CTO IT Governance & Risk Management 4

Question 1

Which of the following best describes the concept of 'risk appetite' in IT governance?

Accepted Answer

The total level of risk an organization is willing to accept in pursuit of its objectives

Answer

Risk appetite defines the broad level of risk an organization is willing to tolerate in pursuit of value, distinct from risk capacity (maximum survivable risk) and residual risk.

Question 2

A CTO implements a new policy requiring quarterly IT risk reviews. Which governance principle does this MOST directly support?

Accepted Answer

Performance principle

Answer

ISO/IEC 38500's Performance principle requires that IT supports the organization effectively and that its performance is monitored and reviewed regularly.

Question 3

When using a quantitative risk analysis approach, what does Annual Loss Expectancy (ALE) represent?

Accepted Answer

The expected monetary loss from a risk over a one-year period

Answer

ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO), representing the expected yearly financial impact of a risk.

Question 4

A regulated financial technology firm must comply with both SOX and PCI DSS. Where do these frameworks MOST commonly overlap in IT governance requirements?

Accepted Answer

Access controls and audit logging for sensitive systems

Answer

Both SOX (Section 404 IT controls) and PCI DSS require robust access controls and comprehensive audit logging for systems handling sensitive financial data.

Question 5

In IT governance, what is the role of an IT steering committee compared to an IT governance board?

Accepted Answer

The steering committee coordinates ongoing IT initiatives at a tactical level; the governance board provides strategic oversight

Answer

IT steering committees typically operate at a management/tactical level coordinating projects and resources, while governance boards provide strategic direction and board-level oversight.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO IT Governance & Risk Management 4