Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I think it’s the wording, a part of the project deals with HW, technically that subset is entirely transferred to 3rd party. Hence A is correct.
This question is in the QAE, only a part of a project deals with the hardware work. Since only the risk response applies to part of the project the overall risk is still owned by the company and this is considered as mitigation.
I would like to correct my answer. the answer should be A Transference for the following reason : When the project manager hires a third party to handle the hardware work, it doesn’t transfer the overall project risk. Instead, it transfers the hardware-related risks (such as technical, operational, or compliance risks specific to hardware) to the third-party vendor. Considering the first sentence in the question mentions "A part of a project deals with the hardware work." then the scope of transfered risk is hardware-related work.