Which of the following would be a risk practitioner's BEST recommendation upon learning of an updated cybersecurity regulation that could impact the organization?

Implement compensating controls

An organization is planning to move its application infrastructure from on-premises to the cloud. Which of the following is the BEST course of the actin to address the risk associated with data transfer if the relationship is terminated with the vendor?

Ensure the language in the contract explicitly states who is accountable for each step of the data transfer process

Meet with the business leaders to ensure the classification of their transferred data is in place

Ensure the language in the contract explicitly states who is accountable for each step of the data transfer process

Collect requirements for the environment to ensure the infrastructure as a service (IaaS) is configured appropriately.

Work closely with the information security officer to ensure the company has the proper security controls in place.

Which of the following would be the result of a significant increase in the motivation of a malicious threat actor?

Increase in risk event likelihood

Increase in mitigating control costs

Increase in risk event likelihood

Increase in cybersecurity premium

Which of the following would BEST facilitate the implementation of data classification requirements?

Implementing technical control over the assets

Implementing a data loss prevention (DLP) solution

Which of the following sources is MOST relevant to reference when updating security awareness training materials?

Recent security incidents reported by competitors

Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?

Several risk action plans have missed target completion dates.

Senior management has accepted more risk than usual.

Risk associated with many assets is only expressed in qualitative terms.

Many risk scenarios are owned by the same senior manager.

When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?

Verbal majority acceptance of risk by committee

A memo indicating risk acceptance

Which of the following is the BEST method of creating risk awareness in an organization?

Ensuring senior management commitment to risk training

Marking the risk register available to project stakeholders

Ensuring senior management commitment to risk training

Providing regular communication to risk managers

Appointing the risk manager from the business units

A bank recently incorporated Blockchain technology with the potential to impact known risk within the organization. Which of the following is the risk practitioner's BEST course of action?

Analyze and update control assessments with the new processes.

Determine whether risk responses are still adequate.

Analyze and update control assessments with the new processes.

Analyze the risk and update the risk register as needed.

Conduct testing of the control that mitigate the existing risk.

When developing risk scenario using a list of generic scenarios based on industry best practices, it is MOST imported to:

Validate the generic risk scenarios for relevance.

Assess generic risk scenarios with business users.

Validate the generic risk scenarios for relevance.

Select the maximum possible risk scenarios from the list.

Identify common threats causing generic risk scenarios

Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?

Inaccurate reporting of results

Increased time to remediate vulnerabilities

Inaccurate reporting of results

Increased number of vulnerabilities

Network performance degradation

Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?

To monitor the vendor's control effectiveness

To provide input to the organization's risk appetite

To monitor the vendor's control effectiveness

To verify the vendor's ongoing financial viability

To assess the vendor's risk mitigation plans

Which of the following is the MOST important objective from a cost perspective for considering aggregated risk responses in an organization?

Address more than one risk response

Prioritize risk response options

Address more than one risk response

Effective risk communication BEST benefits an organization by:

helping personnel make better-informed decisions

assisting the development of a risk register.

improving the effectiveness of IT controls.

increasing participation in the risk assessment process.

Which of the following is the BEST control to minimize the risk associated with scope creep in software development?

An established process for project change management

Retention of test data and results for review purposes

Business managements review of functional requirements

Segregation between development, test, and production

Which of the following is MOST important to update when an organization's risk appetite changes?

Key performance indicators (KPIs)

The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:

successfully within the expected time frame.

by the security administration team.

successfully within the expected time frame.

successfully during the first attempt.

without causing an unplanned system outage.

In order to efficiently execute a risk response action plan, it is MOST important for the emergency response team members to understand:

defined roles and responsibilities.

system architecture in target areas.

IT management policies and procedures.

business objectives of the organization.

defined roles and responsibilities.

Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?

The percentage of corporate budget allocated to IT risk activities

The number of stakeholders involved in IT risk identification workshops

The percentage of corporate budget allocated to IT risk activities

The percentage of incidents presented to the board

The number of executives attending IT security awareness training

Which of the following is MOST important for senior management to review during an acquisition?

Key risk indicator (KRI) thresholds

Senior management wants to increase investment in the organization's cybersecurity program in response to changes in the external threat landscape. Which of the following would BEST help to prioritize investment efforts?

Reviewing the outcome of the latest security risk assessment

Analyzing cyber intelligence reports

Engaging independent cybersecurity consultants

Increasing the frequency of updates to the risk register

Reviewing the outcome of the latest security risk assessment

Which of the following should be of GREATEST concern when reviewing the results of an independent control assessment to determine the effectiveness of a vendor's control environment?

The report was provided directly from the vendor.

The risk associated with multiple control gaps was accepted.

The control owners disagreed with the auditor's recommendations.

The controls had recurring noncompliance.

Which of the following is the MOST critical factor to consider when determining an organization's risk appetite?

Budget for implementing security

Which of the following is the MOST important key performance indicator (KPI) to monitor the effectiveness of disaster recovery processes?

Percentage of IT systems meeting the recovery time objective (RTO) during the disaster recovery test

Percentage of IT systems recovered within the mean time to restore (MTTR) during the disaster recovery test

Percentage of issues arising from the disaster recovery test resolved on time

Percentage of IT systems included in the disaster recovery test scope

Percentage of IT systems meeting the recovery time objective (RTO) during the disaster recovery test

A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner's NEXT step?

Prepare a business case for the response options.

Develop a mechanism for monitoring residual risk.

Update the risk register with the results.

Prepare a business case for the response options.

Identify resources for implementing responses.

The objective of aligning mitigating controls to risk appetite is to ensure that:

the cost of controls does not exceed the expected loss.

exposures are reduced to the fullest extent

exposures are reduced only for critical business systems

the cost of controls does not exceed the expected loss.

When a risk practitioner is determining a system's criticality. it is MOST helpful to review the associated:

business impact analysis (BIA).

When evaluating a number of potential controls for treating risk, it is MOST important to consider:

residual risk and cost of control.

risk appetite and control efficiency.

inherent risk and control effectiveness.

residual risk and cost of control.

risk tolerance and control complexity.

Which of the following is the MOST effective way to reduce potential losses due to ongoing expense fraud?

Perform regular internal audits

Develop and communicate fraud prevention policies

Conduct fraud prevention awareness training.

An organization is participating in an industry benchmarking study that involves providing customer transaction records for analysis Which of the following is the MOST important control to ensure the privacy of customer information?

Nondisclosure agreements (NDAs)

Isaca CRISC Practice Test 25 - Free Online Exam Prep & Questions

An organization is analyzing the risk of shadow IT usage. Which of the following is the MOST important input into the assessment?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 25

Question

Isaca CRISC Practice Tests

Practice Tests