During an internal IT audit, an active network account belonging to a former employee was identified. Which of the following is the BEST way to prevent future occurrences?

Conduct a comprehensive review of access management processes.

Declare a security incident and engage the incident response team.

Conduct a comprehensive awareness session for system administrators.

Evaluate system administrators' technical skills to identify if training is required.

An organization has initiated a project to launch an IT-based service to customers and take advantage of being the first to market. Which of the following should be of GREATEST concern to senior management?

The project is likely to deliver the product late.

More time has been allotted for testing.

The project is likely to deliver the product late.

A new project manager is handling the project.

The cost of the project will exceed the allotted budget.

While conducting an organization-wide risk assessment, it is noted that many of the information security policies have not changed in the past three years. The BEST course of action is to:

review the policies against current needs to determine adequacy.

review and update the policies to align with industry standards.

determine that the policies should be updated annually.

report that the policies are adequate and do not need to be updated frequently.

review the policies against current needs to determine adequacy.

A control for mitigating risk in a key business area cannot be implemented immediately. Which of the following is the risk practitioner's BEST course of action when a compensating control needs to be applied?

Obtain the risk owner's approval.

Record the risk as accepted in the risk register.

An organization operates in an environment where reduced time-to-market for new software products is a top business priority. Which of the following should be the risk practitioner's GREATEST concern?

Sufficient resources are not assigned to IT development projects.

Customer support help desk staff does not have adequate training.

Email infrastructure does not have proper rollback plans.

The corporate email system does not identify and store phishing emails.

Which of the following BEST mitigates the risk of sensitive personal data leakage from a software development environment?

Anonymized personal data in non-production environments

Tokenized personal data only in test environments

Data loss prevention tools (DLP) installed in passive mode

Anonymized personal data in non-production environments

Multi-factor authentication for access to non-production environments

Which of the following should be an element of the risk appetite of an organization?

The enterprise's capacity to absorb loss

The effectiveness of compensating controls

The enterprise's capacity to absorb loss

The residual risk affected by preventive controls

The amount of inherent risk considered appropriate

In an organization where each division manages risk independently, which of the following would BEST enable management of risk at the enterprise level?

An enterprise risk ownership policy

An updated risk tolerance metric

Which of the following would require updates to an organization's IT risk register?

Discovery of an ineffectively designed key IT control

Management review of key risk indicators (KRls)

Changes to the team responsible for maintaining the register

Completion of the latest internal audit

Which of the following controls BEST helps to ensure that transaction data reaches its destination?

Providing acknowledgments from receiver to sender

Securing the network from attacks

Providing acknowledgments from receiver to sender

Digitally signing individual messages

Which of the following is the BEST control to detect an advanced persistent threat (APT)?

Implementing automated log monitoring

Utilizing antivirus systems and firewalls

Conducting regular penetration tests

Monitoring social media activities

Implementing automated log monitoring

Which of the following BEST supports ethical IT risk management practices?

Robust organizational communication channels

Mapping of key risk indicators (KRIs) to corporate strategy

Capability maturity models integrated with risk management frameworks

Rigorously enforced operational service level agreements (SLAs)

Which of the following is the MOST effective way to integrate risk and compliance management?

Embedding risk management into compliance decision-making

Designing corrective actions to improve risk response capabilities

Embedding risk management into processes that are aligned with business drivers

Conducting regular self-assessments to verify compliance

A business unit is implementing a data analytics platform to enhance its customer relationship management (CRM) system primarily to process data that has been provided by its customers. Which of the following presents the GREATEST risk to the organization's reputation?

Data usage exceeds individual consent.

Third-party software is used for data analytics.

Data usage exceeds individual consent.

Revenue generated is not disclosed to customers.

Use of a data analytics system is not disclosed to customers.

Which of the following should be the MOST important consideration when performing a vendor risk assessment?

Inherent risk of the business process supported by the vendor

Results of the last risk assessment of the vendor

Inherent risk of the business process supported by the vendor

Length of time since the last risk assessment of the vendor

While evaluating control costs, management discovers that the annual cost exceeds the annual loss expectancy (ALE) of the risk. This indicates the:

risk is inefficiently controlled.

control is ineffective and should be strengthened

risk is inefficiently controlled.

risk is efficiently controlled.

control is weak and should be removed.

