CISA IT Risk Management 3

Question 1

Which ISACA framework is MOST directly aligned with IT risk management practices for CISA candidates?

Accepted Answer

COBIT 2019

Answer

COBIT 2019 is ISACA's primary governance and management framework, which includes specific guidance on IT risk management.

Question 2

A company's IT risk management process identifies a vulnerability but determines no credible threat exploits it. What is the MOST appropriate action?

Accepted Answer

Monitor it in case a credible threat emerges

Answer

Without a credible threat, the immediate risk is low, but the vulnerability should be monitored in case the threat landscape changes.

Question 3

In the context of IT risk management, what is 'inherent risk'?

Accepted Answer

Risk level before any controls are applied

Answer

Inherent risk is the raw or gross risk that exists in the absence of any control measures.

Question 4

Which of the following is an example of a QUALITATIVE risk analysis technique?

Accepted Answer

Using a 5x5 risk heat map with High/Medium/Low ratings

Answer

A risk heat map using descriptive categories like High, Medium, and Low is a qualitative technique that does not rely on precise numerical values.

Question 5

During an IT audit, a CISA finds that risk assessments are performed annually by IT staff without business unit input. What is the GREATEST weakness?

Accepted Answer

Risk assessments lack business context and may miss operational risks

Answer

Excluding business units means assessments may miss key operational risks and fail to align with business objectives.

CISA - Certified Information Systems Auditor Practice Test