represents the expected loss per year from this risk. The other values result from incorrect operations or from restating an input.

Question 18Risk Management

Which practice best supports consistent comparison of risks across different business units?

  1. Reporting only risks that exceed a locally chosen threshold
  2. Ranking risks solely by the seniority of the manager who raised them
  3. Allowing each unit to define its own scale and terminology independently
  4. Adopting a common risk taxonomy and rating criteria applied uniformly across units Correct answer.

Explanation

A shared taxonomy and uniform rating criteria allow risks from different units to be aggregated and compared meaningfully. Independent local scales produce ratings that cannot be reliably combined. Seniority and local thresholds introduce bias and inconsistency into prioritization.

Question 19Risk Management

Which scenario best illustrates risk avoidance rather than risk mitigation?

  1. Adding multi-factor authentication to an internet-facing application
  2. Accepting a low-rated risk because treatment cost exceeds benefit
  3. Purchasing insurance to cover breach-related costs
  4. Discontinuing an unneeded legacy service that cannot be secured adequately Correct answer.

Explanation

Avoidance eliminates the risk by removing the activity or asset that creates it. Adding authentication reduces likelihood, insurance transfers financial consequence, and acceptance retains the exposure. Only the discontinuation removes the underlying source of risk.

Question 20Risk Management

A risk assessment team discovers that a previously identified risk has changed because a new internet-facing service was deployed. What is the most appropriate action?

  1. Reassess the risk and update its rating, treatment, and ownership in the register Correct answer.
  2. Leave the register unchanged until the next annual review cycle
  3. Downgrade the risk because a newer system is presumed more secure
  4. Delete the original entry and create no replacement

Explanation

Risk management is continuous, and material changes to the environment require reassessment of likelihood and impact. The register entry should be updated with any revised rating, treatment, and ownership. Waiting for a scheduled cycle or assuming newer systems are safer leaves stale assessments in place.

Question 21Risk Management

Which statement about the role of a risk committee in governance is most accurate?

  1. It personally implements technical controls for each registered risk
  2. It replaces the need for risk owners within business units
  3. It performs the independent audit of the risk management function
  4. It provides oversight of the risk portfolio and escalates decisions beyond delegated authority Correct answer.

Explanation

A risk committee oversees the aggregate risk portfolio, reviews reporting, and makes or escalates decisions that exceed delegated authority. Independent audit and technical implementation are separate functions. Risk ownership remains with designated individuals in the business.

Question 22Risk Management

An organization uses a heat map to present its risk portfolio. Which limitation should reviewers keep in mind?

  1. Heat maps are only valid for financial risks and not operational risks
  2. Aggregating risks into cells can hide the severity of individual high-impact risks Correct answer.
  3. Heat maps eliminate the need for any underlying risk data
  4. Heat maps cannot display likelihood and impact simultaneously

Explanation

Heat maps summarize many risks into cells, and this aggregation can conceal a single severe risk among several moderate ones. They display likelihood and impact on two axes but lose granularity. They are a communication tool, not a replacement for underlying data.

Question 23Risk Management

Which factor most directly increases the likelihood component of a risk associated with an unpatched server?

  1. The retention period for backup tapes
  2. The purchase price of the server hardware
  3. The number of staff trained on the patch process
  4. Public exposure of the service and availability of exploit code Correct answer.

Explanation

Likelihood rises when a vulnerable service is reachable by attackers and working exploit code is available. Hardware cost and backup retention do not affect the probability of exploitation. Staff training affects process reliability but is not the direct driver of exploitation likelihood.

Question 24Risk Management

A control is assessed as effective in design but has not been tested in operation. How should the residual risk be reported?

  1. As accepted risk, because testing is optional for designed controls
  2. As fully mitigated, because the design has been approved
  3. As inherent risk, because untested controls are ignored entirely
  4. As provisional, with a note that operational effectiveness is unverified and testing is required Correct answer.

Explanation

Design effectiveness shows that a control should work, but operating effectiveness requires evidence from testing. Until tested, the residual risk estimate is provisional and should be reported as such. Treating a designed control as fully effective overstates assurance.

Question 25Risk Management

Which statement best describes the purpose of a risk register?

  1. To list all approved software vendors and their contract dates
  2. To record identified risks with their ratings, owners, treatments, and status for tracking Correct answer.
  3. To document the security awareness training completion records
  4. To store the organization's complete inventory of hardware assets

Explanation

A risk register is the central record of identified risks, capturing ratings, ownership, treatment decisions, and status so that management can track and report on them. Asset inventories, training records, and vendor lists are separate repositories that may inform risk assessment but do not serve this purpose.

Question 26Risk Management

An organization defines a maximum acceptable annual loss from any single operational risk at 500,000. A proposed cloud migration introduces a risk with an estimated annualized loss exposure of 480,000. How should the risk practitioner interpret this result?

