Which of the following provides the MOST up-to-date information about the effectiveness of an organization's overall IT control environment?

Key performance indicators (KPIs)

An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses. What should be done NEXT in response to this report?

Analyze the impact of the provider's control weaknesses to the business.

Migrate all data to another compliant service provider.

Analyze the impact of the provider's control weaknesses to the business.

Conduct a follow-up audit to verify the provider's control weaknesses.

Review the contract to determine if penalties should be levied against the provider.

A global organization is planning to collect customer behavior data through social media advertising. Which of the following is the MOST important business risk to be considered?

Regulatory requirements may differ in each country.

Data sampling may be impacted by various industry restrictions.

Business advertising will need to be tailored by country.

The data analysis may be ineffective in achieving objectives.

When evaluating enterprise IT risk management it is MOST important to:

confirm the organization's risk appetite and tolerance

create new control processes to reduce identified IT risk scenarios

confirm the organization's risk appetite and tolerance

report identified IT risk scenarios to senior management

review alignment with the organization's investment plan

The MAIN reason for creating and maintaining a risk register is to:

account for identified key risk factors.

assess effectiveness of different projects.

define the risk assessment methodology.

ensure assets have low residual risk.

account for identified key risk factors.

Which of the following is MOST important to the successful development of IT risk scenarios?

Threat and vulnerability analysis

Internal and external audit reports

Threat and vulnerability analysis

Control effectiveness assessment

Which of The following should be the FIRST step when a company is made aware of new regulatory requirements impacting IT?

Prioritize impact to the business units.

Review the risk tolerance and appetite.

Which of the following represents a vulnerability?

A standard procedure for applying software patches two weeks after release

An identity thief seeking to acquire personal financial data from an organization

Media recognition of an organization's market leadership in its industry

A standard procedure for applying software patches two weeks after release

An employee recently fired for insubordination

Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?

To monitor the achievement of set objectives

To measure business exposure to risk

To identify control vulnerabilities

To monitor the achievement of set objectives

To raise awareness of operational issues

The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:

suppliers used by the organization.

Which of the following is the BEST course of action to help reduce the probability of an incident recurring?

Update the incident response plan.

Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

Obtain objective assessment of the control environment.

Ensure the risk profile is defined and communicated.

Validate the threat management process.

Obtain an objective view of process gaps and systemic errors.

An organization has been notified that a disgruntled, terminated IT administrator has tried to break into the corporate network. Which of the following discoveries should be of GREATEST concern to the organization?

Authentication logs have been disabled.

An external vulnerability scan has been detected.

A brute force attack has been detected.

An increase in support requests has been observed.

Which of the following should be done FIRST when developing a data protection management plan?

Perform a cost-benefit analysis.

Which of the following is the BEST way to determine whether new controls mitigate security gaps in a business system?

Perform a vulnerability assessment.

Complete an offsite business continuity exercise.

Conduct a compliance check against standards.

Perform a vulnerability assessment.

Measure the change in inherent risk.

A vulnerability assessment of a vendor-supplied solution has revealed that the software is susceptible to cross-site scripting and SQL injection attacks. Which of the following will BEST mitigate this issue?

Require the software vendor to remediate the vulnerabilities

Monitor the databases for abnormal activity

Approve exception to allow the software to continue operating

Require the software vendor to remediate the vulnerabilities

Accept the risk and let the vendor run the software as is

Which of the following methods is an example of risk mitigation?

Enforcing change and configuration management processes

Not providing capability for employees to work remotely

Outsourcing the IT activities and infrastructure

Enforcing change and configuration management processes

Taking out insurance coverage for IT-related incidents

A service provider is managing a client's servers. During an audit of the service, a noncompliant control is discovered that will not be resolved before the next audit because the client cannot afford the downtime required to correct the issue. The service provider's MOST appropriate action would be to:

ask the client to document the formal risk acceptance for the provider

develop a risk remediation plan overriding the client's decision

make a note for this item in the next audit explaining the situation

insist that the remediation occur for the benefit of other customers

ask the client to document the formal risk acceptance for the provider

The PRIMARY purpose of IT control status reporting is to:

ensure compliance with IT governance strategy.

assist internal audit in evaluating and initiating remediation efforts.

benchmark IT controls with Industry standards.

facilitate the comparison of the current and desired states.

Which of the following risk management practices BEST facilitates the incorporation of IT risk scenarios into the enterprise-wide risk register?

IT risk scenarios are developed in the context of organizational objectives.

Key risk indicators (KRls) are developed for key IT risk scenarios

IT risk scenarios are assessed by the enterprise risk management team

Risk appetites for IT risk scenarios are approved by key business stakeholders.

IT risk scenarios are developed in the context of organizational objectives.

Which of the following is the MOST important technology control to reduce the likelihood of fraudulent payments committed internally?

Daily transaction reconciliation

While reviewing a contract of a cloud services vendor, it was discovered that the vendor refuses to accept liability for a sensitive data breach. Which of the following controls will BES reduce the risk associated with such a data breach?

Engaging a third party to validate operational controls

Ensuring the vendor does not know the encryption key

Engaging a third party to validate operational controls

Using the same cloud vendor as a competitor

Using field-level encryption with a vendor supplied key

Which of the following data would be used when performing a business impact analysis (BIA)?

Expected costs for recovering the business

Cost-benefit analysis of running the current business

Projected impact of current business on future business

Expected costs for recovering the business

Which of the following MUST be updated to maintain an IT risk register?

Enterprise-wide IT risk assessment

Expected frequency and potential impact

Enterprise-wide IT risk assessment

Which of the following is the GREATEST benefit when enterprise risk management (ERM) provides oversight of IT risk management?

Aligning IT with short-term and long-term goals of the organization

Ensuring the IT budget and resources focus on risk management

Ensuring senior management's primary focus is on the impact of identified risk

Prioritizing internal departments that provide service to customers

An organization automatically approves exceptions to security policies on a recurring basis. This practice is MOST likely the result of:

a lack of mitigating actions for identified risk

Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?

Qualitative measures are better able to incorporate expert judgment.

Qualitative measures require less ongoing monitoring.

Qualitative measures are better aligned to regulatory requirements.

Qualitative measures are better able to incorporate expert judgment.

Qualitative measures are easier to update.

Which of the following is the BEST indicator of the effectiveness of IT risk management processes?

Percentage of high-risk scenarios for which risk action plans have been developed

Percentage of business users completing risk training

Percentage of high-risk scenarios for which risk action plans have been developed

Number of key risk indicators (KRIs) defined

Time between when IT risk scenarios are identified and the enterprise's response

A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls. Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?

Identify previous data breaches using the startup company's audit reports.

Have the data privacy officer review the startup company's data protection policies.

Classify and protect the data according to the parent company's internal standards.

Implement a firewall and isolate the environment from the parent company's network.

Which of the following is the BEST indication of a mature organizational risk culture?

Risk owners understand and accept accountability for risk.

Corporate risk appetite is communicated to staff members.

Risk owners understand and accept accountability for risk.

Risk policy has been published and acknowledged by employees.

Management encourages the reporting of policy breaches.

Isaca CRISC Practice Test 15 - Free Online Exam Prep & Questions

Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 15

Question

Isaca CRISC Practice Tests

Practice Tests