CISA Risk appetite Practice Question
An organization's IT governance committee is reviewing a proposal to use a public cloud provider that does not meet the organization's data encryption standards. The board has set a low risk appetite for data privacy. What is the BEST action?
⚠ Common exam trap
The trap is assuming that risk can be mitigated through monitoring or waivers, when the core issue is non-compliance with encryption standards that directly contradicts the board's risk appetite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reject the proposal until encryption requirements are met
Rejecting the proposal aligns with the board's low risk appetite for data privacy and ensures encryption standards are met before acceptance. Option A is incorrect because additional monitoring does not resolve the encryption gap. Option B is incorrect because delegation to the security team bypasses the governance committee's responsibility to enforce risk appetite. Option C is incorrect because waivers do not mitigate the fundamental encryption non-compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the proposal with additional monitoring
Why it's wrong here
Incorrect. Monitoring does not mitigate the encryption risk.
- ✗
Delegate the decision to the security team
Why it's wrong here
Incorrect. The committee must enforce risk appetite, not delegate.
- ✗
Accept the proposal but require the provider to sign a waiver
Why it's wrong here
Incorrect. A waiver does not reduce risk.
- ✓
Reject the proposal until encryption requirements are met
Why this is correct
Correct. The proposal does not align with risk appetite.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.