  1. The risk is automatically acceptable because no incident has occurred
  2. The risk exceeds tolerance and must be escalated for treatment
  3. The risk falls within tolerance and can proceed with monitoring Correct answer.
  4. The risk should be removed from the register as immaterial

Explanation

Risk tolerance is the maximum variance an organization is willing to bear for a given risk category, so an exposure below the stated threshold sits inside tolerance. Monitoring remains necessary because the estimate is close to the limit and could drift. Escalation is triggered only when the exposure breaches the defined tolerance.

Question 27Risk Management

Which term describes the amount of risk an organization is willing to pursue in order to achieve its strategic objectives?

  1. Risk capacity
  2. Risk appetite Correct answer.
  3. Residual risk
  4. Inherent risk

Explanation

Risk appetite is the level of risk an entity is willing to accept in pursuit of its mission and objectives, usually expressed in qualitative and quantitative terms. It sets the direction from which tolerances are derived. Residual and inherent risk describe measured states, and capacity describes the maximum risk the entity could absorb.

Question 28Risk Management

A team is selecting a risk analysis method for a scenario where the initiating event, preventive controls, consequences, and mitigating controls must all be visible on one diagram. Which technique fits this requirement?

  1. Bow-tie analysis Correct answer.
  2. Root cause analysis
  3. Monte Carlo simulation
  4. Delphi technique

Explanation

Bow-tie analysis places the risk event at the center, preventive barriers on the threat side, and mitigating barriers on the consequence side, making controls and their gaps visible. Delphi is a consensus estimation method, Monte Carlo models probabilistic outcomes, and root cause analysis examines past failures.

Question 29Risk Management

A risk register entry lists a likelihood of 4, an impact of 5, and a status of open. Which additional attribute is most important for accountability of that entry?

  1. A related control framework
  2. A named risk owner Correct answer.
  3. A severity score
  4. A review date

Explanation

Every register entry needs an accountable owner who is responsible for treatment and monitoring decisions. Without an owner, the risk cannot be actively managed regardless of its score. Scores, control mappings, and dates are supporting attributes but do not assign accountability.

Question 30Risk Management

An organization's risk management policy states that risk decisions must be documented, approved at the appropriate authority level, and traceable. Which governance principle does this primarily demonstrate?

  1. Least privilege
  2. Confidentiality
  3. Accountability and transparency Correct answer.
  4. Availability

Explanation

Documented, approved, and traceable decisions support accountability and transparency in risk governance, showing who decided and on what basis. Confidentiality, availability, and least privilege are security properties or access principles, not governance principles for decision records.

Question 31Risk Management

A risk analyst is estimating the frequency of a rare event and has no historical data for the organization. Which approach is most appropriate?

  1. Use structured expert judgment with documented rationale Correct answer.
  2. Assign a likelihood of 1 because the event has not occurred
  3. Use the highest likelihood value to be conservative
  4. Exclude the risk until data becomes available

Explanation

When internal data are insufficient, structured elicitation of expert judgment with documented assumptions provides a defensible estimate. Assigning the lowest value because the event has not yet occurred ignores that rare events may simply not have had exposure time. Excluding the risk or defaulting to the maximum introduces bias rather than information.

Question 32Risk Management

Which term describes the risk that remains after existing controls have been applied and assessed?

  1. Risk appetite
  2. Residual risk Correct answer.
  3. Inherent risk
  4. Secondary risk

Explanation

Residual risk is the exposure that persists after controls are in place and evaluated. Inherent risk is the exposure before controls, and secondary risk is a new risk created by a treatment. Risk appetite is a willingness statement, not a measured level of remaining exposure.

Question 33Risk Management

A risk treatment plan proposes purchasing cyber insurance to cover losses from a data breach. Which risk response strategy does this represent?

  1. Risk reduction
  2. Risk avoidance
  3. Risk transfer Correct answer.
  4. Risk acceptance

Explanation

Purchasing insurance shifts the financial consequence of a risk to a third party, which is risk transfer. Avoidance eliminates the activity, reduction lowers likelihood or impact through controls, and acceptance retains the risk without further action. Note that transfer shifts financial impact but does not eliminate the underlying risk.

Question 34Risk Management

An analyst computes a risk score as likelihood multiplied by impact, where likelihood is rated 1 to 5 and impact is rated 1 to 5. A risk has likelihood 3 and impact 4. What is the score?

  1. 7
  2. 1.33
  3. 34
  4. 12 Correct answer.

Explanation

In a multiplicative risk matrix, the score is the product of the likelihood rating and the impact rating, so 3 multiplied by 4 equals 12. Addition would give 7 but does not reflect the multiplicative model. Concatenation and division have no meaning in this scoring scheme.

