Which of the following should be management's PRIMARY focus when key risk indicators (KRIs) begin to rapidly approach defined thresholds?

Determining what has changed in the environment

Designing compensating controls

Determining if KRIs have been updated recently

Assessing the effectiveness of the incident response plan

Determining what has changed in the environment

Legal and regulatory risk associated with business conducted over the Internet is driven by:

the laws and regulations of each individual country

the jurisdiction in which an organization has its principal headquarters

international law and a uniform set of regulations.

the laws and regulations of each individual country

international standard-setting bodies.

When formulating a social media policy lo address information leakage, which of the following is the MOST important concern to address?

Sharing company information on social media

Sharing personal information on social media

Using social media to maintain contact with business associates

Using social media for personal purposes during working hours

Which of the following should be the PRIMARY focus of an IT risk awareness program?

Cultivate long-term behavioral change.

Ensure compliance with the organization's internal policies

Cultivate long-term behavioral change.

Communicate IT risk policy to the participants.

Demonstrate regulatory compliance.

In an organization that allows employee use of social media accounts for work purposes, which of the following is the BEST way to protect company sensitive information from being exposed?

Implementing a data loss prevention (DLP) solution

Educating employees on what needs to be kept confidential

Implementing a data loss prevention (DLP) solution

Taking punitive action against employees who expose confidential data

Requiring employees to sign nondisclosure agreements

Which of the following is a risk practitioner's BEST recommendation to address an organization's need to secure multiple systems with limited IT resources?

Conduct a business impact analysis (BIA)

Apply available security patches.

Conduct a business impact analysis (BIA)

Perform a vulnerability analysis.

Risk acceptance of an exception to a security control would MOST likely be justified when:

business benefits exceed the loss exposure.

automation cannot be applied to the control

business benefits exceed the loss exposure.

the end-user license agreement has expired.

the control is difficult to enforce in practice.

Print jobs containing confidential information are sent to a shared network printer located in a secure room. Which of the following is the BEST control to prevent the inappropriate disclosure of confidential information?

Requiring a printer access code for each user

Using physical controls to access the printer room

Using video surveillance in the printer room

Ensuring printer parameters are properly configured

For a large software development project, risk assessments are MOST effective when performed:

at each stage of the system development life cycle (SDLC).

before system development begins.

at each stage of the system development life cycle (SDLC).

during the development of the business case.

The PRIMARY goal of conducting a business impact analysis (BIA) as part of an overall continuity planning process is to:

identify critical business processes and the degree of reliance on support services.

obtain the support of executive management.

map the business processes to supporting IT and other corporate resources.

identify critical business processes and the degree of reliance on support services.

document the disaster recovery process.

Which of the following BEST indicates the risk appetite and tolerance level (or the risk associated with business interruption caused by IT system failures?

IT system criticality classification

Incident management service level agreement (SLA)

Which of the following should be determined FIRST when a new security vulnerability is made public?

Whether the affected technology is used within the organization

Whether the affected technology is Internet-facing

What mitigating controls are currently in place

How pervasive the vulnerability is within the organization

Which of the following should be of GREATEST concern lo a risk practitioner reviewing the implementation of an emerging technology?

Lack of alignment to best practices

Lack of risk and control procedures

When developing a risk awareness training program, which of the following training topics would BEST facilitate a thorough understanding of risk scenarios?

Identifying potential sources of risk

Mapping threats to organizational objectives

Analyzing key risk indicators (KRIs)

Identifying potential sources of risk

An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?

Analyze data protection methods.

Include a right-to-audit clause.

Implement strong access controls.

Which of the following should be the risk practitioner's FIRST course of action when an organization plans to adopt a cloud computing strategy?

Request a budget for implementation

Create a cloud computing policy.

Which of the following is the BEST way to quantify the likelihood of risk materialization?

Threat and vulnerability assessment

Which of the following is MOST helpful in preventing risk events from materializing?

Prioritizing and tracking issues

Establishing key risk indicators (KRIs)

Reviewing and analyzing security incidents

While reviewing the risk register, a risk practitioner notices that different business units have significant variances in inherent risk for the same risk scenario. Which of the following is the BEST course of action?

Review the assumptions of both risk scenarios to determine whether the variance is reasonable.

Update the risk register with the average of residual risk for both business units.

Review the assumptions of both risk scenarios to determine whether the variance is reasonable.

Update the risk register to ensure both risk scenarios have the highest residual risk.

Request that both business units conduct another review of the risk.

Which of the following is the BEST indicator of an effective IT security awareness program?

Decreased success rate of internal phishing tests

Decreased number of reported security incidents

Number of disciplinary actions issued for security violations

Number of employees that complete security training

Which type of indicators should be developed to measure the effectiveness of an organization's firewall rule set?

Key management indicators (KMIs)

Key performance indicators (KPIs)

Which of the following is the MOST appropriate action when a tolerance threshold is exceeded?

Communicate potential impact to decision makers.

Research the root cause of similar incidents.

Verify the response plan is adequate.

Increase human resources to respond in the interim.

Which of the following will be the GREATEST concern when assessing the risk profile of an organization?

The risk profile was not updated after a recent incident

The risk profile was developed without using industry standards.

The risk profile was last reviewed two years ago.

The risk profile does not contain historical loss data.

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Providing assurance of control effectiveness

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery test of critical business processes?

Percentage of processes recovered within the recovery time and point objectives

Percentage of job failures identified and resolved during the recovery process

Percentage of processes recovered within the recovery time and point objectives

Number of current test plans and procedures

Number of issues and action items resolved during the recovery test

A financial institution has identified high risk of fraud in several business applications. Which of the following controls will BEST help reduce the risk of fraudulent internal transactions?

Periodic user privileges review

Which element of an organization's risk register is MOST important to update following the commissioning of a new financial reporting system?

The risk rating of affected financial processes

The owner of the financial reporting process

The risk rating of affected financial processes

The list of relevant financial controls

Which of the following is a drawback in the use of quantitative risk analysis?

It requires more resources than other methods

It assigns numeric values to exposures of assets.

It requires more resources than other methods

It produces the results in numeric form.

It is based on impact analysis of information assets.

Which of the following would present the MOST significant risk to an organization when updating the incident response plan?

Undefined assignment of responsibility

Obsolete response documentation

Failure to audit third-party providers

Undefined assignment of responsibility

Which of the following would BEST indicate to senior management that IT processes are improving?

Changes in the number of security exceptions

Changes in the number of intrusions detected

Changes in the number of security exceptions

Changes in the position in the maturity model

Changes to the structure of the risk register

Which of the following is the FIRST step when conducting a business impact analysis (BIA)?

Identifying critical information assets

Identifying events impacting continuity of operations;

Creating a data classification scheme

Analyzing previous risk assessment results

Isaca CRISC Practice Test 22 - Free Online Exam Prep & Questions

To reduce costs, an organization is combining the second and third tines of defense in a new department that reports to a recently appointed C-level executive. Which of the following is the GREATEST concern with this situation?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 22

Question

Isaca CRISC Practice Tests

Practice Tests