CRISC Exam PDF [2024] Tests Free Updated Today with Correct 1426 Questions
ISACA CRISC Exam Preparation Guide and PDF Download
NEW QUESTION # 115
Which of the following is NOT true for risk governance?
- A. Risk governance is based on the principles of cooperation, participation, mitigation and sustainability, and is adopted to achieve more effective risk management.
- B. Explanation:
Risk governance is a continuous life cycle that requires regular reporting and ongoing review, not
once a year. - C. Risk governance is a systemic approach to decision making processes associated to natural and technological risks.
- D. Risk governance seeks to reduce risk exposure and vulnerability by filling gaps in risk policy.
- E. Risk governance requires reporting once a year.
Answer: E
Explanation:
A, and C are incorrect. These are true for risk governace.
NEW QUESTION # 116
The PRIMARY reason for establishing various Threshold levels for a set of key risk indicators (KRIs) is to:
- A. highlight trends of developing risk.
- B. take appropriate actions in a timely manner.
- C. set different triggers for each stakeholder.
- D. ensure accurate and reliable monitoring.
Answer: D
NEW QUESTION # 117
Which of the following is the BEST method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system?
- A. Systems log correlation analysis
- B. Penetration testing
- C. Vulnerability scanning
- D. Monitoring of intrusion detection system (IDS) alerts
Answer: B
Explanation:
Section: Volume D
NEW QUESTION # 118
Which of the following should be considered FIRST when assessing risk associated with the adoption of emerging technologies?
- A. Control self-assessment (CSA)
- B. Cost-benefit analysis
- C. Business requirements
- D. Organizational strategy
Answer: C
NEW QUESTION # 119
For the first time, the procurement department has requested that IT grant remote access to third-party suppliers. Which of the following is the BEST course of action for IT in responding to the request?
- A. Propose a solution after analyzing IT risk
- B. Design and implement a secure remote access process
- C. Design and implement key authentication controls
- D. Adequate internal standards to fit the new business case
Answer: A
Explanation:
Section: Volume D
NEW QUESTION # 120
The MOST effective way to increase the likelihood that risk responses will be implemented is to:
- A. review progress reports
- B. perform regular audits.
- C. create an action plan
- D. assign ownership
Answer: D
Explanation:
* Risk responses are the actions or strategies that are taken to address the risks that may affect the organization's objectives, performance, or value creation12.
* The most effective way to increase the likelihood that risk responses will be implemented is to assign ownership, which is the process of identifying and appointing the individuals or groups who are responsible and accountable for the execution and monitoring of the risk responses34.
* Assigning ownership is the most effective way because it ensures the clarity and commitment of the roles and responsibilities for the risk responses, and avoids the confusion or ambiguity that may arise from the lack of ownership34.
* Assigning ownership is also the most effective way because it enhances the communication and collaboration among the stakeholders involved in the risk responses, and provides the feedback and input that are necessary for the improvement and optimization of the risk responses34.
* The other options are not the most effective way, but rather possible steps or tools that may support or complement the assignment of ownership. For example:
* Creating an action plan is a step that involves defining and documenting the specific tasks, resources, timelines, and deliverables for the risk responses34. However, this step is not the most effective way because it does not guarantee the implementation of the risk responses, especially if there is no clear or agreed ownership for the action plan34.
* Reviewing progress reports is a tool that involves collecting and analyzing the information and data on the status and performance of the risk responses, and identifying the issues or gaps that need to be addressed34. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses, especially if there is no ownership for the progress reports or the corrective actions34.
* Performing regular audits is a tool that involves conducting an independent and objective assessment of the adequacy and effectiveness of the risk responses, and providing the findings and recommendations for improvement56. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses, especially if there is no ownership for the audit results or the follow-up actions56. References =
* 1: Risk IT Framework, ISACA, 2009
* 2: IT Risk Management Framework, University of Toronto, 2017
* 3: Risk Response Plan in Project Management: Key Strategies & Tips1
* 4: ProjectManagement.com - How to Implement Risk Responses2
* 5: IT Audit and Assurance Standards, ISACA, 2014
* 6: IT Audit and Assurance Guidelines, ISACA, 2014
NEW QUESTION # 121
A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which of the following is the risk practitioner's BEST course of action?
- A. Document the gap in the risk register and report to senior management.
- B. Include a right to audit clause in the service provider contract.
- C. Collaborate with the risk owner to determine the risk response plan.
- D. Advise the risk owner to accept the risk.