Question 35Risk Management

A risk manager wants to compare exposures from a supplier outage, a regulatory fine, and a phishing campaign on a single consistent basis. Which approach best enables this comparison?

  1. Express each exposure in monetary terms as annualized loss expectancy Correct answer.
  2. Order the risks by the date they were identified
  3. Compare the number of controls applied to each risk
  4. Rank each risk by the subjective concern of senior managers

Explanation

Converting exposures to a common monetary measure such as annualized loss expectancy allows risks of different natures to be compared and prioritized consistently. Subjective concern, control counts, and identification dates are not commensurable measures of exposure.

Question 36Risk Management

A bank's risk committee approves a new product that carries risk above the bank's stated appetite because of expected revenue. Which governance failure does this most directly illustrate?

  1. Adequate exercise of risk appetite within delegated authority
  2. Approval of an exception without a formal, documented escalation and acceptance process Correct answer.
  3. Proper application of risk transfer to a third party
  4. Effective use of a key risk indicator

Explanation

When a decision exceeds stated appetite, governance requires a formal exception process with documented rationale and acceptance at the right authority level. Approving above appetite without that record undermines the appetite framework. The other options describe legitimate practices rather than the failure described.

Question 37Risk Management

A control is documented as well designed, but testing has not yet been performed to confirm it operates as intended. How should the residual risk be characterized?

  1. Low, because the design is sound
  2. Higher than inherent risk
  3. Uncertain, pending operating effectiveness evidence Correct answer.
  4. Zero, because a control exists

Explanation

Design effectiveness alone does not demonstrate that a control works in practice, so residual risk remains uncertain until operating effectiveness is tested. Treating design as proof of operation overstates assurance. Residual risk cannot be zero merely because a control exists, and it cannot exceed inherent risk under normal treatment logic.

Question 38Risk Management

An organization wants a metric that signals rising exposure before losses occur, such as an increasing count of unpatched critical servers. Which type of metric is this?

  1. Key risk indicator Correct answer.
  2. Key control indicator
  3. Single loss expectancy
  4. Key performance indicator

Explanation

A key risk indicator is a forward-looking measure of risk exposure or control weakness that provides early warning. A key performance indicator measures achievement of objectives, and a key control indicator measures control health specifically. Single loss expectancy is a monetary estimate of one loss event.

Question 39Risk Management

An organization decides to stop offering a legacy service entirely because the associated fraud risk cannot be brought within tolerance. Which risk response has been chosen?

  1. Acceptance
  2. Mitigation
  3. Transfer
  4. Avoidance Correct answer.

Explanation

Discontinuing the activity that generates the risk is avoidance, which eliminates the exposure rather than managing it. Mitigation would add controls while continuing the service, transfer would shift financial impact, and acceptance would retain the risk. Avoidance is appropriate when no treatment can bring the risk within tolerance.

Question 40Risk Management

A risk assessment team finds that a risk previously rated low has increased because a new public-facing interface expanded the attack surface. What is the most appropriate immediate action?

  1. Leave the rating unchanged until the annual review
  2. Close the risk because no incident has occurred
  3. Reassess likelihood and impact and update the register entry Correct answer.
  4. Transfer the risk to the vendor without reassessment

Explanation

Material changes in the environment require reassessment of likelihood and impact and an updated register entry so that treatment reflects current exposure. Deferring to the annual cycle leaves a changed risk misrepresented. Closing the risk or transferring it without reassessment ignores the new exposure.

Question 41Risk Management

A risk practitioner needs to show how a specific threat could exploit a vulnerability to produce a business consequence. Which structure best organizes this chain?

  1. Budget, schedule, and scope
  2. Asset, owner, and classification
  3. Policy, standard, and procedure
  4. Threat, vulnerability, event, and consequence Correct answer.

Explanation

Risk scenarios are built by linking a threat source to a vulnerability, the resulting event, and the business consequence, which supports analysis of where controls intervene. Budget and scope are project constraints, policy documents are governance artifacts, and asset attributes describe inventory rather than a causal chain.

Question 42Risk Management

A risk owner proposes a treatment whose cost exceeds the expected annualized loss from the risk. What is the most defensible basis for the decision?

  1. Approve the treatment because more controls are always better
  2. Reject all treatments whose cost exceeds any single loss
  3. Defer the decision until a loss event occurs
  4. Compare treatment cost against expected loss reduction and document the rationale Correct answer.

Explanation

Treatment decisions should weigh the cost of the control against the reduction in expected loss it delivers, with the rationale documented. A control costing more than the exposure it reduces may be poor value unless other factors such as regulatory obligations apply. Rejecting on single loss alone or waiting for an incident is not sound risk-based reasoning.

