IT-Risk-Fundamentals Sample Questions & Answers
Assessing risk, qualitatively and quantitatively, carries the most weight, alongside identifying risks for a register, governing risk and setting management strategy, responding to risk, monitoring and reporting on it, and basics like the three lines of defense.
Launch the full IT-Risk-Fundamentals simulator →Showing 10 of 20 free samples.
- Question 1Intermediate
Risk Governance and Management · Risk Governance Framework
An internal audit of a regional bank reveals that business unit managers are frequently accepting high-level IT risks without consulting the central risk management function or senior leadership. This has led to several operational issues. This situation indicates a primary failure in which of the following?
Show answer & explanation
Correct answer: C
This is a classic failure of risk governance. A proper governance framework would establish clear lines of authority, define risk appetite and tolerance levels, and specify the escalation process for accepting risks that exceed a certain threshold. The managers are operating outside of a well-defined structure, indicating a weakness in governance.
- Question 2Beginner
Risk Introduction and Overview · Three Lines of Defense
The 'three lines of defense' model is a fundamental concept in risk governance. Which of the following correctly maps the roles to their respective lines of defense?
graph TD subgraph First_Line [First Line] A[Business Operations] B[Front-line Staff] end subgraph Second_Line [Second Line] C[Risk Management Function] D[Compliance Department] end subgraph Third_Line [Third Line] E[Internal Audit] end First_Line --> Second_Line Second_Line --> Third_LineShow answer & explanation
Correct answer: B
This is the correct mapping. The first line consists of front-line staff and business operations who own and manage risks directly. The second line, including Risk Management and Compliance, provides oversight and sets policies. The third line, Internal Audit, provides independent assurance to the board and senior management that the first two lines are effective.
- Question 3Advanced
Risk Identification · Risk Evaluation and Prioritization
Case Study
A mid-sized e-commerce company, 'Urban Threads', is planning a major migration of its customer relationship management (CRM) and inventory systems from an on-premises data center to a public cloud provider. The company's risk management team has been tasked with identifying and assessing the risks associated with this migration. The primary business objective is to enhance scalability and reduce operational overhead, but the board is highly concerned about data security and potential business disruption during the transition.
The project team is composed of internal IT staff with limited cloud experience and an external consulting firm specializing in cloud migrations. The timeline for the migration is aggressive, set at three months to align with the launch of a new product line. Early analysis shows that the current on-premises systems have several undocumented dependencies and custom configurations.
Which risk assessment finding should be of the HIGHEST priority to the board of directors?
Show answer & explanation
Correct answer: C
This represents the highest priority risk. A prolonged outage directly impacts the company's ability to conduct business, leading to immediate revenue loss, reputational damage, and failure to meet the product launch deadline. It combines a high likelihood (due to undocumented dependencies and an aggressive timeline) with a catastrophic business impact, directly addressing the board's concern about business disruption.
- Question 4Intermediate
Risk Assessment and Analysis · Qualitative Analysis Methods
A risk manager is using a 5x5 risk matrix (with axes for Likelihood and Impact) to assess risks. Risk A is rated as Likelihood=2, Impact=5. Risk B is rated as Likelihood=4, Impact=3. Assuming the risk score is calculated by multiplying the ratings (Score = Likelihood x Impact), which statement is correct?
Show answer & explanation
Correct answer: C
This is correct. The risk score for Risk A is 2 * 5 = 10. The risk score for Risk B is 4 * 3 = 12. Since Risk B has a higher overall score (12 vs. 10), it should be prioritized for treatment over Risk A, despite having a lower individual impact rating.
- Question 5Beginner
Risk Response · Risk Response Strategies
A telecom company has decided it will no longer offer services in a high-risk geopolitical region to eliminate all associated cybersecurity and compliance risks. This is an example of which risk response strategy?
Show answer & explanation
Correct answer: D
Risk avoidance is the strategy of deciding not to become involved in, or to withdraw from, a risk situation. By ceasing operations in the high-risk region, the company is eliminating the activities that give rise to the associated risks.
- Question 6Intermediate
Risk Monitoring, Reporting and Communication · Reporting Mechanisms
An IT risk analyst is creating a presentation for the audit committee. The presentation needs to visually communicate the current risk posture, showing the distribution of risks across different severity levels. Which of the following would be the MOST effective visualization tool for this purpose?
Show answer & explanation
Correct answer: B
A risk heat map is a graphical representation of risks that uses colors (like red, yellow, and green) to highlight the highest-risk areas on a matrix of likelihood and impact. It is the ideal tool for providing a concise, high-level, and immediate visual summary of the risk posture to senior management and boards.
- Question 7Beginner
Risk Identification · Risk Register Development
The primary purpose of a risk register is to serve as a static, annual record of all identified risks within an enterprise.
Show answer & explanation
Correct answer: B
This statement is false. A risk register should be a dynamic, living document that is continuously updated as new risks are identified, existing risks change, and risk responses are implemented. It is a central tool for ongoing risk management, not a static annual report.
- Question 8Intermediate
Risk Identification · Identification Methods and Tools
A risk practitioner is facilitating a workshop to identify potential risks for a new mobile banking application. Which of the following risk identification techniques would be MOST effective for exploring a wide range of potential negative outcomes and their causes in a collaborative setting?
Show answer & explanation
Correct answer: B
Brainstorming is a highly effective collaborative technique for generating a broad list of potential risks. It encourages open discussion and creative thinking from a diverse group of stakeholders (developers, security experts, business users), making it ideal for identifying a wide range of risks for a new project.
- Question 9Intermediate
Risk Governance and Management · Risk Appetite and Tolerance
The board of a multinational corporation states, "We will not accept any IT project that has a greater than 10% chance of causing a significant data breach." This statement is a direct expression of the organization's:
Show answer & explanation
Correct answer: B
Risk appetite is the amount and type of risk that an organization is willing to pursue or retain in pursuit of its objectives. This high-level statement from the board sets a clear boundary on the level of risk it is willing to accept for a specific type of risk (data breaches), which is a classic example of a risk appetite statement.
- Question 10Beginner
Risk Response · Residual Risk Management
After implementing a new set of firewall rules to mitigate a specific network intrusion risk, the risk team performs a follow-up assessment. They determine that the likelihood of the intrusion has been significantly reduced, but a small chance of occurrence still remains. This remaining risk is BEST described as:
Show answer & explanation
Correct answer: B
Residual risk is the risk that remains after risk response measures (such as implementing controls) have been taken. Since the firewall rules have been applied but a small amount of risk still exists, this is the correct definition.
Ready for the real thing?
The full IT-Risk-Fundamentals simulator has every exam-style question, timed mode, and instant scoring.