Which of the following will BEST support management reporting on risk?

Key performance indicators (KPIs)

Which of The following is the BEST way to confirm whether appropriate automated controls are in place within a recently implemented system?

Review the key performance indicators (KPIs).

Perform a post-implementation review.

Conduct user acceptance testing.

Review the key performance indicators (KPIs).

Management has required information security awareness training to reduce the risk associated with credential compromise. What is the BEST way to assess the effectiveness of the training?

Conduct social engineering testing.

Audit security awareness training materials.

Administer an end-of-training quiz.

Perform a vulnerability assessment.

Which of the following would be a risk practitioner'$ BEST recommendation to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile?

Define cyber roles and responsibilities across the organization

Manage cyber risk according to the organization's risk management framework.

Define cyber roles and responsibilities across the organization

Conduct cyber risk awareness training tailored specifically for senior management

Implement a cyber risk program based on industry best practices

An organization has detected unauthorized logins to its client database servers. Which of the following should be of GREATEST concern?

Potential theft of personal information

Potential increase in regulatory scrutiny

Potential theft of personal information

Which of the following BEST assists in justifying an investment in automated controls?

Alignment of investment with risk appetite

Elimination of compensating controls

The risk associated with an asset after controls are applied can be expressed as:

a function of the likelihood and impact.

a function of the cost and effectiveness of controls.

the likelihood of a given threat.

a function of the likelihood and impact.

Which of the following is the BEST recommendation to senior management when the results of a risk and control assessment indicate a risk scenario can only be partially mitigated?

Accept the residual risk in its entirety and obtain executive management approval.

Implement controls to bring the risk to a level within appetite and accept the residual risk.

Implement a key performance indicator (KPI) to monitor the existing control performance.

Accept the residual risk in its entirety and obtain executive management approval.

Separate the risk into multiple components and avoid the risk components that cannot be mitigated.

A violation of segregation of duties is when the same:

programmer writes and promotes code into production.

user requests and tests the change prior to production.

user authorizes and monitors the change post-implementation.

programmer requests and tests the change prior to production.

programmer writes and promotes code into production.

Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?

Number of successful recovery plan tests

Number of times the recovery plan is reviewed

Number of successful recovery plan tests

Percentage of systems with outdated virus protection

Percentage of employees who can work remotely

Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Ensuring relevance to organizational goals

Including trend analysis of risk metrics

Using an aggregated view of organizational risk

Relying on key risk indicator (KRI) data

Ensuring relevance to organizational goals

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an antivirus program?

Percentage of IT assets with current malware definitions

Number of false positives defected over a period of time

Number of alerts generated by the anti-virus software

Frequency of anti-vinjs software updates

Which of the following is the BEST source for identifying key control indicators (KCIs)?

Controls mapped to organizational risk scenarios

Privileged user activity monitoring controls

Controls mapped to organizational risk scenarios

Recent audit findings of control weaknesses

A list of critical security processes

An organization discovers significant vulnerabilities in a recently purchased commercial off-the-shelf software product which will not be corrected until the next release. Which of the following is the risk manager's BEST course of action?

Review software license to determine the vendor's responsibility regarding vulnerabilities.

Review the risk of implementing versus postponing with stakeholders.

Run vulnerability testing tools to independently verify the vulnerabilities.

Review software license to determine the vendor's responsibility regarding vulnerabilities.

Require the vendor to correct significant vulnerabilities prior to installation.

The BEST way to improve a risk register is to ensure the register:

is updated based upon significant events.

documents possible countermeasures.

contains the risk assessment completion date.

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:

analyze the alerts to minimize the false positives

reset the alert threshold based on peak traffic

analyze the traffic to minimize the false negatives

analyze the alerts to minimize the false positives

sniff the traffic using a network analyzer

A chief information officer (CIO) has identified risk associated with shadow systems being maintained by business units to address specific functionality gaps in the organization's enterprise resource planning (ERP) system. What is the BEST way to reduce this risk going forward?

Implement an enterprise architecture (EA).

Align applications to business processes.

Implement an enterprise architecture (EA).

Define the software development life cycle (SDLC).

Define enterprise-wide system procurement requirements.

