Section: Volume D
Explanation:
An enterprise's risk management capability maturity level is 1 when:
* There is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk.
* Any risk identification criteria vary widely across the enterprise.
* Risk appetite and tolerance are applied only during episodic risk assessments.
* Enterprise risk policies and standards are incomplete and/or reflect only external requirements and lack defensible rationale and enforcement mechanisms.
* Risk management skills exist on an ad hoc basis, but are not actively developed.
* Ad hoc inventories of controls that are unrelated to risk are dispersed across desktop applications.
Incorrect Answers:
A: In level 3 of risk management capability maturity model, local tolerances drive the enterprise risk tolerance.
B: In level 2 of risk management capability maturity model, risk tolerance is set locally and may be difficult to aggregate.
C: In level 4 of risk management capability maturity model, business risk tolerance is reflected by enterprise policies and standards reflect.

Section: Volume D
Explanation/Reference:

Explanation/Reference:
Explanation:
Change requests are not one of the four inputs to the Risk Monitoring and Controlling Process. The four inputs are the risk register, the project management plan, work performance information, and performance reports.
Incorrect Answers:
A, B, C: These are the valid inputs to the Risk Monitoring and Controlling Process.

is incorrect. Malicious code protection is not a Media protection control.
Media Protection includes removable digital media such as tapes, external hard drives, and USB
flash drives. It also includes non-digital media such as paper and film. This family of controls
covers the access, marking, storage, transport, and sanitization of media.

Explanation/Reference:
Explanation:
Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.
Incorrect Answers:
A: A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks.
Typically a risk register contains:
A description of the risk

The impact should this event actually occur

The probability of its occurrence

Risk Score (the multiplication of Probability and Impact)

A summary of the planned response should the event occur

A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the

event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

D: Return On Investment (ROI) is a performance measure used to evaluate the efficiency of an investment or to compare the efficiency of a number of different investments. To calculate ROI, the benefit (return) of an investment is divided by the cost of the investment; the result is expressed as a percentage or a ratio.
The return on investment formula:
ROI= (Gain from investment - Cost of investment) / Cost of investment
In the above formula "gains from investment", refers to the proceeds obtained from selling the investment of interest.