ISACA IT Risk Fundamentals Practice Test

These questions are part of the practice quiz. Start practicing

• A method to define and depict roles and responsibilities.
• Which metric is a backward-looking indicator that shows risk has been realized after an event has occurred?
• What is the term for a deficiency in the design or operation of a control procedure that may result in misstatements not being detected?
• Which analysis is based on adding positive factors and subtracting negative factors to determine a net result and support a risk response?
• Which term describes a program that creates an understanding of risk, risk factors and the various types of risk that an enterprise faces?
• Which term describes the process of aggregating risk assessments to obtain a complete view of enterprise risk?
• Which term describes the act of accepting risk within defined appetite?
• A mathematically driven measure of the possibility of a specific outcome as a ratio of all possible outcomes.
• Which term describes the risk that information may be divulged or made available to recipients without authorized access by the information owner?
• Which term is defined as the approach that uses a calculation of risk's likelihood and impact using numerical techniques?
• What is the remaining risk after management has implemented a risk response?
• Which term measures operating performance as net income divided by total investment?
• Which risk is the risk that IT projects take longer than expected?
• The magnitude of loss resulting from a threat exploiting a vulnerability is referred to as what?
• Which term describes the risk category focused on IT service delivery and operations performance?
• Which is defined as a practice, procedure or mechanism that reduces risk?
• Which term refers to an adversary that has advanced capabilities and uses multiple attack vectors to achieve its objectives?
• Which term best describes the magnitude of loss or gain from realized events?
• Which term describes the magnitude of loss from a threat exploiting a vulnerability?
• Which artifact is a list of risk items that have been identified, analyzed and prioritized?
• Which term describes the process of assigning risk to another enterprise, usually through insurance or outsourcing?
• Which risk category describes the probability and consequences of failing to comply with laws or ethical standards?
• Which term describes the statement of the desired result or purpose to be achieved by implementing control procedures?
• Which concept involves distributing risk among multiple parties?
• What term describes a control designed to correct errors, omissions and unauthorized uses or intrusions after they are detected?
• Which term describes a live test of the effectiveness of security defenses by mimicking the actions of real-life attackers?
• Which term describes the evaluation step that compares risk estimates to predefined criteria to determine significance?
• Threats to natural resources, human health and wildlife are categorized as which risk?
• An event or attempt to gain unauthorized access or use of an asset is called what?
• Which term describes the probability and potential size of losses or gains that could prevent an organization from achieving its objectives?
• Which term describes the risk level before management actions such as controls are applied?
• Which risk relates to the performance of IT systems and services, where a poorly performing IT operation can bring destruction or reduction of value to the enterprise?
• Which artifact documents the rationale for making a business investment and supports management of the investment through its full economic life cycle?
• Illustrates who is Responsible, Accountable, Consulted and Informed within an enterprise framework.
• An IT-related event that causes an operational, developmental and/or strategic business impact describes which concept?
• Which term describes the repository containing key attributes of IT risks such as name, description, owner, expected/actual frequency, potential/actual magnitude, and disposition?
• Which term is defined as a mandatory requirement or specification approved by a recognized external standards organization?
• Which term describes the probability that something will happen?
• Which artifact explicitly shows who is Responsible, Accountable, Consulted, and Informed for a process?
• What term refers to any event that is not part of the ordinary operation of a service that causes, or may cause, an interruption to, or a reduction in, the quality of that service?
• What are the activities and programs designed to return the enterprise to an acceptable condition called?
• Which term describes the organizational capability to maintain essential functions during a disruption and resume normal operations?
• Which term describes the risk that service may be lost or data are not accessible when needed?
• What is the term for the method by which management and staff at all levels collectively identify and evaluate risk and controls with their business areas, possibly under the guidance of a facilitator such as an auditor or risk manager?
• A person in whom the enterprise has invested the authority and accountability for making control-related decisions and for ensuring the control is implemented and operating effectively is called what?
• Which term describes the rate at which events occur?
• What is the assessment of controls performed by the staff and management of the unit or units involved called?
• Which term describes anyone who has a responsibility for, an expectation from, or some other interest in the enterprise?
• Which term describes the risk that information delivered to stakeholders may be timely or suitable, impacting decision quality?
• What term describes a control designed to detect and report when errors, omissions and unauthorized uses or entries occur?
• Which term is used to catalog identified risks and their analyses for governance?
• Which term describes a graphic tool for ranking and displaying risk by defined ranges for frequency and magnitude?
• Which term best describes the risk that I&T investment is wasteful or does not provide value relative to its cost?
• What is the term for determining how often a particular risk scenario might be expected to occur during a specified period of time?
• Which IT risk concept refers to an IT-related event that can impact operations and strategy?
• A document containing a detailed description of the steps necessary to perform specific operations in conformance with applicable standards.
• Which term is a description of the current conditions that may lead to the loss and a description of the loss?
• Which term describes the framework used to map and assign roles and responsibilities for processes?
