ExamGecko
Question list
Search
Search

Related questions











Question 499 - CISA discussion

Report
Export

Which of the following should be the FIRST step when conducting an IT risk assessment?

A.
Identify potential threats.
Answers
A.
Identify potential threats.
B.
Assess vulnerabilities.
Answers
B.
Assess vulnerabilities.
C.
Identify assets to be protected.
Answers
C.
Identify assets to be protected.
D.
Evaluate controls in place.
Answers
D.
Evaluate controls in place.
Suggested answer: C

Explanation:

The first step when conducting an IT risk assessment is to identify assets to be protected, which include hardware, software, data, processes, people, and facilities that support the business objectives and operations of an organization. Identifying assets to be protected helps to establish the scope and boundaries of the risk assessment, as well as the value and criticality of each asset.Identifying potential threats, assessing vulnerabilities, and evaluating controls in place are subsequent steps in the risk assessment process that depend on the identification of assets to be protected.Reference:CISA Review Manual (Digital Version), Chapter 2: Governance & Management of IT, Section 2.3: IT Risk Management

asked 18/09/2024
Mohammad Wahid
46 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first