When of the following provides the MOST tenable evidence that a business process control is effective?

Management attestation that the control is operating effectively

Demonstration that the control is operating as designed

A successful walk-through of the associated risk assessment

Management attestation that the control is operating effectively

Automated data indicating that risk has been reduced

During a risk treatment plan review, a risk practitioner finds the approved risk action plan has not been completed However, there were other risk mitigation actions implemented. Which of the fallowing is the BEST course of action?

Review the cost-benefit of mitigating controls

Mark the risk status as unresolved within the risk register

Verify the sufficiency of mitigating controls with the risk owner

Update the risk register with implemented mitigating actions

What should be the PRIMARY driver for periodically reviewing and adjusting key risk indicators (KRIs)?

Control self-assessments (CSAs)

Which of the following BEST represents a critical threshold value for a key control indicator (KCI)?

The value at which control effectiveness would fail

Thresholds benchmarked to peer organizations

A value that represents the intended control state

Which of We following is the MOST effective control to address the risk associated with compromising data privacy within the cloud?

Specify cloud service provider liability for data privacy breaches in the contract

Establish baseline security configurations with the cloud service provider.

Require the cloud prowler 10 disclose past data privacy breaches.

Ensure the cloud service provider performs an annual risk assessment.

Specify cloud service provider liability for data privacy breaches in the contract

Which of tie following is We MOST important consideration when implementing ethical remote work monitoring?

Employees are informed of how they are bong monitored

Monitoring is only conducted between official hours of business

Employees are informed of how they are bong monitored

Reporting on nonproductive employees is sent to management on a scheduled basis

Multiple data monitoring sources are integrated into security incident response procedures

An organization outsources the processing of us payroll data A risk practitioner identifies a control weakness at the third party trial exposes the payroll data. Who should own this risk?

The organization's process owner

The third party's IT operations manager

The organization's process owner

The third party's chief risk officer (CRO)

The organization's risk practitioner

Which of the following BEST mitigates the risk of violating privacy laws when transferring personal information lo a supplier?

Contractually obligate the supplier to follow privacy laws.

Encrypt the data while in transit lo the supplier

Contractually obligate the supplier to follow privacy laws.

Require independent audits of the supplier's control environment

Utilize blockchain during the data transfer

Which of the following poses the GREATEST risk to an organization's operations during a major it transformation?

Unavailability of critical IT systems

Lack of robust awareness programs

infrequent risk assessments of key controls

Unavailability of critical IT systems

When performing a risk assessment of a new service to support a ewe Business process. which of the following should be done FRST10 ensure continuity of operations?

a identity conditions that may cause disruptions

Review incident response procedures

Evaluate the probability of risk events

Define metrics for restoring availability

Which of the following is the BEST way to mitigate the risk to IT infrastructure availability?

Establishing a disaster recovery plan (DRP)

Establishing recovery time objectives (RTOs)

Maintaining a current list of staff contact delays

Which of me following is MOST helpful to mitigate the risk associated with an application under development not meeting business objectives?

Including key stakeholders in review of user requirements

Identifying tweets that may compromise enterprise architecture (EA)

Including diverse Business scenarios in user acceptance testing (UAT)

Performing risk assessments during the business case development stage

Including key stakeholders in review of user requirements

Winch of the following key control indicators (KCIs) BEST indicates whether security requirements are identified and managed throughout a project He cycle?

Number of projects going live without a security review

Number of employees completing project-specific security training

Number of security projects started in core departments

Number of security-related status reports submitted by project managers

Which of the following BEST facilities the alignment of IT risk management with enterprise risk management (ERM)?

linking IT risk scenarios to enterprise strategy

Adopting qualitative enterprise risk assessment methods

Linking IT risk scenarios to technology objectives

linking IT risk scenarios to enterprise strategy

Adopting quantitative enterprise risk assessment methods

An organization is implementing internet of Things (loT) technology to control temperature and lighting in its headquarters. Which of the following should be of GREATEST concern?