• Which indicator is a subset of risk indicators that are highly relevant and possess a high probability of predicting important risk?
• Which term describes the risk that I&T projects fail to meet objectives through lack of accountability and commitment?
• Which term means avoiding risk by not engaging in certain activities?
• Which term is defined as the risk that controls, testing, or monitoring will fail to detect a material error?
• Which term is described by the risk that the delivery of a product relies on coordinated cross-functional activities?
• The net effect, positive or negative, on the achievement of business objectives, is called which term?
• The activities and programs designed to return the enterprise to an acceptable condition are collectively known as what?
• What term describes an event where the attacker takes advantage of a vulnerability?
• Which term describes a process used to identify and evaluate risk and its potential effects?
• Which concept includes using a set of responses so that residual risk approaches risk appetite?
• Which process involves diagnosing the origins of events, which can be used for learning from errors and problems?
• Which term best describes the risk tied to a company's plans and strategies?
• Which term describes the overall process of analyzing what threats exist against assets and how they may materialize?
• Which term describes the risk that data quality issues lead to unreliable information and decisions?
• What term describes any enterprise asset that helps to achieve IT goals?
• A mandatory requirement, code of practice or specification approved by a recognized external standards organization.
• Which term describes the implementation of a risk strategy that reflects the culture, appetite and tolerance levels, technology, budgets, and compliance requirements?
• What term refers to something with value, either tangible or intangible, that needs protection?
• Which process involves formal inspection and verification to ensure guidelines are followed, records are accurate, and targets are met?
• What term sets the direction and strategy of risk management efforts and defines acceptable levels of risk?
• Which term is an internal control that reduces risk of a control weakness by providing an alternative safeguard?
• The risk associated with an enterprise's future business plans and strategies.
• The risk category describing the possibility that a borrower or creditor will fail to meet financial obligations is known as which risk?
• Which risk level is the exposure without considering management actions such as controls?
• What is the process of integrating risk assessments at a corporate level to obtain a complete view of the enterprise's overall risk?
• Anything that is capable of acting against an asset in a manner that can result in harm. Threats are aimed at exploiting enterprise vulnerabilities.
• Which term refers to the person who owns the risk and is accountable for risk-based decisions within the organization?
• Which metric is a forward-looking indicator that provides an early warning that risk may soon be realized before an event has occurred?
• What is the tangible and assessable representation of risk?
• Which term describes the risk that data may be unavailable due to incompleteness or inaccuracy?
• Which term is used when risk is allocated to another party, commonly via insurance?
• Which term tests security by simulating attacker techniques?
• Which term describes the process of comparing the estimated risk against given risk criteria to determine the significance of the risk?
• Which approach is based on expert opinion, judgement, intuition and experience?
• The combination of the likelihood of an event and its impact.
• Which concept accounts for potential delays in IT project delivery due to risk factors?
• Which term refers to the risk that I&T infrastructure and systems may be unable to effectively support the current and future needs of the business in an efficient, cost-effective and well-controlled fashion?
• Which term describes the set of activities and framework for directing and controlling risk across the organization?
• Pressures on an asset class
• What term describes something that happens at a specific place and/or time?
• The set of shared values and beliefs that governs attitudes toward risk-taking, care and integrity, and determines how openly risk and losses are reported and discussed.
• Which term describes the governance approach that includes managing IT risk within an enterprise, considering culture, appetite, budgets and compliance?
• Which term is defined as a path or route used by the adversary to gain access to a target asset?
• What is the probability of something happening?
• A measure the potential severity of loss or the potential gain from realized events/scenarios
• Which term refers to managing risk through countermeasures and controls?
• An internal control that reduces the risk of an existing or potential control weakness resulting in errors and omissions is known as what?
• Which term refers to the coordinated activities to direct and control an enterprise with regard to risk?
• Which concept refers to a gap that exists when the acceptable level of risk and the current state of risk are different?
• A failed IT project that poses a significant risk to an enterprise, manifesting as lost market share, failure to seize new opportunities or other adverse impacts on customers, shareholders and staff.
• Which term measures performance against objectives to indicate likely achievement?
• What is the term for a repository of the key attributes of potential and known IT risk issues?
• Which term is an interrelated set of cross-functional activities that result in the delivery of a specific product or service to a customer?
• Which term describes a part of IT risk focused on the use, ownership, operation, involvement, influence and adoption of I&T within an enterprise?
• Which term denotes the representation of risk that is tangible and assessable?
• Which term describes a deficiency in the design or operation of a control that could allow misstatements to go undetected?
• Which term denotes the magnitude of loss resulting from a threat exploiting a vulnerability?
• Which term refers to the value of an asset to the business and to competitors?
• Which term describes the risk that the right information may not get to the right recipients at the right time to allow the right action to be taken or the right decisions to be made?
• Which indicator is effective in predicting whether a goal will be reached and indicates the capabilities and skills valuable to the enterprise?
