An organization has an approved bring your own device (BYOD) policy. Which of the following would BEST mitigate the security risk associated with the inappropriate use of enterprise applications on the devices?

Implement BYOD mobile device management (MDM) controls.

Periodically review application on BYOD devices

Include BYOD in organizational awareness programs

Implement BYOD mobile device management (MDM) controls.

Enable a remote wee capability for BYOD devices

Which key performance efficiency IKPI) BEST measures the effectiveness of an organization's disaster recovery program?

Percentage of critical systems recovered within tie recovery time objective (RTO)

Number of service level agreement (SLA) violations

Percentage of recovery issues identified during the exercise

Number of total systems recovered within tie recovery point objective (RPO)

Percentage of critical systems recovered within tie recovery time objective (RTO)

Which of the following will BEST help to ensure the continued effectiveness of the IT risk management function within an organization experiencing high employee turnover?

Well documented policies and procedures

An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would be based on:

The organization's specific control requirements

a recognized industry control framework

guidance provided by the external auditor

the service provider's existing controls

The organization's specific control requirements

A company has recently acquired a customer relationship management (CRM) application from a certified software vendor. Which of the following will BE ST help lo prevent technical vulnerabilities from being exploded?

Update the software with the latest patches and updates

implement code reviews and Quality assurance on a regular basis

Verity me software agreement indemnifies the company from losses

Review the source coda and error reporting of the application

Update the software with the latest patches and updates

What is the PRIMARY reason an organization should include background checks on roles with elevated access to production as part of its hiring process?

Eliminate risk associated with personnel

Reduce exposure to vulnerabilities

Eliminate risk associated with personnel

Ensure new hires have the required skills

Before assigning sensitivity levels to information it is MOST important to:

define the information classification policy

define recovery time objectives (RTOs).

define the information classification policy

Identify information custodians

An organization has used generic risk scenarios to populate its risk register. Which of the following presents the GREATEST challenge to assigning of the associated risk entries?

The risk analysts for each scenario is incomplete

The volume of risk scenarios is too large

Risk aggregation has not been completed

Risk scenarios are not applicable

The risk analysts for each scenario is incomplete

When of the following standard operating procedure (SOP) statements BEST illustrates appropriate risk register maintenance?

Remove risk only following a significant change in the risk environment

Remove risk that has been mitigated by third-party transfer

Remove risk that management has decided to accept

Remove risk only following a significant change in the risk environment

Remove risk when mitigation results in residual risk within tolerance levels

Which of the blowing is MOST important when implementing an organization s security policy?

Benchmarking against industry standards

Assessing compliance requirements

Identifying threats and vulnerabilities

The BEST way to mitigate the high cost of retrieving electronic evidence associated with potential litigation is to implement policies and procedures for.

data classification and labeling

An organization has completed a risk assessment of one of its service providers. Who should be accountable for ensuring that risk responses are implemented?

Legal representation of the business

Which of the following would MOST likely require a risk practitioner to update the risk register?

Completion of a project for implementing a new control

An alert being reported by the security operations center.

Development of a project schedule for implementing a risk response

Completion of a project for implementing a new control

Engagement of a third party to conduct a vulnerability scan

Which of the following is a risk practitioner's MOST important responsibility in managing risk acceptance that exceeds risk tolerance?

Verify authorization by senior management.

Increase the risk appetite to align with the current risk level

Ensure the acceptance is set to expire over lime

Update the risk response in the risk register.

Which of the following would provide the BEST evidence of an effective internal control environment/?

Adherence to governing policies

An organization is concerned that its employees may be unintentionally disclosing data through the use of social media sites. Which of the following will MOST effectively mitigate tins risk?

Conducting user awareness training

Requiring the use of virtual private networks (VPNs)

Establishing a data classification policy

Conducting user awareness training

Requiring employee agreement of the acceptable use policy

A global company s business continuity plan (BCP) requires the transfer of its customer information....event of a disaster. Which of the following should be the MOST important risk consideration?

The cloud computing environment is shared with another company

The difference In the management practices between each company

The cloud computing environment is shared with another company

The lack of a service level agreement (SLA) in the vendor contract

The organizational culture differences between each country

Which of the following is the BEST approach to mitigate the risk associated with a control deficiency?

Conduct a control sell-assessment (CSA)

Perform a business case analysis

Implement compensating controls.

Conduct a control sell-assessment (CSA)

Which of the following is PRIMARILY a risk management responsibly of the first line of defense?

Establishing risk policies and standards

Implementing risk treatment plans

Validating the status of risk mitigation efforts

Establishing risk policies and standards

Conducting independent reviews of risk assessment results

Which of the following would be the GREATEST concern for an IT risk practitioner when an employees.....

Unnecessary access permissions have not been removed.

The organization's structure has not been updated

Unnecessary access permissions have not been removed.

Company equipment has not been retained by IT

Job knowledge was not transferred to employees m the former department

Which of the following is the BEST indication that key risk indicators (KRls) should be revised?

An Increase In the number of risk threshold exceptions

A decrease in the number of critical assets covered by risk thresholds

An Increase In the number of risk threshold exceptions

An increase in the number of change events pending management review

A decrease In the number of key performance indicators (KPls)

In order to determining a risk is under-controlled the risk practitioner will need to

monitor and evaluate IT performance

identify risk management best practices

determine the sufficiency of the IT risk budget

An organization is considering the adoption of an aggressive business strategy to achieve desired growth From a risk management perspective what should the risk practitioner do NEXT?

Identify new threats resorting from the new business strategy

Update risk awareness training to reflect current levels of risk appetite and tolerance

Inform the board of potential risk scenarios associated with aggressive business strategies

Increase the scale for measuring impact due to threat materialization

Which of the following practices would be MOST effective in protecting personality identifiable information (Ptl) from unauthorized access m a cloud environment?

Utilize encryption with logical access controls

Apply data classification policy

Utilize encryption with logical access controls

Require logical separation of company data

Which of the following will BEST help to ensure implementation of corrective action plans?

Assigning accountability to risk owners

Establishing employee awareness training

Assigning accountability to risk owners

Selling target dates to complete actions

Which of the following would BEST facilitate the implementation of data classification requirements?

Implementing a data toss prevention (DLP) solution

Implementing technical controls over the assets

Which of the following is MOST important for mitigating ethical risk when establishing accountability for control ownership?

Ensuring regular risk messaging is Included in business communications from leadership

Ensuring processes are documented to enable effective control execution

Ensuring regular risk messaging is Included in business communications from leadership

Ensuring schedules and deadlines for control-related deliverables are strictly monitored

Ensuring performance metrics balance business goals with risk appetiie

Which of the following management action will MOST likely change the likelihood rating of a risk scenario related to remote network access?

Updating the organizational policy for remote access

Creating metrics to track remote connections

Implementing multi-factor authentication

Updating remote desktop software

After the implementation of internal of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?

To confirm the impact to the risk profile

To reevaluate continued use to IoT devices

The add new controls to mitigate the risk

The recommend changes to the IoT policy

To confirm the impact to the risk profile

An organization control environment is MOST effective when:

control designs are reviewed periodically

controls are implemented consistently.

The PRIMARY objective of collecting information and reviewing documentation when performing periodic risk analysis should be to:

Understand internal and external threat agents.

Identify new or emerging risk issues.

Survey and analyze historical risk data.

Understand internal and external threat agents.

Isaca CRISC Practice Test 24 - Free Online Exam Prep & Questions

Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 24

Question

Isaca CRISC Practice Tests

Practice Tests