A risk practitioner has just learned about new done FIRST?

Analyze the impact to the organization.

Design IT risk mitigation plans.

When testing the security of an IT system, il is MOST important to ensure that;

agreement is obtained from stakeholders.

tests are conducted after business hours.

operators are unaware of the test.

external experts execute the test.

agreement is obtained from stakeholders.

Which of the following risk scenarios would be the GREATEST concern as a result of a single sign-on implementation?

Unauthorized access may be gained to multiple systems.

User access may be restricted by additional security.

Unauthorized access may be gained to multiple systems.

Security administration may become more complex.

User privilege changes may not be recorded.

Which of the following would provide the MOST objective assessment of the effectiveness of an organization's security controls?

Security operations center review

A risk owner has identified a risk with high impact and very low likelihood. The potential loss is covered by insurance. Which of the following should the risk practitioner do NEXT?

Validate the risk response with internal audit.

Evaluate outsourcing the process.

A maturity model will BEST indicate:

certification and accreditation.

An organization has recently updated its disaster recovery plan (DRP). Which of the following would be the GREATEST risk if the new plan is not tested?

Service interruptions may be longer than anticipated.

External resources may need to be involved.

Data privacy regulations may be violated.

Recovery costs may increase significantly.

Service interruptions may be longer than anticipated.

What are the MOST important criteria to consider when developing a data classification scheme to facilitate risk assessment and the prioritization of risk mitigation activities?

Business criticality and sensitivity

Volume and scope of data generated daily

Business criticality and sensitivity

Recovery point objective (RPO) and recovery time objective (RTO)

A control owner identifies that the organization's shared drive contains personally identifiable information (Pll) that can be accessed by all personnel. Which of the following is the MOST effective risk response?

Protect sensitive information with access controls.

Implement a data loss prevention (DLP) solution.

Re-communicate the data protection policy.

Implement a data encryption solution.

An organization has decided to outsource a web application, and customer data will be stored in the vendor's public cloud. To protect customer data, it is MOST important to ensure which of the following?

The vendor's responsibilities are defined in the contract.

The organization's incident response procedures have been updated.

The vendor stores the data in the same jurisdiction.

Administrative access is only held by the vendor.

The vendor's responsibilities are defined in the contract.

Which of the following is the PRIMARY reason to establish the root cause of an IT security incident?

Avoid recurrence of the incident.

Assign responsibility and accountability for the incident.

Prepare a report for senior management.

Avoid recurrence of the incident.

IT disaster recovery point objectives (RPOs) should be based on the:

maximum tolerable loss of data.

An IT risk practitioner is evaluating an organization's change management controls over the last six months. The GREATEST concern would be an increase in:

change-related exceptions per month.

rolled back changes below management's thresholds.

change-related exceptions per month.

the average implementation time for changes.

number of user stories approved for implementation.

A key risk indicator (KRI) threshold has reached the alert level, indicating data leakage incidents are highly probable. What should be the risk practitioner's FIRST course of action?

Review incident handling procedures.

Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?

The business case for the use of loT

The network that loT devices can access

Which of the following is MOST helpful in developing key risk indicator (KRl) thresholds?

Control performance predictions

IT service level agreements (SLAs)

Which of the following is the MOST important objective of regularly presenting the project risk register to the project steering committee?

To track the status of risk mitigation actions

To allocate budget for resolution of risk issues

To determine if new risk scenarios have been identified

To ensure the project timeline is on target

To track the status of risk mitigation actions

Which of the following is the PRIMARY reason to establish the root cause of an IT security incident?

Avoid recurrence of the incident.

Prepare a report for senior management.

Assign responsibility and accountability for the incident.

Avoid recurrence of the incident.

Which of the following is MOST important to include in a Software as a Service (SaaS) vendor agreement?

A service level agreement (SLA)

A requirement to adopt an established risk management framework

A requirement to provide an independent audit report

Which of the following should be the PRIMARY focus of an independent review of a risk management process?

Consistency of risk process results

Accuracy of risk tolerance levels

Consistency of risk process results

To minimize risk in a software development project, when is the BEST time to conduct a risk analysis?

During the business requirement definitions phase

Before periodic steering committee meetings

At each stage of the development life cycle

During the business case development

A large organization needs to report risk at all levels for a new centralized visualization project to reduce cost and improve performance. Which of the following would MOST effectively represent the overall risk of the project to senior management?

Aggregated key performance indicators (KPls)

An organization has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data. What should be The FIRST course of action?

Invoke the incident response plan.

Conduct a forensic investigation.

Invoke the business continuity plan (BCP).

The PRIMARY purpose of vulnerability assessments is to:

detect weaknesses that could lead to system compromise.

provide clear evidence that the system is sufficiently secure.

determine the impact of potential threats.

test intrusion detection systems (IDS) and response procedures.

detect weaknesses that could lead to system compromise.

Which of the following BEST facilitates the development of effective IT risk scenarios?

Utilization of a cross-functional team

Participation by IT subject matter experts

Integration of contingency planning

Validation by senior management

Which of the following is MOST helpful to management when determining the resources needed to mitigate a risk?

A business impact analysis (BIA)

Which of the following is the MOST important reason to revisit a previously accepted risk?

To ensure risk levels have not changed

To review the risk acceptance with new stakeholders

To ensure risk levels have not changed

To ensure controls are still operating effectively

Which of the following is the GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs?

There is a lack of technology recovery options.

An IT project manager is not assigned to oversee development.

Controls are not applied to the applications.

There is a lack of technology recovery options.

The applications are not captured in the risk profile.

Which of the following activities is PRIMARILY the responsibility of senior management?

Prioritization of risk scenarios based on severity

Bottom-up identification of emerging risks

Categorization of risk scenarios against a standard taxonomy

Prioritization of risk scenarios based on severity

Isaca CRISC Practice Test 12 - Free Online Exam Prep & Questions

Which of the following will MOST improve stakeholders' understanding of the effect of a potential threat?

Isaca CRISC Practice Test 12

Question

Isaca CRISC Practice Tests

Practice Tests