Question 43Risk Management

An organization wants assurance that third-party providers meet its risk requirements before contracts are signed. Which practice most directly supports this?

  1. Pre-contract due diligence with defined security and risk criteria Correct answer.
  2. Post-incident forensic investigation
  3. Employee security awareness training
  4. Annual penetration testing of internal systems

Explanation

Pre-contract due diligence evaluates a provider's controls and risk posture against defined criteria before the organization becomes dependent on it. Forensic investigation happens after an incident, internal penetration testing does not assess the vendor, and awareness training addresses internal staff behavior.

Question 44Risk Management

A risk manager wants to aggregate risks across business units to see concentrations that individual units cannot see. Which practice best supports this?

  1. Maintain a common taxonomy and scoring scale across all registers Correct answer.
  2. Allow each unit to define its own rating scale
  3. Consolidate risks by the date each was identified
  4. Report only risks above a unit-defined threshold

Explanation

Aggregation requires a common taxonomy and consistent scoring so that risks from different units can be combined and compared meaningfully. Unit-specific scales prevent comparability, filtered reporting hides concentration, and sorting by identification date provides no analytical value.

Question 45Risk Management

A risk analyst must decide whether to treat a risk that is within tolerance but trending upward. Which consideration is most relevant?

  1. The projected trajectory and the cost of early treatment versus waiting Correct answer.
  2. The number of past incidents affecting unrelated systems
  3. The seniority of the person who identified the risk
  4. Only the current rating relative to tolerance

Explanation

A risk within tolerance but trending upward may breach it soon, so the projected trajectory and the economics of early treatment versus later action are the relevant considerations. Relying only on the current rating ignores direction and speed of change. Unrelated incidents and the identifier's seniority do not bear on the decision.

Question 46Risk Management

An organization sets a risk appetite statement that is qualitative only, such as a preference for low risk in customer data handling. What is the main practical limitation?

  1. It prevents any risk from being accepted
  2. It cannot be communicated to staff
  3. It provides little basis for measuring whether specific exposures fall within it Correct answer.
  4. It eliminates the need for risk tolerance

Explanation

A purely qualitative appetite is difficult to apply consistently because there is no measurable threshold against which to test exposures. It can still be communicated and does not forbid acceptance outright. Tolerances are derived from appetite and remain necessary even when the statement is qualitative.

Question 47Risk Management

A risk assessment uses a heat map with likelihood on one axis and impact on the other. Which limitation should decision makers keep in mind when reviewing it?

  1. It cannot display more than ten risks
  2. It replaces the need for a risk register
  3. Risks in the same cell can differ greatly in nature and velocity Correct answer.
  4. It always overstates low-likelihood risks

Explanation

Heat maps group risks by two dimensions and hide differences such as velocity, controllability, and risk type within the same cell, so risks that appear equal may require very different responses. There is no ten-risk limit, the map does not systematically overstate low-likelihood risks, and it complements rather than replaces the register.

Question 48Risk Management

A risk owner must decide how to respond to a risk with high impact and very low likelihood where the potential consequence is catastrophic. Which response is most likely appropriate?

  1. Reduce monitoring to save resources
  2. Remove the risk from the register to reduce noise
  3. Maintain preventive controls and a documented contingency plan Correct answer.
  4. Accept the risk with no further action because likelihood is low

Explanation

Low-likelihood, high-impact risks often justify retaining preventive controls plus a tested contingency plan because the consequence, not the frequency, drives the decision. Accepting without action, deleting the risk, or reducing monitoring ignores the severe downside. Treatment should be proportionate to impact as well as likelihood.

Question 49Risk Management

An organization wants to quantify the aggregate distribution of losses across many correlated risks rather than a single point estimate. Which method is designed for this?

  1. Delphi technique
  2. Monte Carlo simulation Correct answer.
  3. Bow-tie analysis
  4. Checklist-based review

Explanation

Monte Carlo simulation samples from probability distributions for each risk and their dependencies to produce an aggregate loss distribution, capturing correlation and tail behavior that a point estimate cannot. Bow-tie analysis maps controls, Delphi builds expert consensus, and checklists ensure coverage.

Question 50Risk Management

A risk manager observes that a key risk indicator has breached its threshold but no loss event has occurred. What is the most appropriate interpretation?

  1. The risk has been fully mitigated
  2. Exposure has risen beyond the defined threshold and warrants review Correct answer.
  3. The threshold should be raised to avoid alerts
  4. The indicator is faulty because no loss occurred

Explanation

A key risk indicator measures exposure or control weakness, so a breach signals that risk has risen beyond the defined threshold and requires review, even without a loss. Absence of loss does not invalidate the indicator, mitigation is not demonstrated, and raising thresholds to silence alerts undermines the metric's purpose.