Which of the following methods is the BEST way to measure the effectiveness of automated information security controls prior to going live?

Testing in a non-production environment

Performing a security control review

Reviewing the security audit report

A bank wants to send a critical payment order via email to one of its offshore branches. Which of the following is the BEST way to ensure the message reaches the intended recipient without alteration?

Apply multi-factor authentication

Which of the following will be MOST effective to mitigate the risk associated with the loss of company data stored on personal devices?

Enforced authentication and data encryption

An acceptable use policy for personal devices

Required user log-on before synchronizing data

Enforced authentication and data encryption

Security awareness training and testing

Who should be responsible for strategic decisions on risk management?

Chief information officer (CIO)

Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?

Outcomes of periodic risk assessments

The outsourcing of related IT processes

Outcomes of periodic risk assessments

Changes in service level objectives

Findings from continuous monitoring

Which of the following will BEST help ensure that risk factors identified during an information systems review are addressed?

Assigning action items and deadlines to specific individuals

Informing business process owners of the risk

Reviewing and updating the risk register

Assigning action items and deadlines to specific individuals

Implementing new control technologies

Following a review of a third-party vendor, it is MOST important for an organization to ensure:

results of the review are accurately reported to management.

identified findings are reviewed by the organization.

results of the review are validated by internal audit.

identified findings are approved by the vendor.

A risk practitioner has observed that risk owners have approved a high number of exceptions to the information security policy. Which of the following should be the risk practitioner's GREATEST concern?

Aggregate risk is approaching the tolerance threshold

Security policies are being reviewed infrequently.

Controls are not operating efficiently.

Vulnerabilities are not being mitigated

Aggregate risk is approaching the tolerance threshold

Which of the following BEST promotes commitment to controls?

Assigning appropriate resources

Assigning a quality control review

Performing regular independent control reviews

Which of the following is MOST important for developing effective key risk indicators (KRIs)?

Including input from risk and business unit management

Engaging sponsorship by senior management

Utilizing data and resources internal to the organization

Including input from risk and business unit management

Developing in collaboration with internal audit

The MOST important reason to monitor key risk indicators (KRIs) is to help management:

analyze the chain of risk events.

identity early risk transfer strategies.

lessen the impact of realized risk.

analyze the chain of risk events.

identify the root cause of risk events.

The implementation of a risk treatment plan will exceed the resources originally allocated for the risk response. Which of the following should be the risk owner's NEXT action?

Accept the risk of not implementing.

Update the implementation plan.

Which of the following is the PRIMARY benefit of identifying and communicating with stakeholders at the onset of an IT risk assessment?

Defining the risk assessment scope

Selecting the risk assessment framework

An organization has just implemented changes to close an identified vulnerability that impacted a critical business process. What should be the NEXT course of action?

Perform a business impact analysis (BIA)

Which of the following is MOST important for a risk practitioner to consider when evaluating plans for changes to IT services?

Impact assessment of the change

Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?

An intrusion detection system (IDS)

A risk practitioner shares the results of a vulnerability assessment for a critical business application with the business manager. Which of the following is the NEXT step?

Evaluate the impact of the vulnerabilities to the business application.

Develop a risk action plan to address the findings.

Evaluate the impact of the vulnerabilities to the business application.

Escalate the findings to senior management and internal audit.

Conduct a penetration test to validate the vulnerabilities from the findings.

A third-party vendor has offered to perform user access provisioning and termination. Which of the following control accountabilities is BEST retained within the organization?

Authorizing user access requests

Performing user access recertification

Terminating inactive user access

Which of the following resources is MOST helpful when creating a manageable set of IT risk scenarios?

Organizational strategy and objectives

Results of current and past risk assessments

Organizational strategy and objectives

Lessons learned from materialized risk scenarios

Internal and external audit findings

The BEST key performance indicator (KPI) to measure the effectiveness of a vendor risk management program is the percentage of:

vendors providing risk assessments on time.

vendor contracts reviewed in the past year.

vendor risk mitigation action items completed on time.

vendors that have reported control-related incidents.

What is the MOST important consideration when aligning IT risk management with the enterprise risk management (ERM) framework?

Senior management participation

Which of the following is the MOST important enabler of effective risk management?

User awareness of policies and procedures

Implementation of proper controls

Continuous monitoring of threats and vulnerabilities

Which of the following is MOST important when defining controls?

Aligning them with business objectives

Identifying monitoring mechanisms

Including them in the risk register

Aligning them with business objectives

Prototyping compensating controls

A risk practitioner is reviewing a vendor contract and finds there is no clause to control privileged access to the organization's systems by vendor employees. Which of the following is the risk practitioner's BEST course of action?

Document this concern as a threat and conduct an impact analysis.

Contact the control owner to determine if a gap in controls exists.

Add this concern to the risk register and highlight it for management review.

Report this concern to the contracts department for further action.

Document this concern as a threat and conduct an impact analysis.

Which of the following is the PRIMARY objective for automating controls?

Improving control process efficiency

Facilitating continuous control monitoring

Complying with functional requirements

Reducing the need for audit reviews

Which of the following is MOST important when developing risk scenarios?

The scenarios are relevant to the organization.

The scenarios are based on industry best practice.

The scenarios focus on current vulnerabilities.

The scenarios are relevant to the organization.

The scenarios include technical consequences.

An organization has initiated a project to implement an IT risk management program for the first time. The BEST time for the risk practitioner to start populating the risk register is when:

calculating impact and likelihood.

completing the controls catalog.

Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?

To minimize subjectivity of assessments

To enhance compliance with standards

To minimize subjectivity of assessments

To increase consensus among peers

To provide assessments for benchmarking

Which of the following would be the GREATEST concern related to data privacy when implementing an Internet of Things (loT) solution that collects personally identifiable information (Pll)?

A privacy impact assessment has not been completed.

Data encryption methods apply to a subset of Pll obtained.

The data privacy officer was not consulted.

Insufficient access controls are used on the loT devices.

Isaca CRISC Practice Test 11 - Free Online Exam Prep & Questions

Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?

Isaca CRISC Practice Test 11

Question

Isaca CRISC Practice Tests

Practice Tests