A risk practitioner has discovered a deficiency in a critical system that cannot be patched. Which of the following should be the risk practitioner's FIRST course of action?

Report the issue to internal audit.

Submit a request to change management.

Review the business impact assessment.

Which of the following practices MOST effectively safeguards the processing of personal data?

Data protection impact assessments are performed on a regular basis.

Personal data attributed to a specific data subject is tokenized.

Data protection impact assessments are performed on a regular basis.

Personal data certifications are performed to prevent excessive data collection.

Data retention guidelines are documented, established, and enforced.

Which of the following should be the PRIMARY goal of developing information security metrics?

Enabling continuous improvement

An IT department has organized training sessions to improve user awareness of organizational information security policies. Which of the following is the BEST key performance indicator (KPI) to reflect effectiveness of the training?

Percentage of staff members who complete the training with a passing score

Number of training sessions completed

Percentage of staff members who complete the training with a passing score

Percentage of attendees versus total staff

Percentage of staff members who attend the training with positive feedback

A maturity model is MOST useful to an organization when it:

provides a reference for progress

benchmarks against other organizations

defines a qualitative measure of risk

provides a reference for progress

A risk practitioner is preparing a report to communicate changes in the risk and control environment. The BEST way to engage stakeholder attention is to:

include a summary linking information to stakeholder needs,

include detailed deviations from industry benchmarks,

include a summary linking information to stakeholder needs,

include a roadmap to achieve operational excellence,

publish the report on-demand for stakeholders.

The PRIMARY advantage of involving end users in continuity planning is that they:

can balance the overall technical and business concerns

have a better understanding of specific business needs

can balance the overall technical and business concerns

can see the overall impact to the business

are more objective than information security management.

Which of the following is the PRIMARY reason to adopt key control indicators (KCIs) in the risk monitoring and reporting process?

To provide assessments of mitigation effectiveness

To provide data for establishing the risk profile

To provide assurance of adherence to risk management policies

To provide measurements on the potential for risk to occur

To provide assessments of mitigation effectiveness

The PRIMARY benefit of using a maturity model is that it helps to evaluate the:

evolution of process improvements

capability to implement new processes

evolution of process improvements

degree of compliance with policies and procedures

Which of the following provides the BEST evidence that a selected risk treatment plan is effective?

Performing a cost-benefit analysis

Identifying key risk indicators (KRIs)

Evaluating the return on investment (ROI)

Evaluating the residual risk level

Performing a cost-benefit analysis

Senior management has asked the risk practitioner for the overall residual risk level for a process that contains numerous risk scenarios. Which of the following should be provided?

The average of anticipated residual risk levels

The sum of residual risk levels for each scenario

The loss expectancy for aggregated risk scenarios

The highest loss expectancy among the risk scenarios

The average of anticipated residual risk levels

Which of the following is the PRIMARY benefit of stakeholder involvement in risk scenario development?

Ability to determine business impact

Up-to-date knowledge on risk responses

Decision-making authority for risk treatment

Awareness of emerging business threats

Which of the following is the BEST way to help ensure risk will be managed properly after a business process has been re-engineered?

Reassessing control effectiveness of the process

Conducting a post-implementation review to determine lessons learned

Reporting key performance indicators (KPIs) for core processes

Establishing escalation procedures for anomaly events

Which of the following would be a risk practitioner's BEST course of action when a project team has accepted a risk outside the established risk appetite?

Monitor the residual risk level of the accepted risk.

Reject the risk acceptance and require mitigating controls.

Monitor the residual risk level of the accepted risk.

Escalate the risk decision to the project sponsor for review.

Document the risk decision in the project risk register.

When reviewing the business continuity plan (BCP) of an online sales order system, a risk practitioner notices that the recovery time objective (RTO) has a shorter lime than what is defined in the disaster recovery plan (DRP). Which of the following is the BEST way for the risk practitioner to address this concern?

Communicate the discrepancy to the DR manager for follow-up.

Adopt the RTO defined in the BCR

Update the risk register to reflect the discrepancy.

Adopt the RTO defined in the DRP.

Communicate the discrepancy to the DR manager for follow-up.

Which of the following is MOST important for maintaining the effectiveness of an IT risk register?

Performing regular reviews and updates to the register

Removing entries from the register after the risk has been treated

Recording and tracking the status of risk response plans within the register

Communicating the register to key stakeholders

Performing regular reviews and updates to the register

Which of the following is the MOST important consideration when developing risk strategies?

Concerns of the business process owners

An organization wants to grant remote access to a system containing sensitive data to an overseas third party. Which of the following should be of GREATEST concern to management?

Lack of monitoring over vendor activities

Transborder data transfer restrictions

Differences in regional standards

Lack of monitoring over vendor activities

Lack of after-hours incident management support

Which of the following will BEST help to ensure new IT policies address the enterprise's requirements?

Require business users to sign acknowledgment of the poises

involve IT leadership in the policy development process

Require business users to sign acknowledgment of the poises

involve business owners in the pokey development process

Provide policy owners with greater enforcement authority

A multinational organization is considering implementing standard background checks to' all new employees A KEY concern regarding this approach

violate laws in other countries

fail to identity all relevant issues.

violate laws in other countries

An organization's control environment is MOST effective when:

controls are implemented consistent

control designs are reviewed periodically

Recovery the objectives (RTOs) should be based on

minimum tolerable loss of data.

Which of the following issues found during the review of a newly created disaster recovery plan (DRP) should be of MOST concern?

Some critical business applications are not included in the plan

Several recovery activities will be outsourced

The plan is not based on an internationally recognized framework

The chief information security officer (CISO) has not approved the plan

Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth''

Bandwidth used during business hours

An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?

Management may be unable to accurately evaluate the risk profile.

Resources may be inefficiently allocated.

The same risk factor may be identified in multiple areas.

Multiple risk treatment efforts may be initiated to treat a given risk.

it was determined that replication of a critical database used by two business units failed. Which of the following should be of GREATEST concern1?

The underutilization of the replicated Iink

The cost of recovering the data

The loss of data confidentiality

Which of the following contributes MOST to the effective implementation of risk responses?

Clear understanding of the risk

Comparable industry risk trends

Detailed standards and procedures

As pan of business continuity planning, which of the following is MOST important to include m a business impact analysis (BlA)?

An assessment of threats to the organization

An assessment of recovery scenarios

Documentation of testing procedures

Which of the following would BEST mitigate an identified risk scenario?

Establishing an organization's risk tolerance

An organization has decided to commit to a business activity with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner's MOST important action related to this decision?

Document formal acceptance of the risk

Change the level of risk appetite

Document formal acceptance of the risk

An organization is considering outsourcing user administration controls tor a critical system. The potential vendor has offered to perform quarterly sett-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to me risk practitioner?

Lack of a risk-based approach to access control

The controls may not be properly tested

The vendor will not ensure against control failure

The vendor will not achieve best practices

Lack of a risk-based approach to access control

Which of the following would BEST mitigate the ongoing risk associated with operating system (OS) vulnerabilities?

Document and implement a patching process

Temporarily mitigate the OS vulnerabilities

Document and implement a patching process

Evaluate permanent fixes such as patches and upgrades

Identify the vulnerabilities and applicable OS patches

Isaca CRISC Practice Test 23 - Free Online Exam Prep & Questions

Which of the following would be the GREATEST challenge when implementing a corporate risk framework for a global organization?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 23

Question

Isaca CRISC Practice Tests

Practice Tests