Which of the following is the MOST effective way to mitigate identified risk scenarios?

Assign ownership of the risk response plan

Provide awareness in early detection of risk.

Perform periodic audits on identified risk.

areas Document the risk tolerance of the organization.

An external security audit has reported multiple findings related to control noncompliance. Which of the following would be MOST important for the risk practitioner to communicate to senior management?

The impact to the organization's risk profile

A recommendation for internal audit validation

Plans for mitigating the associated risk

Suggestions for improving risk awareness training

The impact to the organization's risk profile

A risk practitioner is reporting on an increasing trend of ransomware attacks in the industry. Which of the following information is MOST important to include to enable an informed response decision by key stakeholders?

Losses incurred by industry peers

Most recent antivirus scan reports

Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?

Configuration updates do not follow formal change control.

Operational staff perform control self-assessments.

Controls are selected without a formal cost-benefit

analysis-Management reviews security policies once every two years.

Which of the following BEST supports the communication of risk assessment results to stakeholders?

Classification of risk profiles

Periodic review of the risk register

Which of the following is MOST important to ensure when continuously monitoring the performance of a client-facing application?

Control owners approve control changes.

Objectives are confirmed with the business owner.

Control owners approve control changes.

End-user acceptance testing has been conducted.

Performance information in the log is encrypted.

The PRIMARY purpose of a maturity model is to compare the:

current state of key processes to their desired state.

organization to industry best practices.

Due to a change in business processes, an identified risk scenario no longer requires mitigation. Which of the following is the MOST important reason the risk should remain in the risk register?

To monitor for potential changes to the risk scenario

To support regulatory requirements

To prevent the risk scenario in the current environment

To monitor for potential changes to the risk scenario

To track historical risk assessment results

Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?

Increased resource availability

A risk owner has accepted a high-impact risk because the control was adversely affecting process efficiency. Before updating the risk register, it is MOST important for the risk practitioner to:

obtain approval from senior management.

ensure suitable insurance coverage is purchased.

negotiate with the risk owner on control efficiency.

reassess the risk to confirm the impact.

obtain approval from senior management.

Controls should be defined during the design phase of system development because:

it is more cost-effective to determine controls in the early design phase.

structured analysis techniques exclude identification of controls.

structured programming techniques require that controls be designed before coding begins.

technical specifications are defined during this phase.

Which of the following would present the GREATEST challenge when assigning accountability for control ownership?

Unclear reporting relationships

An organization's internal audit department is considering the implementation of robotics process automation (RPA) to automate certain continuous auditing tasks. Who would own the risk associated with ineffective design of the software bots?

Chief information officer (CIO)

Which of the following is the BEST key performance indicator (KPI) for determining how well an IT policy is aligned to business requirements?

Total cost to support the policy

Number of exceptions to the policy

Number of inquiries regarding the policy

Which of the following provides the BEST evidence that risk mitigation plans have been implemented effectively?

Change in the level of residual risk

Self-assessments by process owners

Mitigation plan progress reports

Change in the level of residual risk

Which of the following is the PRIMARY responsibility of the first line of defense related to computer-enabled fraud?

Implementing processes to detect and deter fraud

Providing oversight of risk management processes

Implementing processes to detect and deter fraud

Ensuring that risk and control assessments consider fraud

Monitoring the results of actions taken to mitigate fraud

Which of the following BEST enables the risk profile to serve as an effective resource to support business objectives?

Updating the risk profile with risk assessment results

Engaging external risk professionals to periodically review the risk

Prioritizing global standards over local requirements in the risk profile

Updating the risk profile with risk assessment results

Assigning quantitative values to qualitative metrics in the risk register

Which of the following will BEST ensure that information security risk factors are mitigated when developing in-house applications?

Include information security control specifications in business cases.

Identify information security controls in the requirements analysis

Identify key risk indicators (KRIs) as process output.

Design key performance indicators (KPIs) for security in system specifications.

Include information security control specifications in business cases.

Which of the following would provide executive management with the BEST information to make risk decisions as a result of a risk assessment?

A companion of risk assessment results to the desired state

A quantitative presentation of risk assessment results

An assessment of organizational maturity levels and readiness

A qualitative presentation of risk assessment results

What should be the PRIMARY objective for a risk practitioner performing a post-implementation review of an IT risk mitigation project?

Verifying that the risk level has been lowered

Documenting project lessons learned

Validating the risk mitigation project has been completed

Confirming that the project budget was not exceeded

Verifying that the risk level has been lowered

Which of the following is MOST important when discussing risk within an organization?

Adopting a common risk taxonomy

Using key performance indicators (KPIs)

Creating a risk communication policy

Using key risk indicators (KRIs)

Which of the following should an organization perform to forecast the effects of a disaster?

Develop a business impact analysis (BIA).

Define recovery time objectives (RTO).

Analyze capability maturity model gaps.

A business manager wants to leverage an existing approved vendor solution from another area within the organization. Which of the following is the risk practitioner's BEST course of action?

Assess the risk associated with the new use case.

Recommend allowing the new usage based on prior approval.

Request a new third-party review.

Request revalidation of the original use case.

Assess the risk associated with the new use case.

It is MOST important to the effectiveness of an IT risk management function that the associated processes are:

periodically assessed against regulatory requirements.

aligned to an industry-accepted framework.

reviewed and approved by senior management.

periodically assessed against regulatory requirements.

updated and monitored on a continuous basis.

Which of the following would be MOST beneficial as a key risk indicator (KRI)?

Current capital allocation reserves

Negative security return on investment (ROI)

Which of the following would provide the MOST comprehensive information for updating an organization's risk register?

Results of the latest risk assessment

Results of a risk forecasting analysis

A review of compliance regulations

Findings of the most recent audit

Which of the following statements in an organization's current risk profile report is cause for further action by senior management?

New key risk indicators (KRIs) have been established.

Key performance indicator (KPI) trend data is incomplete.

New key risk indicators (KRIs) have been established.

Key performance indicators (KPIs) are outside of targets.

Key risk indicators (KRIs) are lagging.

Isaca CRISC Practice Test 10 - Free Online Exam Prep & Questions

Which of the following will BEST support management repotting on risk?

Risk policy requirements

A risk register

Control self-assessment

Key performance Indicators

Comment (0)

Isaca CRISC Practice Test 10

Question

Isaca CRISC Practice Tests

Practice Tests