Which of the following statements BEST illustrates the relationship between key performance indicators (KPIs) and key control indicators (KCIs)?

KPIs and KCIs both contribute to understanding of control effectiveness.

KPIs measure manual controls, while KCIs measure automated controls.

KPIs and KCIs both contribute to understanding of control effectiveness.

A robust KCI program will replace the need to measure KPIs.

KCIs are applied at the operational level while KPIs are at the strategic level.

The BEST way to determine the likelihood of a system availability risk scenario is by assessing the:

redundancy of technical infrastructure.

availability of fault tolerant software.

strategic plan for business growth.

vulnerability scan results of critical systems.

redundancy of technical infrastructure.

An organization uses a vendor to destroy hard drives. Which of the following would BEST reduce the risk of data leakage?

Implement an encryption policy for the hard drives.

Require the vendor to degauss the hard drives

Implement an encryption policy for the hard drives.

Require confirmation of destruction from the IT manager.

Use an accredited vendor to dispose of the hard drives.

The BEST key performance indicator (KPI) for monitoring adherence to an organization's user accounts provisioning practices is the percentage of:

accounts without documented approval

user accounts with default passwords

active accounts belonging to former personnel

accounts with dormant activity.

Which of the following BEST enables the identification of trends in risk levels?

Measurements for key risk indicators (KRIs) are repeatable

Correlation between risk levels and key risk indicators (KRIs) is positive.

Measurements for key risk indicators (KRIs) are repeatable

Quantitative measurements are used for key risk indicators (KRIs).

Qualitative definitions for key risk indicators (KRIs) are used.

While reviewing an organization's monthly change management metrics, a risk practitioner notes that the number of emergency changes has increased substantially Which of the following would be the BEST approach for the risk practitioner to take?

Temporarily suspend emergency changes.

Document the control deficiency in the risk register.

Continue monitoring change management metrics.

Which of the following is the MOST effective control to maintain the integrity of system configuration files?

Monitoring against the configuration standard

Recording changes to configuration files

Implementing automated vulnerability scanning

Restricting access to configuration documentation

Monitoring against the configuration standard

When reviewing a business continuity plan (BCP). which of the following would be the MOST significant deficiency?

Recovery time objectives (RTOs) do not meet business requirements.

BCP testing is net in conjunction with the disaster recovery plan (DRP)

Recovery time objectives (RTOs) do not meet business requirements.

BCP is often tested using the walk-through method.

Each business location has separate, inconsistent BCPs.

Which of the following is the STRONGEST indication an organization has ethics management issues?

Employees do not report IT risk issues for fear of consequences.

Internal IT auditors report to the chief information security officer (CISO).

Employees face sanctions for not signing the organization's acceptable use policy.

The organization has only two lines of defense.

Which of the following is the BEST evidence that a user account has been properly authorized?

User privileges matching the request form

An email from the user accepting the account

Notification from human resources that the account is active

User privileges matching the request form

Formal approval of the account by the user's manager

Which of the following is the BEST way to manage the risk associated with malicious activities performed by database administrators (DBAs)?

Activity logging and monitoring

Awareness training and background checks

Which of the following would BEST assist in reconstructing the sequence of events following a security incident across multiple IT systems in the organization's network?

Network monitoring infrastructure

Centralized vulnerability management

To communicate the risk associated with IT in business terms, which of the following MUST be defined?

Risk appetite of the organization

Which of the following is the MOST critical element to maximize the potential for a successful security implementation?

industry-leading security tools

Which of the following is the PRIMARY purpose of periodically reviewing an organization's risk profile?

Enable risk-based decision making.

Align business objectives with risk appetite.

Enable risk-based decision making.

Design and implement risk response action plans.

Update risk responses in the risk register

To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:

require the vendor to sign a nondisclosure agreement

clearly define the project scope.

perform background checks on the vendor.

notify network administrators before testing

Which of the following tasks should be completed prior to creating a disaster recovery plan (DRP)?

Conducting a business impact analysis (BIA)

Identifying the recovery response team

Assigning sensitivity levels to data

Which of the following BEST indicates the efficiency of a process for granting access privileges?

Average number of access privilege exceptions

Average time to grant access privileges

Number of changes in access granted to users

Average number of access privilege exceptions

Number and type of locked obsolete accounts

Several newly identified risk scenarios are being integrated into an organization's risk register. The MOST appropriate risk owner would be the individual who:

is accountable for loss if the risk materializes.

is in charge of information security.

is responsible for enterprise risk management (ERM)

can implement remediation action plans.

is accountable for loss if the risk materializes.

