Answers

1. B. The second LoD is responsible for risk monitoring and oversight. Please refer to the Responsibilities of 3LoD section for additional details.
2. B. The third LoD is primarily responsible for an internal and external audit, which is an independent assurance of controls. The keyword here is independent, which is the utmost requirement of a third LoD function.
3. D. An organization should be able to accept the risk within the risk appetite. Any risk above the risk appetite should be reduced to an acceptable level by implementing adequate controls.
4. C. This is the fundamental aspect of risk management to ensure that the cost of control implementation should not outweigh the cost of assets. For example, it does not make sense to put a $1,000 lock on a $500 bicycle.
5. A. This is the only correct statement in this question. Option B is incorrect as that should be risk tolerance. Option C is incorrect as we learned in the Risk appetite, tolerance, and capacity section...