Which of the following provides the MOST useful information when developing a risk profile for management approval?

Residual risk and risk appetite

Strength of detective and preventative controls

Effectiveness and efficiency of controls

Inherent risk and risk tolerance

Which of the following approaches would BEST help to identify relevant risk scenarios?

Engage line management in risk assessment workshops.

Escalate the situation to risk leadership.

Engage internal audit for risk assessment workshops.

Review system and process documentation.

Which of the following BEST indicates the effectiveness of anti-malware software?

Number of successful attacks by malicious software

Number of staff hours lost due to malware attacks

Number of downtime hours in business critical servers

Number of patches made to anti-malware software

Number of successful attacks by malicious software

To minimize the risk of a potential acquisition being exposed externally, an organization has selected a few key employees to be engaged in the due diligence process. A member of the due diligence team realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired. What is the BEST course of action for this team member?

Disclose potential conflicts of interest.

Delegate responsibilities involving the acquaintance.

Notify the subsidiary's legal team.

Vulnerabilities have been detected on an organization's systems. Applications installed on these systems will not operate if the underlying servers are updated. Which of the following is the risk practitioner's BEST course of action?

Implement compensating controls.

Recommend the business change the application.

Recommend a risk treatment plan.

Include the risk in the next quarterly update to management.

Implement compensating controls.

Which of the following should be management's PRIMARY consideration when approving risk response action plans?

Changes in residual risk after implementing the plans

Ability of the action plans to address multiple risk scenarios

Ease of implementing the risk treatment solution

Changes in residual risk after implementing the plans

Prioritization for implementing the action plans

The PRIMARY objective of a risk identification process is to:

determine threats and vulnerabilities.

evaluate how risk conditions are managed.

determine threats and vulnerabilities.

estimate anticipated financial impact of risk conditions.

establish risk response options.

A risk practitioner has received an updated enterprise risk management (ERM) report showing that residual risk is now within the organization's defined appetite and tolerance levels. Which of the following is the risk practitioner's BEST course of action?

Verify the adequacy of risk monitoring plans.

Identify new risk entries to include in ERM.

Remove the risk entries from the ERM register.

Re-perform the risk assessment to confirm results.

Verify the adequacy of risk monitoring plans.

An organization's risk register contains a large volume of risk scenarios that senior management considers overwhelming. Which of the following would BEST help to improve the risk register?

Analyzing the residual risk components

Validating the risk appetite level

Which of the following is MOST important when developing key risk indicators (KRIs)?

Alignment with regulatory requirements

Availability of qualitative data

Alignment with industry benchmarks

A risk practitioner has been asked by executives to explain how existing risk treatment plans would affect risk posture at the end of the year. Which of the following is MOST helpful in responding to this request?

Assessing risk with current controls in place

Assessing risk with no controls in place

Showing projected residual risk

Providing peer benchmarking results

Assessing risk with current controls in place

Which of the following presents the GREATEST risk to change control in business application development over the complete life cycle?

Introduction of requirements that have not been approved

Emphasis on multiple application testing cycles

Lack of an integrated development environment (IDE) tool

Introduction of requirements that have not been approved

Bypassing quality requirements before go-live

An IT risk practitioner has determined that mitigation activities differ from an approved risk action plan. Which of the following is the risk practitioner's BEST course of action?

Validate the adequacy of the implemented risk mitigation measures.

Report the observation to the chief risk officer (CRO).

Validate the adequacy of the implemented risk mitigation measures.

Update the risk register with the implemented risk mitigation actions.

Revert the implemented mitigation measures until approval is obtained

Determining if organizational risk is tolerable requires:

understanding the organization's risk appetite.

mapping residual risk with cost of controls

comparing against regulatory requirements

comparing industry risk appetite with the organization's.

understanding the organization's risk appetite.

Isaca CRISC Practice Test 18 - Free Online Exam Prep & Questions

Which of the following is the PRIMARY reason for monitoring activities performed in a production database environment?

Ensuring that database changes are correctly applied

Enforcing that changes are authorized

Deterring illicit actions of database administrators

Preventing system developers from accessing production data

Comment (0)

Isaca CRISC Practice Test 18

Question

Isaca CRISC Practice Tests

Practice Tests