An internal audit report reveals that not all IT application databases have encryption in place. Which of the following information would be MOST important for assessing the risk impact?

A list of unencrypted databases which contain sensitive data

The number of users who can access sensitive data

A list of unencrypted databases which contain sensitive data

The reason some databases have not been encrypted

The cost required to enforce encryption

Which of the following is the GREATEST benefit of analyzing logs collected from different systems?

Security violations can be identified.

A record of incidents is maintained.

Forensic investigations are facilitated.

Security violations can be identified.

Developing threats are detected earlier.

Which of the following is the BEST approach when a risk practitioner has been asked by a business unit manager for special consideration during a risk assessment of a system?

Report the business unit manager for a possible ethics violation.

Conduct an abbreviated version of the assessment.

Report the business unit manager for a possible ethics violation.

Perform the assessment as it would normally be done.

Recommend an internal auditor perform the review.

What is the PRIMARY reason to periodically review key performance indicators (KPIs)?

Optimize resources needed for controls

The MOST important reason for implementing change control procedures is to ensure:

only approved changes are implemented

timely evaluation of change events

that emergency changes are logged.

Which of the following is the PRIMARY objective of providing an aggregated view of IT risk to business management?

To allow for proper review of risk tolerance

To enable consistent data on risk to be obtained

To allow for proper review of risk tolerance

To identify dependencies for reporting risk

To provide consistent and clear terminology

Which of the following is MOST important when considering risk in an enterprise risk management (ERM) process?

Risk with strategic impact is included.

Financial risk is given a higher priority.

Risk with strategic impact is included.

Security strategy is given a higher priority.

Risk identified by industry benchmarking is included.

Which of the following is a KEY consideration for a risk practitioner to communicate to senior management evaluating the introduction of artificial intelligence (Al) solutions into the organization?

Al potentially introduces new types of risk.

Al requires entirely new risk management processes.

Al potentially introduces new types of risk.

Al will result in changes to business processes.

Third-party Al solutions increase regulatory obligations.

All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness, the BEST course of action would be to:

evaluate opportunities to combine disaster recovery plans.

select a provider to standardize the disaster recovery plans.

outsource disaster recovery to an external provider.

centralize the risk response function at the enterprise level.

evaluate opportunities to combine disaster recovery plans.

Which of the following would BEST mitigate the risk associated with reputational damage from inappropriate use of social media sites by employees?

Implementing training and awareness programs

Validating employee social media accounts and passwords

Monitoring Internet usage on employee workstations

Disabling social media access from the organization's technology

Implementing training and awareness programs

After the review of a risk record, internal audit questioned why the risk was lowered from medium to low. Which of the following is the BEST course of action in responding to this inquiry?

Provide justification for the lower risk rating.

Obtain industry benchmarks related to the specific risk.

Provide justification for the lower risk rating.

Notify the business at the next risk briefing.

Reopen the risk issue and complete a full assessment.

Which of the following issues should be of GREATEST concern when evaluating existing controls during a risk assessment?

Successive assessments have the same recurring vulnerabilities.

A high number of approved exceptions exist with compensating controls.

Successive assessments have the same recurring vulnerabilities.

Redundant compensating controls are in place.

Asset custodians are responsible for defining controls instead of asset owners.

Which of the following would be MOST helpful to a risk practitioner when ensuring that mitigated risk remains within acceptable limits?

Implementing a process for ongoing monitoring of control effectiveness

Building an organizational risk profile after updating the risk register

Ensuring risk owners participate in a periodic control testing process

Designing a process for risk owners to periodically review identified risk

Implementing a process for ongoing monitoring of control effectiveness

Which of the following should be the PRIMARY focus of a risk owner once a decision is made to mitigate a risk?

Ensuring that control design reduces risk to an acceptable level

Updating the risk register to include the risk mitigation plan

Determining processes for monitoring the effectiveness of the controls

Ensuring that control design reduces risk to an acceptable level

Confirming to management the controls reduce the likelihood of the risk

Which of the following is the MOST appropriate key risk indicator (KRI) for backup media that is recycled monthly?

Percentage of failed restore tests

Time required for backup restoration testing

Change in size of data backed up

Successful completion of backup operations

Percentage of failed restore tests

Isaca CRISC Practice Test 16 - Free Online Exam Prep & Questions

Which of the following provides the BEST measurement of an organization's risk management maturity level?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 16

Question

Isaca CRISC Practice Tests

Practice Tests