According to the CRISC Review Manual1, single sign-on (SSO) is a method of authentication that allows a user to access multiple systems or applications with a single set of credentials. SSO can improve user convenience and productivity, but it also introduces some security risks. The greatest concern as a result of a single sign-on implementation is that unauthorized access may be gained to multiple systems, as this can compromise the confidentiality, integrity, and availability of the data and resources stored on those systems. If an attacker obtains the SSO credentials of a user, either by phishing, malware, or other means, they can Laccess all the systems or applications that the user is authorized for, without any additional authentication or verification. This can expose the organization to various threats, such as data leakage, theft, loss, corruption, manipulation, or misuse2345. References = CRISC Review Manual1, page 240, 253.

Project Delta should be deferred by management, as it has the lowest return on investment (ROI) among the four competing projects. ROI is a measure of the profitability or efficiency of a project, calculated by dividing the net benefits by the total costs. Project Delta has a net benefit of $100,000 and a total cost of $200,000, resulting in an ROI of 0.5. The other projects have higher ROIs: Project Alpha has an ROI of 1.0, Project Bravo has an ROI of 0.8, and Project Charlie has an ROI of 0.6. Therefore, Project Delta is the least attractive option for reducing overall IT risk, and management should prioritize the other projects instead. References = How to Manage Project Risk: A 5-Step Guide; Matching the right projects with the right resources; Risk Types in Project Management

*External sources of emerging threats are sources that provide information about the latest cyberattacks, hacking techniques, malware, and vulnerabilities that can affect an organization's IT systems and data.
Examples of external sources are security blogs, forums, newsletters, reports, and alerts from reputable organizations such as ISACA, Imperva, Aura, and BitSight123.
*The most useful information an organization can obtain from external sources is the indicators for detecting the presence of threats. Indicators are observable signs or patterns that can help identify, prevent, or mitigate cyberattacks. Examples of indicators are IP addresses, domain names, file hashes, network traffic, system logs, and user behavior4.
*Indicators for detecting the presence of threats are more useful than the other options because they can help an organization to:
oMonitor and analyze its IT environment for any suspicious or malicious activity oRespond quickly and effectively to any potential or actual incidents oReduce the impact and damage of cyberattacks oImprove its security posture and resilience
*Solutions for eradicating emerging threats are not the most useful information because they may not be applicable or effective for every organization, depending on its specific context, needs, and resources.
Moreover, solutions may not be available or known for some new or sophisticated threats.
*Cost to mitigate the risk resulting from threats is not the most useful information because it does not help an organization to identify or prevent cyberattacks. Cost is only one factor to consider when deciding how to manage IT risk, and it may not reflect the true value or impact of the threats.
*Source and identity of attackers are not the most useful information because they may not be relevant or accurate for every organization. Source and identity of attackers are often difficult to trace or verify, and they may not affect the organization's risk level or response strategy.
References =
*Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, Chapter 2: IT Risk Assessment, Section 2.3: Risk Identification, pp. 83-84
*Risk and Information Systems Control Review Questions, Answers & Explanations Database, 12 Month Subscription, ISACA, 2020, Question ID: 100000

Reviewing the risk register change log is the best way for management to validate whether risk response activities have been completed, because it helps to track and monitor the changes and updates that have been made to the risk register, and to verify that the risk response activities have been implemented and closed. A risk register is a document that captures, identifies, assesses and tracks risk as part of the risk management process4. A risk register change log is a record that documents the date, description, and reason for each change or update that is made to the risk register. A risk response activity is an action or task that is performed to implement the chosen risk response strategy for a specific risk, such as avoid, transfer, mitigate, or accept.
Reviewing the risk register change log is the best way, as it helps to ensure that the risk register is accurate and current, and that the risk response activities have been completed and reported. Reviewing evidence of risk acceptance, control effectiveness test results, and control design documentation are all possible ways to validate whether risk response activities have been completed, but they are not the best way, as they may not cover all the risk response activities, and they may not reflect the changes or updates in the risk register.
References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, page 101