GRC Risk Management & Mitigation Strategies 2

Question 1

Which risk response strategy involves shifting the financial impact of a risk to a third party?

Accepted Answer

Transfer

Answer

Risk transfer moves the financial burden to another party, such as purchasing insurance or outsourcing a risky function.

Question 2

A company decides not to enter a new market because the associated risks exceed its risk appetite. This is an example of which strategy?

Accepted Answer

Risk avoidance

Answer

Risk avoidance involves eliminating the risk entirely by choosing not to engage in the activity that creates it.

Question 3

In quantitative risk analysis, what does Annualized Loss Expectancy (ALE) represent?

Accepted Answer

Expected monetary loss per year for a given risk

Answer

ALE is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO).

Question 4

Which type of risk control is designed to detect and record security incidents after they occur?

Accepted Answer

Detective control

Answer

Detective controls identify and log incidents that have already happened, such as intrusion detection systems and audit logs.

Question 5

A risk register is primarily used to:

Accepted Answer

Document, track, and monitor identified risks

Answer

A risk register is a centralized document that records risk details, owners, likelihood, impact, and mitigation actions for ongoing tracking.

(GRC) Governance, Risk, and Compliance Certification Practice Test