Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I believe A is the answer. How can a manager "manage" the impact of a risk. How can they quantify it enough to pre--cushion the effect?
It is required to identify residual risk after applying the controls and then take actions ( Risk mitigation methods) on residual risk based on risk appetite
A. Identifying unacceptable risk levels is the correct answer. For those of you who say D. Managing the impact, keep in mind that you cannot manage the risk impact without first of all identifying if the risk level is acceptable or not. If the risk is within the company's risk appetite level then Managing the impact can happen. However, if the risk exceeds the company's risk appetite then eliminating the risk will be the next step. Managing the impact will not be relevant in that case. So A. is the correct answer.