What is the PRIMARY purpose of a business impact analysis (BIA)?

To evaluate the priority of business operations in case of disruption

To determine the likelihood and impact of threats to business operations

To identify important business processes in the organization

To estimate resource requirements for related business processes

To evaluate the priority of business operations in case of disruption

Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure?

Regulatory compliance requirements

Relevance to the business process

Regulatory compliance requirements

Comparison against best practice

Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?

Policy compliance requirements and exceptions process

Internal and external information security incidents

The risk department's roles and responsibilities

Policy compliance requirements and exceptions process

The organization's information security risk profile

Upon learning that the number of failed back-up attempts continually exceeds the current risk threshold, the risk practitioner should:

initiate corrective action to address the known deficiency

inquire about the status of any planned corrective actions

keep monitoring the situation as there is evidence that this is normal

adjust the risk threshold to better reflect actual performance

initiate corrective action to address the known deficiency

A newly hired risk practitioner finds that the risk register has not been updated in the past year. What is the risk practitioner's BEST course of action?

Identify changes in risk factors and initiate risk reviews.

Engage an external consultant to redesign the risk management process.

Outsource the process for updating the risk register.

Implement a process improvement and replace the old risk register.

Which of the following should be implemented to BEST mitigate the risk associated with infrastructure updates?

Role-specific technical training

An organization practices the principle of least privilege. To ensure access remains appropriate, application owners should be required to review user access rights on a regular basis by obtaining:

an access control matrix and approval from the user's manager

business purpose documentation and software license counts

an access control matrix and approval from the user's manager

documentation indicating the intended users of the application

security logs to determine the cause of invalid login attempts

Which of the following BEST indicates the condition of a risk management program?

Number of risk register entries

Which of the following is MOST important to have in place to ensure the effectiveness of risk and security metrics reporting?

Organizational reporting process

Which of the following is MOST important when developing risk scenarios?

Obtaining input from key stakeholders

Reviewing business impact analysis (BIA)

Conducting vulnerability assessments

Obtaining input from key stakeholders

Which of the following approaches will BEST help to ensure the effectiveness of risk awareness training?

Creating modules for targeted audiences

Piloting courses with focus groups

Using reputable third-party training programs

Reviewing content with senior management

Creating modules for targeted audiences

The MOST important objective of information security controls is to:

Provide measurable risk reduction

Identify threats and vulnerability

Ensure alignment with industry standards

Provide measurable risk reduction

Enforce strong security solutions

The PRIMARY benefit of conducting continuous monitoring of access controls is the ability to identify:

possible noncompliant activities that lead to data disclosure

inconsistencies between security policies and procedures

possible noncompliant activities that lead to data disclosure

leading or lagging key risk indicators (KRIs)

unknown threats to undermine existing access controls

Which of the following is the PRIMARY role of a data custodian in the risk management process?

Ensuring data is protected according to the classification

Performing periodic data reviews according to policy

Reporting and escalating data breaches to senior management

Being accountable for control design

Ensuring data is protected according to the classification

An organization learns of a new ransomware attack affecting organizations worldwide. Which of the following should be done FIRST to reduce the likelihood of infection from the attack?

Identify systems that are vulnerable to being exploited by the attack.

Confirm with the antivirus solution vendor whether the next update will detect the attack.

Verify the data backup process and confirm which backups are the most recent ones available.

Obtain approval for funding to purchase a cyber insurance plan.

Which of the following is the MOST important objective of establishing an enterprise risk management (ERM) function within an organization?

To have a unified approach to risk management across the organization

To have a standard risk management process for complying with regulations

To optimize risk management resources across the organization

To ensure risk profiles are presented in a consistent format within the organization

Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?

Percentage of high-risk vulnerabilities addressed

Percentage of high-risk vulnerabilities missed

Number of high-risk vulnerabilities outstanding

Defined thresholds for high-risk vulnerabilities

Percentage of high-risk vulnerabilities addressed

Which of the following BEST facilitates the mitigation of identified gaps between current and desired risk environment states?

Validate organizational risk appetite.

Review results of prior risk assessments.

Include the current and desired states in the risk register.

An application runs a scheduled job that compiles financial data from multiple business systems and updates the financial reporting system. If this job runs too long, it can delay financial reporting. Which of the following is the risk practitioner's BEST recommendation?

Ensure the enterprise has a process to detect such situations.

Implement database activity and capacity monitoring.

Ensure the business is aware of the risk.

Ensure the enterprise has a process to detect such situations.

Consider providing additional system resources to this job.

A deficient control has been identified which could result in great harm to an organization should a low frequency threat event occur. When communicating the associated risk to senior management the risk practitioner should explain:

mitigation plans for threat events should be prepared in the current planning period.

this risk scenario is equivalent to more frequent but lower impact risk scenarios.

the current level of risk is within tolerance.

an increase in threat events could cause a loss sooner than anticipated.

When reporting on the performance of an organization's control environment including which of the following would BEST inform stakeholders risk decision-making?

A report of deficiencies noted during controls testing

The audit plan for the upcoming period

Spend to date on mitigating control implementation

A report of deficiencies noted during controls testing

A status report of control deployment

Which of the following provides the MOST useful information to determine risk exposure following control implementations?

Risk limits, thresholds, and indicators

Strategic plan and risk management integration

Risk escalation and process for communication

Risk limits, thresholds, and indicators

Policies, standards, and procedures

Which of the following is the GREATEST benefit to an organization when updates to the risk register are made promptly after the completion of a risk assessment?

Optimized risk treatment decisions

Improved senior management communication

Optimized risk treatment decisions

Enhanced awareness of risk management

Improved collaboration among risk professionals

Which of the following is the BEST method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system?

Systems log correlation analysis

Monitoring of intrusion detection system (IDS) alerts

Which of the following is an IT business owner's BEST course of action following an unexpected increase in emergency changes?

Conducting a root cause analysis

Evaluating the impact to control objectives

Conducting a root cause analysis

Validating the adequacy of current processes

Reconfiguring the IT infrastructure

Which of the following scenarios represents a threat?

A virus transmitted on a USB thumb drive

Connecting a laptop to a free, open, wireless access point (hotspot)

Visitors not signing in as per policy

Storing corporate data in unencrypted form on a laptop

A virus transmitted on a USB thumb drive

Which of the following is MOST helpful in aligning IT risk with business objectives?

Performing a business impact analysis (BlA)

Introducing an approved IT governance framework

Integrating the results of top-down risk scenario analyses

Performing a business impact analysis (BlA)

Implementing a risk classification system

A peer review of a risk assessment finds that a relevant threat community was not included. Mitigation of the risk will require substantial changes to a software application. Which of the following is the BEST course of action?

Determine the impact of the missing threat.

Ask the business to make a budget request to remediate the problem.

Build a business case to remediate the fix.

Research the types of attacks the threat can present.

Determine the impact of the missing threat.

Isaca CRISC Practice Test 17 - Free Online Exam Prep & Questions

Which of the following will BEST help in communicating strategic risk priorities?

Isaca CRISC Practice Test 17

Question

Isaca CRISC Practice Tests

Practice Tests