Review questions

1. In the 3LoD model, which LoD is responsible for risk monitoring and oversight?
   1. The first LoD
   2. The second LoD
   3. The third LoD
   4. All of the above
2. What is the primary responsibility of the third LoD?
   1. Policy and procedure development
   2. Provide independent assurance of controls
   3. Perform periodic user reviews
   4. Restrict least privileged roles
3. The amount of risk an organization is willing to accept is known as ____::
   1. Risk tolerance
   2. Risk capacity
   3. Risk profile
   4. Risk appetite
4. The information security manager has performed a risk assessment and provided recommendations for enhancing the controls of the Business Process Owner (BPO). After much deliberation, the BPO has decided to accept the risk. The BEST reason for the BPO to accept the risk is ____:
   1. Difficulty to implement the suggested controls
   2. Unavailability of resources to implement the controls
   3. Cost of control implementation outweighs the cost of assets
   4. Budgetary constraints
5. Which of the following statements is correct?
   1. Breaching...