Review questions

1. Which of the following depicts the correct relationship between IT risk and enterprise risk?
   1. Enterprise risk is a part of IT risk.
   2. IT risk is a part of enterprise risk.
   3. These types of risk are not related to each other.
   4. Enterprise risk is independent of IT risk.
2. Which risk management life cycle step emphasizes the “You can’t protect what you don’t know exists” dictum?
   1. Risk and control monitoring
   2. Risk assessment
   3. Risk identification
   4. Risk categorization
3. Which of the following is a formal requirement by many legal and regulatory compliance frameworks?
   1. Performing vulnerability assessments
   2. Maintaining an asset inventory
   3. Deploying changes to production without testing
   4. Conducting a formal risk assessment
4. A healthcare employee accidentally sent more than 5,000 patient records in response to a phishing email. The patient records are not encrypted at rest or in transit. This scenario will fall under a material ____.
   1. Issue
   2. Event
   3. Incident
   4. Breach
...