The PRIMARY reason to have risk owners assigned to entries in the risk register is to ensure:

mitigating actions are prioritized

risk entries are regularly updated

In response to the threat of ransomware, an organization has implemented cybersecurity awareness activities. The risk practitioner's BEST recommendation to further reduce the impact of ransomware attacks would be to implement:

continuous data backup controls.

Which of the following should a risk practitioner recommend FIRST when an increasing trend of risk events and subsequent losses has been identified?

Integrate the risk event and incident management processes.

Conduct root cause analyses for risk events.

Educate personnel on risk mitigation strategies.

Integrate the risk event and incident management processes.

Implement controls to prevent future risk events.

When reviewing a report on the performance of control processes, it is MOST important to verify whether the:

control process is designed effectively.

business process objectives have been met.

control adheres to regulatory standards.

residual risk objectives have been achieved.

control process is designed effectively.

Which of the following BEST enforces access control for an organization that uses multiple cloud technologies?

Adoption of a cloud access security broker (CASB) solution

Senior management support of cloud adoption strategies

Creation of a cloud access risk management policy

Adoption of a cloud access security broker (CASB) solution

Expansion of security information and event management (SIEM) to cloud services

Which of the following scenarios presents the GREATEST risk for a global organization when implementing a data classification policy?

Changes to data sensitivity during the data life cycle have not been considered.

Data encryption has not been applied to all sensitive data across the organization.

There are many data assets across the organization that need to be classified.

Changes to information handling procedures are not documented.

Changes to data sensitivity during the data life cycle have not been considered.

Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?

Availability of automated reporting systems

Which of the following should be the GREATEST concern for an organization that uses open source software applications?

Lack of organizational policy regarding open source software

Lack of reliability associated with the use of open source software

Lack of monitoring over installation of open source software in the organization

Lack of professional support for open source software

An organization has recently been experiencing frequent data corruption incidents. Implementing a file corruption detection tool as a risk response strategy will help to:

reduce the likelihood of future events

reduce the impact of future events

Which of the following is the MOST important responsibility of a risk owner?

Establishing business information criteria

The PRIMARY objective for requiring an independent review of an organization's IT risk management process should be to:

ensure IT risk management is focused on mitigating potential risk.

assess gaps in IT risk management operations and strategic focus.

confirm that IT risk assessment results are expressed as business impact.

verify implemented controls to reduce the likelihood of threat materialization.

ensure IT risk management is focused on mitigating potential risk.

Which of the following is the PRIMARY benefit of using an entry in the risk register to track the aggregate risk associated with server failure?

It provides a comprehensive view of the impact should the servers simultaneously fail.

It provides a cost-benefit analysis on control options available for implementation.

It provides a view on where controls should be applied to maximize the uptime of servers.

It provides historical information about the impact of individual servers malfunctioning.

It provides a comprehensive view of the impact should the servers simultaneously fail.

An information system for a key business operation is being moved from an in-house application to a Software as a Service (SaaS) vendor. Which of the following will have the GREATEST impact on the ability to monitor risk?

Reduced ability to evaluate key risk indicators (KRIs)

Reduced access to internal audit reports

Dependency on the vendor's key performance indicators (KPIs)

Dependency on service level agreements (SLAs)

Which of the following BEST enables an organization to determine whether external emerging risk factors will impact the organization's risk profile?

Scenario analysis and stress testing

Control identification and mitigation

Adoption of a compliance-based approach

Prevention and detection techniques

Scenario analysis and stress testing

In an organization dependent on data analytics to drive decision-making, which of the following would BEST help to minimize the risk associated with inaccurate data?

Evaluating each of the data sources for vulnerabilities

Establishing an intellectual property agreement

Evaluating each of the data sources for vulnerabilities

Periodically reviewing big data strategies

Benchmarking to industry best practice

Isaca CRISC Practice Test 19 - Free Online Exam Prep & Questions

Which of the following would BEST help an enterprise define and communicate its risk appetite?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 19

Question

Isaca CRISC Practice Tests

Practice Tests