The PRIMARY benefit of classifying information assets is that it helps to:

determine the appropriate level of control

communicate risk to senior management

determine the appropriate level of control

A payroll manager discovers that fields in certain payroll reports have been modified without authorization. Which of the following control weaknesses could have contributed MOST to this problem?

Payroll files were not under the control of a librarian.

The user requirements were not documented.

Payroll files were not under the control of a librarian.

The programmer had access to the production programs.

The programmer did not involve the user in testing.

Once a risk owner has decided to implement a control to mitigate risk, it is MOST important to develop:

a process for measuring and reporting control performance.

an alternate control design in case of failure of the identified control.

a process for bypassing control procedures in case of exceptions.

procedures to ensure the effectiveness of the control.

After migrating a key financial system to a new provider, it was discovered that a developer could gain access to the production environment. Which of the following is the BEST way to mitigate the risk in this situation?

Re-certify the application access controls.

Escalate the issue to the service provider.

Re-certify the application access controls.

Review the results of pre-migration testing.

Which of the following is the MOST important data attribute of key risk indicators (KRIs)?

The data is calculated continuously.

The data is automatically produced.

Prior to selecting key performance indicators (KPIs), itis MOST important to ensure:

measurement objectives are defined.

process flowcharts are current.

measurement objectives are defined.

data collection technology is available.

Which of the following is MOST important to the effective monitoring of key risk indicators (KRIS)?

Updating the threat inventory with new threats

Preventing the generation of false alerts

Which of the following would BEST enable a risk practitioner to embed risk management within the organization?

Engage key stakeholders in risk management practices.

Provide risk management feedback to key stakeholders.

Collect and analyze risk data for report generation.

Monitor and prioritize risk data according to the heat map.

Engage key stakeholders in risk management practices.

Which of the following is MOST helpful in determining the effectiveness of an organization's IT risk mitigation efforts?

Reviewing key risk indicators (KRIS)

Assigning identification dates for risk scenarios in the risk register

Updating impact assessments for risk scenario

Verifying whether risk action plans have been completed

Reviewing key risk indicators (KRIS)

What should a risk practitioner do FIRST when vulnerability assessment results identify a weakness in an application?

Assess the risk to determine mitigation needed.

Review regular control testing results.

Assess the risk to determine mitigation needed.

Analyze key performance indicators (KPIs).

A risk practitioner notices a trend of noncompliance with an IT-related control. Which of the following would BEST assist in making a recommendation to management?

Assessing the degree to which the control hinders business objectives

Reviewing the IT policy with the risk owner

Reviewing the roles and responsibilities of control process owners

Assessing noncompliance with control best practices

Within the three lines of defense model, the accountability for the system of internal control resides with:

the chief information officer (CIO).

An organization is considering adopting artificial intelligence (AI). Which of the following is the risk practitioner's MOST important course of action?

Identify applicable risk scenarios.

Develop key risk indicators (KRIs).

Ensure sufficient pre-implementation testing.

Identify applicable risk scenarios.

Identify the organization's critical data.

Mitigating technology risk to acceptable levels should be based PRIMARILY upon:

business sector best practices.

availability of automated solutions

A change management process has recently been updated with new testing procedures. What is the NEXT course of action?

Monitor processes to ensure recent updates are being followed.

Communicate to those who test and promote changes.

Conduct a cost-benefit analysis to justify the cost of the control.

Assess the maturity of the change management process.

Which of the following should be done FIRST when information is no longer required to support business objectives?

Assess the information against the retention policy.

Archive the information to a backup database.

Protect the information according to the classification policy.

Assess the information against the retention policy.

Securely and permanently erase the information

When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?

Risk management strategy planning

An organizations chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner's BEST course of action is to:

identify key risk indicators (KRls) for ongoing monitoring

validate the CTO's decision with the business process owner

update the risk register with the selected risk response

recommend that the CTO revisit the risk acceptance decision.

Several network user accounts were recently created without the required management approvals. Which of the following would be the risk practitioner's BEST recommendation to address this situation?

Investigate the root cause of noncompliance.

Conduct a comprehensive compliance review.

Develop incident response procedures for noncompliance.

Investigate the root cause of noncompliance.

Declare a security breach and Inform management.

Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?

Enforce an internal data access policy.

Implement segregation of duties.

Enforce an internal data access policy.

Enforce the use of digital signatures.

Apply single sign-on for access control.

A risk practitioner has become aware of production data being used in a test environment. Which of the following should be the practitioner's PRIMARY concern?

Security of the test environment

Availability of data to authorized staff

When updating the risk register after a risk assessment, which of the following is MOST important to include?

Likelihood and impact of the risk scenario

Historical losses due to past risk events

Cost to reduce the impact and likelihood

Likelihood and impact of the risk scenario

Actor and threat type of the risk scenario

The GREATEST benefit of including low-probability, high-impact events in a risk assessment is the ability to:

perform an aggregated cost-benefit analysis

develop a comprehensive risk mitigation strategy

develop understandable and realistic risk scenarios

identify root causes for relevant events

perform an aggregated cost-benefit analysis

The BEST metric to monitor the risk associated with changes deployed to production is the percentage of:

changes not requiring user acceptance testing.

personnel that have rights to make changes in production.

Which of the following criteria associated with key risk indicators (KRIs) BEST enables effective risk monitoring?

Sensitivity to changes in risk levels

Low cost of development and maintenance

Sensitivity to changes in risk levels

Use of industry risk data sources

Which of the following BEST protects an organization against breaches when using a software as a service (SaaS) application?

Security information and event management (SIEM) solutions

Data privacy impact assessment (DPIA)

Data loss prevention (DLP) tools

Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators (KRIs)?

To monitor changes in the risk environment

To provide input to management for the adjustment of risk appetite

To monitor the accuracy of threshold levels in metrics

To obtain business buy-in for investment in risk mitigation measures

Which of the following controls BEST enables an organization to ensure a complete and accurate IT asset inventory?

Performing network scanning for unknown devices

Prohibiting the use of personal devices for business

Performing network scanning for unknown devices

Requesting an asset list from business owners

Documenting asset configuration baselines

Participants in a risk workshop have become focused on the financial cost to mitigate risk rather than choosing the most appropriate response. Which of the following is the BEST way to address this type of issue in the long term?

Raise the maturity of organizational risk management.

Perform a return on investment analysis.

Review the risk register and risk scenarios.

Calculate annualized loss expectancy of risk scenarios.

Raise the maturity of organizational risk management.

Isaca CRISC Practice Test 14 - Free Online Exam Prep & Questions

A risk assessment indicates the residual risk associated with a new bring your own device (BYOD) program is within organizational risk tolerance. Which of the following should the risk practitioner recommend be done NEXT?

Implement targeted awareness training for new BYOD users.

Implement monitoring to detect control deterioration.

Identify log sources to monitor BYOD usage and risk impact.

Reduce the risk tolerance level.

Comment (0)

Isaca CRISC Practice Test 14

Question

Isaca CRISC Practice Tests

Practice Tests