Answer: A
Explanation:
The best course of action for the risk practitioner who has identified that the agreed RTO with a SaaS provider is longer than the business expectation is to document the gap in the risk register and report to senior management. The risk register is the document that records the details of all identified risks, including their sources, causes, impacts, likelihood, and responses. The risk register should be updated regularly to reflect any changes in the risk environment or the risk status. Reporting to senior management is also important, because senior management is the highest level of authority and responsibility in the organization, and they are responsible for setting the strategic direction, objectives, and risk appetite of the organization. Senior management should also oversee the risk management process, and ensure that the risks are aligned with the organization's goals and values. By documenting the gap in the risk register and reporting to senior management, the risk practitioner can communicate the issue clearly and effectively, and seek guidance and support for resolving the problem. Collaborating with the risk owner, including a right to audit clause, or advising the risk owner to accept the risk are not the best courses of action, because they may not be feasible, effective, or desirable in some situations, or they may require senior management approval or involvement. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 4-13.
NEW QUESTION # 122
A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner's NEXT step?
- A. Develop a mechanism for monitoring residual risk.
- B. Update the risk register with the results.
- C. Prepare a business case for the response options.
- D. Identify resources for implementing responses.
Answer: C
NEW QUESTION # 123
Jenny is the project manager for the NBT projects. She is working with the project team and several subject matter experts to perform the quantitative risk analysis process. During this process she and the project team uncover several risks events that were not previously identified. What should Jenny do with these risk events?
- A. The events should continue on with quantitative risk analysis.
- B. The events should be determined if they need to be accepted or responded to.
- C. The events should be entered into the risk register.
- D. The events should be entered into qualitative risk analysis.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
All identified risk events should be entered into the risk register.
A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
A description of the risk
The impact should this event actually occur
The probability of its occurrence
Risk Score (the multiplication of Probability and Impact)
A summary of the planned response should the event occur
A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the
event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.
Incorrect Answers:
A: Before the risk events are analyzed they should be documented in the risk register.
B: The risks should first be documented and analyzed.
D: These risks should first be identified, documented, passed through qualitative risk analysis and then it should be determined if they should pass through the quantitative risk analysis process.
NEW QUESTION # 124
You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?
- A. Resource Management Plan
- B. Stakeholder management strategy
- C. Explanation:
The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project. - D. Risk Management Plan
- E. Communications Management Plan
Answer: E
Explanation:
is incorrect. The stakeholder management strategy does not address risk communications. Answer: A is incorrect. The Risk Management Plan defines risk identification, analysis, response, and monitoring. Answer: D is incorrect. The Resource Management Plan does not define risk communications.
NEW QUESTION # 125
An organization has recently been experiencing frequent data corruption incidents. Implementing a file corruption detection tool as a risk response strategy will help to:
- A. reduce the impact of future events
- B. address the root cause
- C. reduce the likelihood of future events
- D. restore availability
Answer: A
Explanation:
Implementing a file corruption detection tool as a risk response strategy will help to reduce the impact of future events, as it will enable the organization to identify and correct the corrupted files before they cause further damage or loss. A file corruption detection tool is a software that scans and verifies the integrity and validity of the files, and alerts the users or administrators of any anomalies or errors. This helps to minimize the disruption and downtime caused by the data corruption incidents, and to preserve the quality and reliability of the data. Implementing a file corruption detection tool will not reduce the likelihood of future events, as it does not prevent or mitigate the causes or sources of the data corruption incidents. It will not restore availability, as it does not recover or restore the corrupted files, but only detects them. It will not address the root cause, as it does not analyze or eliminate the underlying factors that lead to the data corruption incidents.
References = CRISC Certified in Risk and Information Systems Control - Question215; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 215.
NEW QUESTION # 126
Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?
- A. Encrypt data before it leaves the organization.
- B. Encrypt the data in the cloud database.
- C. Encrypt physical hard drives within the cloud.
- D. Use an encrypted tunnel lo connect to the cloud.
Answer: A
Explanation:
Encrypting data before it leaves the organization is the best way to protect sensitive data from administrators within a public cloud, as it ensures that the data is secured at the source and remains encrypted throughout the transmission and storage in the cloud. Using an encrypted tunnel to connect to the cloud, encrypting the data in the cloud database, and encrypting physical hard drives within the cloud are not the best ways, as they may not prevent the cloud administrators from accessing the data or the encryption keys, or may not protect the data from unauthorized interception or modification during the transmission. References = CRISC Review Manual,
7th Edition, page 153.
NEW QUESTION # 127
Which of the following would MOST likely cause management to unknowingly accept excessive risk?
