ISACA Certified Information Systems Auditor Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  Risk Reduction/Mitigation: Because there was no transfer of risk to other parties. Moving to another facility will reduce the likelihood of flooding or the impact of the event. For those who select answer D, it will make sense to choose D if a flood insurance was purchased. But it's not the case in this example, so answer A is correct!

• Chose A2

  By shifting the data Centre to a higher ground, this is a mitigation measure done to reduce the risk of flooding at which the risk seem to be extremely low. Acceptance would mean keeping the Data Centre at current location and doing nothing. Transfer would mean contracting a third party such as an insurance company to pay for any flood risk eventualities. Avoidance would mean terminating and not owning a Data Centre at all to totally avoid any possibilities of facing the risk.

• Chose D1

  When you see “not updated policy” ask yourself what’s the biggest consequence? If the answer includes laws, compliance, or regulations, that’s your winner!