Who is the MOST appropriate owner for newly identified IT risk?

The individual with authority to commit organizational resources to mitigate the risk

The manager responsible for IT operations that will support the risk mitigation efforts

The individual with authority to commit organizational resources to mitigate the risk

A project manager capable of prioritizing the risk remediation efforts

The individual with the most IT risk-related subject matter knowledge

Which of the following would be the BEST way to help ensure the effectiveness of a data loss prevention (DLP) control that has been implemented to prevent the loss of credit card data?

Testing the transmission of credit card numbers

Reviewing logs for unauthorized data transfers

Configuring the DLP control to block credit card numbers

Testing the DLP rule change control process

Calculation of the recovery time objective (RTO) is necessary to determine the:

time required to restore files.

The PRIMARY objective for selecting risk response options is to:

reduce risk 10 an acceptable level.

identify compensating controls.

Which of the following is the MOST important consideration for a risk practitioner when making a system implementation go-live recommendation?

Results of end user acceptance testing

Completeness of system documentation

Results of end user acceptance testing

Variances between planned and actual cost

availability of in-house resources

Which of the following would BEST help an enterprise prioritize risk scenarios?

Degree of variances in the risk

Which of the following would be a risk practitioners BEST recommendation for preventing cyber intrusion?

Strengthen vulnerability remediation efforts.

Establish a cyber response plan

Implement data loss prevention (DLP) tools.

Strengthen vulnerability remediation efforts.

A contract associated with a cloud service provider MUST include:

provision for source code escrow.

the providers financial statements.

An application owner has specified the acceptable downtime in the event of an incident to be much lower than the actual time required for the response team to recover the application. Which of the following should be the NEXT course of action?

Prepare a cost-benefit analysis of alternatives available

Invoke the disaster recovery plan during an incident.

Prepare a cost-benefit analysis of alternatives available

Implement redundant infrastructure for the application.

Reduce the recovery time by strengthening the response team.

Which of the following is the MAIN reason to continuously monitor IT-related risk?

To ensure risk levels are within acceptable limits of the organization's risk appetite and risk tolerance

To redefine the risk appetite and risk tolerance levels based on changes in risk factors

To update the risk register to reflect changes in levels of identified and new IT-related risk

To ensure risk levels are within acceptable limits of the organization's risk appetite and risk tolerance

To help identify root causes of incidents and recommend suitable long-term solutions

An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program. The PRIMARY goal of this program should be to:

communicate the consequences for violations.

reduce the risk to an acceptable level.

communicate the consequences for violations.

implement industry best practices.

reduce the organization's risk appetite

Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Ensuring relevance to organizational goals

Using an aggregated view of organizational risk

Ensuring relevance to organizational goals

Relying on key risk indicator (KRI) data Including

A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption. Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?

Block unencrypted outgoing emails which contain sensitive data.

Implement a tool to create and distribute violation reports

Raise awareness of encryption requirements for sensitive data.

Block unencrypted outgoing emails which contain sensitive data.

Implement a progressive disciplinary process for email violations.

Risk management strategies are PRIMARILY adopted to:

achieve acceptable residual risk levels.

take necessary precautions for claims and losses.

achieve acceptable residual risk levels.

avoid risk for business and IT assets.

achieve compliance with legal requirements.

Which of the following would be considered a vulnerability?

Delayed removal of employee access

Authorized administrative access to HR files

Corruption of files due to malware

Server downtime due to a denial of service (DoS) attack

Which of the following would BEST help to ensure that identified risk is efficiently managed?

Periodically reviewing controls per the risk treatment plan

Reviewing the maturity of the control environment

Regularly monitoring the project plan

Maintaining a key risk indicator for each asset in the risk register

Periodically reviewing controls per the risk treatment plan

The head of a business operations department asks to review the entire IT risk register. Which of the following would be the risk manager s BEST approach to this request before sharing the register?

Determine the purpose of the request

Require a nondisclosure agreement.

Sanitize portions of the register

Determine the purpose of the request

Which of the following BEST describes the role of the IT risk profile in strategic IT-related decisions?

It facilitates the alignment of strategic IT objectives to business objectives.

It compares performance levels of IT assets to value delivered.

It facilitates the alignment of strategic IT objectives to business objectives.

It provides input to business managers when preparing a business case for new IT projects.

It helps assess the effects of IT decisions on risk exposure

Which of the following activities would BEST contribute to promoting an organization-wide risk-aware culture?

Communicating components of risk and their acceptable levels

Performing a benchmark analysis and evaluating gaps

Conducting risk assessments and implementing controls

Communicating components of risk and their acceptable levels

Participating in peer reviews and implementing best practices

Which of the following is the MAIN reason for documenting the performance of controls?

Providing accurate risk reporting

Demonstrating effective risk mitigation

Justifying return on investment

Providing accurate risk reporting

When using a third party to perform penetration testing, which of the following is the MOST important control to minimize operational impact?

Clearly define the project scope

Perform a background check on the vendor.

Require the vendor to sign a nondisclosure agreement.

Require the vendor to have liability insurance.

Clearly define the project scope

A systems interruption has been traced to a personal USB device plugged into the corporate network by an IT employee who bypassed internal control procedures. Of the following, who should be accountable?

Chief information officer (CIO)

Business continuity manager (BCM)

Chief information officer (CIO)

A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management. The BEST way to support risk-based decisions by senior management would be to:

provide a quantified detailed analysts.

recommend risk tolerance thresholds.

quantify key risk indicators (KRls).

Which of the following is MOST critical when designing controls?

Quantitative impact of the risk

Identification of key risk indicators

Which of the following is the MOST useful indicator to measure the efficiency of an identity and access management process?

Password reset volume per month

Number of tickets for provisioning new accounts

Average time to provision user accounts

Password reset volume per month

The analysis of which of the following will BEST help validate whether suspicious network activity is malicious?

Intrusion detection system (IDS) rules

Vulnerability assessment reports

Which of the following is the MOST important requirement for monitoring key risk indicators (KRls) using log analysis?

Providing accurate logs m a timely manner

Obtaining logs m an easily readable format

Providing accurate logs m a timely manner

Collecting logs from the entire set of IT systems

implementing an automated log analysis tool

Which of the following is the MOST important outcome of reviewing the risk management process?

Assuring the risk profile supports the IT objectives

Improving the competencies of employees who performed the review

Determining what changes should be nude to IS policies to reduce risk

Determining that procedures used in risk assessment are appropriate

Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an organization?

Enabling risk-based decision making

Better understanding of the risk appetite

Enabling risk-based decision making

Increasing process control efficiencies

Which of the following is the BEST method to identify unnecessary controls?

Evaluating the impact of removing existing controls

Evaluating existing controls against audit requirements

Reviewing system functionalities associated with business processes

Monitoring existing key risk indicators (KRIs)

Isaca CRISC Practice Test 1 - Free Online Exam Prep & Questions

The acceptance of control costs that exceed risk exposure is MOST likely an example of:

low risk tolerance.

corporate culture misalignment.

corporate culture alignment.

high risk tolerance

Comment (0)

Isaca CRISC Practice Test 1

Question

Isaca CRISC Practice Tests

Practice Tests