Which of the following is the MOST important benefit of key risk indicators (KRIs)'

Providing an early warning to take proactive actions

Assisting in continually optimizing risk governance

Enabling the documentation and analysis of trends

Ensuring compliance with regulatory requirements

Providing an early warning to take proactive actions

IT risk assessments can BEST be used by management:

for compliance with laws and regulations

as a basis for cost-benefit analysis.

to measure organizational success.

Which of the following is the MOST important element of a successful risk awareness training program?

Customizing content for the audience

Providing incentives to participants

Mapping to a recognized standard

Providing metrics for measurement

Whether the results of risk analyses should be presented in quantitative or qualitative terms should be based PRIMARILY on the:

specific risk analysis framework being used.

results of the risk assessment.

Which of the following would BEST help to ensure that suspicious network activity is identified?

Analyzing intrusion detection system (IDS) logs

Using a third-party monitoring provider

Coordinating events with appropriate agencies

Which of the following would BEST help minimize the risk associated with social engineering threats?

Reviewing the organization's risk appetite

Which of the following should be the PRIMARY consideration when implementing controls for monitoring user activity logs?

Ensuring the control is proportional to the risk

Ensuring availability of resources for log analysis

Implementing log analysis tools to automate controls

Ensuring the control is proportional to the risk

Building correlations between logs collected from different sources

Risk mitigation procedures should include:

deployment of counter measures.

enterprise architecture implementation.

Which of the following is MOST helpful to ensure effective security controls for a cloud service provider?

A third-party security assessment report

Internal audit reports from the vendor

Service level agreement monitoring

A risk practitioner has determined that a key control does not meet design expectations. Which of the following should be done NEXT?

Document the finding in the risk register.

Invoke the incident response plan.

Re-evaluate key risk indicators.

Modify the design of the control.

Which of the following is a PRIMARY benefit of engaging the risk owner during the risk assessment process?

Accurate measurement of loss impact

Identification of controls gaps that may lead to noncompliance

Prioritization of risk action plans across departments

Early detection of emerging threats

Accurate measurement of loss impact

Which of the following would BEST provide early warning of a high-risk condition?

Key performance indicator (KPI)

From a business perspective, which of the following is the MOST important objective of a disaster recovery test?

Errors are discovered in the disaster recovery process.

The organization gains assurance it can recover from a disaster

Errors are discovered in the disaster recovery process.

All business critical systems are successfully tested.

All critical data is recovered within recovery time objectives (RTOs).

Which of the following is MOST important to understand when determining an appropriate risk assessment approach?

Complexity of the IT infrastructure

During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards. The overall control environment may still be effective if:

compensating controls are in place.

a control mitigation plan is in place.

An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST.

The risk owner who also owns the business service enabled by this infrastructure

The data center manager who is also employed under the managed hosting services contract

The site manager who is required to provide annual risk assessments under the contract

The chief information officer (CIO) who is responsible for the hosted services

Which of the following is the BEST metric to demonstrate the effectiveness of an organization's change management process?

Percent of unauthorized changes

Increase in the frequency of changes

Percent of unauthorized changes

Increase in the number of emergency changes

Average time to complete changes

Which of the following IT controls is MOST useful in mitigating the risk associated with inaccurate data?

Check totals on data records and data fields

Audit trails for updates and deletions

Check totals on data records and data fields

A risk practitioner is organizing risk awareness training for senior management. Which of the following is the MOST important topic to cover in the training session?

Senior management roles and responsibilities

The organization's strategic risk management projects

Senior management roles and responsibilities

The organizations risk appetite and tolerance

Senior management allocation of risk management resources

An organization wants to assess the maturity of its internal control environment. The FIRST step should be to:

validate control process execution.

determine if controls are effective.

Which of the following will BEST mitigate the risk associated with IT and business misalignment?

Involving the business process owner in IT strategy

Establishing business key performance indicators (KPIs)

Introducing an established framework for IT architecture

Establishing key risk indicators (KRIs)

Involving the business process owner in IT strategy

A trusted third party service provider has determined that the risk of a client's systems being hacked is low. Which of the following would be the client's BEST course of action?

Accept the risk based on the third party's risk assessment

Perform their own risk assessment

Implement additional controls to address the risk.

Accept the risk based on the third party's risk assessment

Perform an independent audit of the third party.

The MAIN purpose of conducting a control self-assessment (CSA) is to:

gain a better understanding of the control effectiveness in the organization

gain a better understanding of the risk in the organization

adjust the controls prior to an external audit

reduce the dependency on external audits

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery plan (DRP)?

Number of issues identified during DRP testing

Number of users that participated in the DRP testing

Number of issues identified during DRP testing

Percentage of applications that met the RTO during DRP testing

Percentage of issues resolved as a result of DRP testing

The risk associated with an asset before controls are applied can be expressed as:

a function of the cost and effectiveness of control.

a function of the likelihood and impact

a function of the cost and effectiveness of control.

the likelihood of a given threat

Which of the following is the MOST important key performance indicator (KPI) to establish in the service level agreement (SLA) for an outsourced data center?

Average response time to resolve system incidents

Percentage of systems included in recovery processes

Average response time to resolve system incidents

Percentage of system availability

A key risk indicator (KRI) is reported to senior management on a periodic basis as exceeding thresholds, but each time senior management has decided to take no action to reduce the risk. Which of the following is the MOST likely reason for senior management's response?

The KRI threshold needs to be revised to better align with the organization s risk appetite

The underlying data source for the KRI is using inaccurate data and needs to be corrected.

The KRI is not providing useful information and should be removed from the KRI inventory.

The KRI threshold needs to be revised to better align with the organization s risk appetite

Senior management does not understand the KRI and should undergo risk training.

A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?

An assigned risk manager to provide oversight

The team that performed the risk assessment

An assigned risk manager to provide oversight

Action plans to address risk scenarios requiring treatment

The methodology used to perform the risk assessment

Isaca CRISC Practice Test 2 - Free Online Exam Prep & Questions

What is the BEST information to present to business control owners when justifying costs related to controls?

Loss event frequency and magnitude

The previous year's budget and actuals

Industry benchmarks and standards

Return on IT security-related investments

Comment (0)

Isaca CRISC Practice Test 2

Question

Isaca CRISC Practice Tests

Practice Tests