*External sources of emerging threats are sources that provide information about the latest cyberattacks, hacking techniques, malware, and vulnerabilities that can affect an organization's IT systems and data.
Examples of external sources are security blogs, forums, newsletters, reports, and alerts from reputable organizations such as ISACA, Imperva, Aura, and BitSight123.
*The most useful information an organization can obtain from external sources is the indicators for detecting the presence of threats. Indicators are observable signs or patterns that can help identify, prevent, or mitigate cyberattacks. Examples of indicators are IP addresses, domain names, file hashes, network traffic, system logs, and user behavior4.
*Indicators for detecting the presence of threats are more useful than the other options because they can help an organization to:
oMonitor and analyze its IT environment for any suspicious or malicious activity oRespond quickly and effectively to any potential or actual incidents oReduce the impact and damage of cyberattacks oImprove its security posture and resilience
*Solutions for eradicating emerging threats are not the most useful information because they may not be applicable or effective for every organization, depending on its specific context, needs, and resources.
Moreover, solutions may not be available or known for some new or sophisticated threats.
*Cost to mitigate the risk resulting from threats is not the most useful information because it does not help an organization to identify or prevent cyberattacks. Cost is only one factor to consider when deciding how to manage IT risk, and it may not reflect the true value or impact of the threats.
*Source and identity of attackers are not the most useful information because they may not be relevant or accurate for every organization. Source and identity of attackers are often difficult to trace or verify, and they may not affect the organization's risk level or response strategy.
References =
*Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, Chapter 2: IT Risk Assessment, Section 2.3: Risk Identification, pp. 83-84
*Risk and Information Systems Control Review Questions, Answers & Explanations Database, 12 Month Subscription, ISACA, 2020, Question ID: 100000

Automated data indicating that risk has been reduced provides the most tenable evidence that a business process control is effective, because it shows the actual impact and outcome of the control on the risk level. A demonstration that the control is operating as designed, a successful walk-through of the associated risk assessment, and a management attestation that the control is operating effectively are not the most tenable evidence, because they are based on subjective judgments, assumptions, or expectations, not on objective facts or results. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

The most appropriate key risk indicator (KRI) for backup media that is recycled monthly is the percentage of failed restore tests. A KRI is a metric that measures the likelihood or impact of a risk, and provides an early warning signal of a potential risk event. The percentage of failed restore tests is a KRI that reflects the quality and reliability of the backup media, and indicates the possibility of data loss or corruption. A high percentage of failed restore tests would suggest that the backup media is not functioning properly, and that the risk of data unavailability is increasing. Therefore, this KRI would help the risk practitioner to monitor the risk and take corrective actions as needed. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.2, page 235.