Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Answer D is only necessary if there's reason to believe the scenarios were incorrectly assessed. Don't think that the case there - it isn't explicitly stated in the question as such.
The question does not emphasize if the level of residual risk (even it is a low residual risk) is acceptable for the organization or not. If it is unacceptable, we would go with option "A". However, to know if the mentioned risks are acceptable or not (in order to take the decision); you have to reassess. Most times, in such questions, you have to evaluate then decide.
When a risk practitioner identifies an ineffective control that is linked to several low residual risk scenarios, it is important to re-evaluate the risk scenarios to ensure their accuracy and validity.