CSIA Final Exam Version 2 Questions And Answers
Practice Questions with Solutions Newest | Already
Graded A+
Question 1
A financial institution is performing a risk
assessment and identifies that a prolonged power
outage could cause the online banking system to be
unavailable for up to 12 hours. The institution
decides to purchase backup generators and a fuel
contract to reduce the likelihood of prolonged
downtime. Which risk management strategy is
being applied?
A) Risk acceptance
B) Risk avoidance
C) Risk mitigation
D) Risk transference
Answer: C) Risk mitigation
Rationale: Risk mitigation reduces the probability or
impact of a risk. Installing backup generators
reduces the impact of a power outage, making this
1|Page
,a mitigation strategy. Acceptance would do nothing,
avoidance would stop online banking, and
transference would shift financial risk to insurance .
Question 2
An organization has identified that a specific
process violates data protection regulations.
Instead of modifying the process, leadership
decides to terminate the process entirely. This
eliminates the risk associated with that process.
Which risk treatment option has been chosen?
A) Risk mitigation
B) Risk avoidance
C) Risk transference
D) Risk acceptance
Answer: B) Risk avoidance
Rationale: Risk avoidance eliminates the risk by
discontinuing the activity that creates the risk.
Terminating the non-compliant process removes
2|Page
,the risk entirely, unlike mitigation which only
reduces it .
Question 3
What is the primary purpose of a quantitative risk
analysis?
A) To assign subjective labels like "High," "Medium,"
and "Low"
B) To assign numerical values to risks and express
them in financial terms
C) To eliminate all identified risks
D) To identify risks without assessing them
Answer: B) To assign numerical values to risks and
express them in financial terms
Rationale: Quantitative risk analysis uses numerical
values such as Annualized Loss Expectancy (ALE)
and Single Loss Expectancy (SLE) to express risk in
financial terms, enabling cost-benefit analysis .
Question 4
3|Page
, Which of the following is a limitation of qualitative
risk analysis?
A) It provides precise financial figures for risks
B) It relies on subjective assessments and can be
inconsistent
C) It does not consider the likelihood of risks
D) It cannot be used to prioritize risks
Answer: B) It relies on subjective assessments and
can be inconsistent
Rationale: Qualitative risk analysis uses subjective
labels (e.g., "High," "Medium," "Low") rather than
precise financial figures. This subjectivity can lead to
inconsistencies and varying results depending on
who performs the analysis .
Question 5
A publicly traded company must comply with the
Sarbanes-Oxley Act (SOX). The IT audit team is
reviewing access controls over the financial
reporting system. Which SOX section requires
4|Page
Practice Questions with Solutions Newest | Already
Graded A+
Question 1
A financial institution is performing a risk
assessment and identifies that a prolonged power
outage could cause the online banking system to be
unavailable for up to 12 hours. The institution
decides to purchase backup generators and a fuel
contract to reduce the likelihood of prolonged
downtime. Which risk management strategy is
being applied?
A) Risk acceptance
B) Risk avoidance
C) Risk mitigation
D) Risk transference
Answer: C) Risk mitigation
Rationale: Risk mitigation reduces the probability or
impact of a risk. Installing backup generators
reduces the impact of a power outage, making this
1|Page
,a mitigation strategy. Acceptance would do nothing,
avoidance would stop online banking, and
transference would shift financial risk to insurance .
Question 2
An organization has identified that a specific
process violates data protection regulations.
Instead of modifying the process, leadership
decides to terminate the process entirely. This
eliminates the risk associated with that process.
Which risk treatment option has been chosen?
A) Risk mitigation
B) Risk avoidance
C) Risk transference
D) Risk acceptance
Answer: B) Risk avoidance
Rationale: Risk avoidance eliminates the risk by
discontinuing the activity that creates the risk.
Terminating the non-compliant process removes
2|Page
,the risk entirely, unlike mitigation which only
reduces it .
Question 3
What is the primary purpose of a quantitative risk
analysis?
A) To assign subjective labels like "High," "Medium,"
and "Low"
B) To assign numerical values to risks and express
them in financial terms
C) To eliminate all identified risks
D) To identify risks without assessing them
Answer: B) To assign numerical values to risks and
express them in financial terms
Rationale: Quantitative risk analysis uses numerical
values such as Annualized Loss Expectancy (ALE)
and Single Loss Expectancy (SLE) to express risk in
financial terms, enabling cost-benefit analysis .
Question 4
3|Page
, Which of the following is a limitation of qualitative
risk analysis?
A) It provides precise financial figures for risks
B) It relies on subjective assessments and can be
inconsistent
C) It does not consider the likelihood of risks
D) It cannot be used to prioritize risks
Answer: B) It relies on subjective assessments and
can be inconsistent
Rationale: Qualitative risk analysis uses subjective
labels (e.g., "High," "Medium," "Low") rather than
precise financial figures. This subjectivity can lead to
inconsistencies and varying results depending on
who performs the analysis .
Question 5
A publicly traded company must comply with the
Sarbanes-Oxley Act (SOX). The IT audit team is
reviewing access controls over the financial
reporting system. Which SOX section requires
4|Page