• What describes the evaluation of the type, scope and nature of events or actions that can result in adverse consequences; identification of the threats that exist against enterprise assets?
• Which term describes the risk that I&T investment fails to provide value commensurate with its cost or is otherwise excessive or wasteful, including the overall I&T investment portfolio?
• Which term describes the process of management and staff identifying risk and controls with guidance from an auditor?
• Which risk state reflects the situation at a moment in time, including actions already taken but not future actions?
• Which term serves as the business justification for pursuing a project and supports management of the investment through its life cycle?
• The means of managing risk, including policies, procedures, guidelines, practices or organizational structures, is called what?
• Which term describes any person or group that has responsibility for, an expectation from, or an interest in the enterprise?
• Which term represents the level of risk that management is willing to tolerate in pursuit of objectives?
• The danger, harm or loss related to the use of, or dependence on, information and communications technology, electronic data, and digital or electronic communications is best described as which risk?
• Which concept ensures stakeholder needs and options are evaluated to determine balanced, agreed-on enterprise objectives and monitoring performance against them?
• Which term describes the potential for losses caused by inadequate systems or controls, human error or mismanagement and natural disasters?
• Which term refers to any process that directly reduces a threat or vulnerability?
• What term is a measure of the rate by which events occur over a certain period of time?
• What is the process of identifying and classifying vulnerabilities?
• A measure of operating performance and efficiency computed as net income divided by total investment over the period being considered is known as what?
• What term means any person, thing, or entity that acts or carries out a threat and is responsible for a threat event?
• Which process determines the impact of losing the support of any resource on operations and objectives?
• Which term is the process of sharing risk with others?
• What is the term for the amount of risk an enterprise is willing to accept in pursuit of its objectives?
• Which risk is a part of overall business risk associated with the use, ownership, operation, involvement, influence and adoption of I&T within an enterprise?
• Which process includes developing a strategy to regularly evaluate I&T-related controls/metrics, recording and evaluating I&T-related events, recording changes to I&T-related controls, and communicating the current risk and control status to enable information-sharing decisions involving the enterprise?
• Which term describes the decision to accept a risk according to the risk appetite?
• Which artifact is a method to define and depict roles and responsibilities?
• A document that records a high-level principle or course of action that has been decided on.
• Which term is a forward-looking signal used to prompt early mitigations before problems occur?
• The amount of risk, on a broad level, that an enterprise or other entity is willing to accept in pursuit of its mission.
• Which term provides a structured language for discussing risk by grouping sources and categories?
• Which term denotes potential sources of harm that may be exploited by attackers?
• Which term describes the selection of items included in the risk activities based on understanding the full risk universe and down-selecting the specific part of the enterprise to which the risk activities will be applied?
• Which concept is the overall approach to responding to risk to keep residual risk within appetite?
• Which term describes the risk associated with a company's future business plans and strategies?
• Which term covers implementing controls and measures to reduce risk?
• Which term describes the statement of the desired result or purpose to be achieved by implementing control procedures in a particular process?
• The probability and consequences of failing to comply with laws, regulations, or ethical standards applicable to the industry describes which risk?
• Which term denotes the entity that performs the exploitation of a vulnerability via methods and tools?
• What is the scheme for classifying sources and categories of risk that provides a common language for discussing and communicating risk to stakeholders?
• A change in technology, regulation, business process, functionality, architecture, or user variables that affects the enterprise risk level is described as which risk?
• The maximum loss an enterprise can tolerate without risking its continued existence is called?
• Which term describes assets that help achieve IT and risk goals?
• Which term refers to an assessment performed by the unit's own staff to verify that controls are working as intended?
• Which control detects and reports when errors or unauthorized uses occur?
• The potential that a borrower or creditor will fail to meet financial obligations is known as which risk?
• What is the process for determining and documenting the risk an enterprise faces?
• The person in whom the enterprise has invested the authority and accountability for making risk-based decisions and who owns the loss associated with a realized risk scenario?
• Which concept is a mechanism that reduces risk?
• Which term is defined as the objective magnitude or amount of loss an enterprise can tolerate without risking its continued existence?
• What is the acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives?
• Which term describes the approach that uses numerical calculation to determine risk likelihood and impact?
• Which term denotes something of value, tangible or intangible, that is worth protecting?
• Which term describes a record used to track all relevant assets?
• Which term best describes the management of risk through countermeasures and controls to reduce probability or impact?
• Which approach uses numerical and statistical techniques to calculate a risk's likelihood and impact?
• Which term describes the process of planning to prevent, mitigate, and recover from disruptions?
• Which term describes the risk that the overall IT investment portfolio may fail to deliver value commensurate with cost?
• What is the process of systematically avoiding risk called?
• Which term refers to any event during which a threat actor acts against an asset in a manner that has the potential to directly result in harm?
• Threats to natural resources, human health and wildlife are categorized as which risk?
• Which term describes the description of the current conditions that may lead to a loss and the description of the loss?
• Methods and things used to exploit a vulnerability.