- A. Inaccurate risk ratings
- B. Lack of preventive controls
- C. Risk tolerance being set too low
- D. Satisfactory audit results
Answer: A
Explanation:
Inaccurate risk ratings would most likely cause management to unknowingly accept excessive risk, as they may not reflect the true level of risk exposure and impact, and may lead to inappropriate risk responses or decisions. Satisfactory audit results, risk tolerance being set too low, and lack of preventive controls are not the most likely causes, as they may indicate a different risk management issue, such as over-reliance on audit assurance, misalignment of risk tolerance and appetite, or insufficient risk mitigation, respectively. References = CRISC Review Manual, 7th Edition, page 109.
NEW QUESTION # 128
Which of the following is MOST helpful in identifying new risk exposures due to changes in the business environment?
- A. Industry benchmarking
- B. Control gap analysis
- C. SWOT analysis
- D. Standard operating procedures
Answer: C
Explanation:
* New risk exposures due to changes in the business environment are the possibilities and impacts of new or emerging threats or opportunities that may affect the organization's objectives, performance, or value creation, as a result of changes in the internal or external factors that influence the organization's operations, such as technology, competition, regulation, or customer behavior12.
* The most helpful tool in identifying new risk exposures due to changes in the business environment is a SWOT analysis, which is a technique that involves identifying and analyzing the strengths, weaknesses, opportunities, and threats (SWOT) that are relevant to the organization's situation, goals, and capabilities34.
* A SWOT analysis is the most helpful tool because it helps the organization to scan and assess the business environment, and to identify and prioritize the new or emerging risk exposures that may arise from the changes in the environment34.
* A SWOT analysis is also the most helpful tool because it helps the organization to align and adapt its strategy and actions to the changes in the environment, and to leverage its strengths and opportunities, and mitigate its weaknesses and threats34.
* The other options are not the most helpful tools, but rather possible sources or inputs that may be used in a SWOT analysis. For example:
* Standard operating procedures are documents that describe the routine tasks and processes that are performed by the organization, and the policies and standards that govern them56. However, these documents are not the most helpful tools because they may not reflect or capture the changes in the business environment, and they may need to be revised or updated to address the new or emerging risk exposures56.
* Industry benchmarking is a technique that involves comparing and contrasting the performance and practices of the organization with those of the similar or leading organizations in the same or related industry, and identifying the gaps or opportunities for improvement78. However, this technique is not the most helpful tool because it may not provide a comprehensive or holistic view of the business environment, and it may not align with the organization's specific situation, goals, or capabilities78.
* Control gap analysis is a technique that involves assessing and evaluating the adequacy and effectiveness of the controls that are designed and implemented to mitigate the risks, and
* identifying and addressing the areas or aspects that need to be improved or added . However, this technique is not the most helpful tool because it is reactive rather than proactive, and it may not identify or anticipate the new or emerging risk exposures that may result from the changes in the business environment . References =
* 1: Risk IT Framework, ISACA, 2009
* 2: IT Risk Management Framework, University of Toronto, 2017
* 3: SWOT Analysis - ISACA1
* 4: SWOT Analysis: What It Is and When to Use It2
* 5: Standard Operating Procedure - Wikipedia3
* 6: How to Write Effective Standard Operating Procedures (SOP)4
* 7: Benchmarking - Wikipedia5
* 8: Benchmarking: Definition, Types, Process, Advantages & Examples6
* : Control Gap Analysis - ISACA7
* : Control Gap Analysis: A Step-by-Step Guide8
NEW QUESTION # 129
Which of the following should be the FIRST course of action if the risk associated with a new technology is found to be increasing?
- A. Escalate the risk to senior management.
- B. Implement additional controls.
- C. Re-evaluate current controls.
- D. Revise the current risk action plan.
Answer: D
Explanation:
A risk action plan is a document that outlines the actions to be taken to mitigate or avoid a risk. A risk action plan should be revised when the risk associated with a new technology is found to be increasing, as this indicates that the current plan is not effective or sufficient. Revising the risk action plan can help identify the root causes of the risk increase, evaluate the effectiveness of current controls, and implement additional or alternative controls as needed. Re-evaluating current controls, escalating the risk to senior management, and implementing additional controls are possible steps in the revision process, but they are not the first course of action. The first course of action should be to update the risk action plan to reflect the current risk situation and the appropriate risk response.
NEW QUESTION # 130
Which of the following is an administrative control?
- A. Data loss prevention program
- B. Water detection
- C. Reasonableness check
- D. Session timeout
Answer: A
Explanation:
Explanation/Reference:
Explanation:
NEW QUESTION # 131
......
Verified & Correct CRISC Practice Test Reliable Source Jul 05, 2024 Updated: https://exampasspdf.testkingit.com/ISACA/latest-CRISC-exam-dumps.html