Lack of interoperability between sensors

insecure data transmission protocols

Lack of interoperability between sensors

Which of the following is the BEST Key control indicator KCO to monitor the effectiveness of patch management?

Percentage of legacy servers out of support

Percentage of severs receiving automata patches

Number of unremediated vulnerabilities

Winch of the following is the BEST evidence of an effective risk treatment plan?

Remediation cost is below the asset business value

The inherent risk is below the asset residual risk.

Remediation cost is below the asset business value

The risk tolerance threshold s above the asset residual

Remediation is completed within the asset recovery time objective (RTO)

When of the following is the MOST significant exposure when an application uses individual user accounts to access the underlying database?

Users may be able to circumvent application controls.

Users may share accounts with business system analyst

Application may not capture a complete audit trail.

Users may be able to circumvent application controls.

Multiple connects to the database are used and slow the process

Which of the following is the MOST important consideration for protecting data assets m a Business application system?

Application controls are aligned with data classification lutes

Application users are periodically trained on proper data handling practices

Encrypted communication is established between applications and data servers

Offsite encrypted backups are automatically created by the application

Which of the following will help ensure the elective decision-making of an IT risk management committee?

Functional overlap across the business is minimized

Key stakeholders are enrolled as members

Approved minutes ate forwarded to senior management

Committee meets at least quarterly

Functional overlap across the business is minimized

Which of the following is the BEST way to assess the effectiveness of an access management process?

Reviewing access logs for user activity

Comparing the actual process with the documented process

Reviewing access logs for user activity

Reconciling a list of accounts belonging to terminated employees

Reviewing for compliance with acceptable use policy

Which of the following practices BEST mitigates risk related to enterprise-wide ethical decision making in a multi-national organization?

Customized regional training on local laws and regulations

Policies requiring central reporting of potential procedure exceptions

Ongoing awareness training to support a common risk culture

Zero-tolerance policies for risk taking by middle-level managers

Which of the following BEST indicates that additional or improved controls ate needed m the environment?

Risk events and losses exceed risk tolerance

Management, has decreased organisational risk appetite

The risk register and portfolio do not include all risk scenarios

merging risk scenarios have been identified

Risk events and losses exceed risk tolerance

Which of The following is the MOST comprehensive input to the risk assessment process specific to the effects of system downtime?

Business continuity plan (BCP) testing results

results Recovery point objective (RPO)

A risk practitioner identifies a database application that has been developed and implemented by the business independently of IT. Which of the following is the BEST course of action?

Document the reasons for the exception.

Escalate the concern to senior management.

Document the reasons for the exception.

Include the application in IT risk assessments.

Propose that the application be transferred to IT.

Which of the following is the MOST effective way to incorporate stakeholder concerns when developing risk scenarios?

Establishing key performance indicators (KPIs)

Creating quarterly risk reports

Which of the following is the BEST way to determine the potential organizational impact of emerging privacy regulations?

Conduct a privacy impact assessment (PIA).

Evaluate the security architecture maturity.

Map the new requirements to the existing control framework.

Charter a privacy steering committee.

Conduct a privacy impact assessment (PIA).

An employee lost a personal mobile device that may contain sensitive corporate information. What should be the risk practitioner's recommendation?

Invoke the incident response plan

The PRIMARY reason for prioritizing risk scenarios is to:

facilitate risk response decisions.

provide an enterprise-wide view of risk

facilitate risk response decisions.

Which of the following approaches to bring your own device (BYOD) service delivery provides the BEST protection from data loss?

Enforce strong passwords and data encryption

Penetration testing and session timeouts

Enforce strong passwords and data encryption

Isaca CRISC Practice Test 21 - Free Online Exam Prep & Questions

When of the following 15 MOST important when developing a business case for a proposed security investment?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 21

Question

Isaca CRISC Practice Tests

Practice Tests