Which of the following is MOST important to promoting a risk-aware culture?

Open communication of risk reporting

Regular testing of risk controls

Communication of audit findings

Procedures for security monitoring

Open communication of risk reporting

The BEST metric to demonstrate that servers are configured securely is the total number of servers:

meeting the baseline for hardening.

exceeding availability thresholds

exceeding current patching standards.

meeting the baseline for hardening.

If preventive controls cannot be Implemented due to technology limitations, which of the following should be done FIRST to reduce risk7

Redefine the business process to reduce the risk.

Develop a plan to upgrade technology.

Define a process for monitoring risk.

Which of the following resources is MOST helpful to a risk practitioner when updating the likelihood rating in the risk register?

Audit reports with risk ratings

Which of the following would be the BEST way for a risk practitioner to validate the effectiveness of a patching program?

Interview IT operations personnel.

Review change control board documentation.

The BEST indicator of the risk appetite of an organization is the

risk management capability of the organization

regulatory environment of the organization

risk management capability of the organization

board of directors' response to identified risk factors

importance assigned to IT in meeting strategic goals

Which of the following is the BEST method to mitigate the risk of an unauthorized employee viewing confidential data in a database''

Implement role-based access control

Implement a data masking process

Include sanctions in nondisclosure agreements (NDAs)

Install a data loss prevention (DLP) tool

Which of the following is the BEST approach for an organization in a heavily regulated industry to comprehensively test application functionality?

Use anonymized data in a non-production environment

Use production data in a non-production environment

Use masked data in a non-production environment

Use test data in a production environment

Use anonymized data in a non-production environment

Which of the following is the PRIMARY purpose of creating and documenting control procedures?

To increase the likelihood of effective control operation

To facilitate ongoing audit and control testing

To help manage risk to acceptable tolerance levels

To establish and maintain a control inventory

To increase the likelihood of effective control operation

During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do NEXT?

Review the supplier's contractual obligations.

Escalate the non-cooperation to management

Exclude applicable controls from the assessment.

Review the supplier's contractual obligations.

Request risk acceptance from the business process owner.

Which of the following findings of a security awareness program assessment would cause the GREATEST concern to a risk practitioner?

The program uses non-customized training modules.

The program has not decreased threat counts.

The program has not considered business impact.

The program has been significantly revised

The program uses non-customized training modules.

Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

Accountability may not be clearly defined.

Risk ratings may be inconsistently applied.

Different risk taxonomies may be used.

Mitigation efforts may be duplicated.

When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes

risk exposure in business terms

a detailed view of individual risk exposures

a summary of incidents that have impacted the organization.

recommendations by an independent risk assessor.

Following an acquisition, the acquiring company's risk practitioner has been asked to update the organization's IT risk profile What is the MOST important information to review from the acquired company to facilitate this task?

Risk assessment and risk register

Internal and external audit reports

Risk disclosures in financial statements

Risk assessment and risk register

Business objectives and strategies

An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to address this situation?

Recommend a root cause analysis of the incidents.

Recommend additional controls to address the risk.

Update the risk tolerance level to acceptable thresholds.

Update the incident-related risk trend in the risk register.

Recommend a root cause analysis of the incidents.

During an acquisition, which of the following would provide the MOST useful input to the parent company's risk practitioner when developing risk scenarios for the post-acquisition phase?

IT balanced scorecard of each company

Risk management framework adopted by each company

Risk registers of both companies

IT balanced scorecard of each company

Most recent internal audit findings from both companies

Which of the following is the MOST important consideration when communicating the risk associated with technology end-of-life to business owners?

Maintainability and reliability

Which of the following is MOST important when conducting a post-implementation review as part of the system development life cycle (SDLC)?

Verifying that project objectives are met

Identifying project cost overruns

Leveraging an independent review team

Reviewing the project initiation risk matrix

Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:

communicate risk trends to stakeholders.

assign ownership of emerging risk scenarios.

highlight noncompliance with the risk policy

identify threats to emerging technologies.

When defining thresholds for control key performance indicators (KPIs). it is MOST helpful to align:

key risk indicators (KRIs) with risk appetite of the business.

information risk assessments with enterprise risk assessments.

key risk indicators (KRIs) with risk appetite of the business.

the control key performance indicators (KPIs) with audit findings.

control performance with risk tolerance of business owners.

Which of the following is the MOST important step to ensure regulatory requirements are adequately addressed within an organization?

Develop a policy framework that addresses regulatory requirements

Obtain necessary resources to address regulatory requirements

Develop a policy framework that addresses regulatory requirements

Perform a gap analysis against regulatory requirements.

Employ IT solutions that meet regulatory requirements.

Which of the following is the GREATEST benefit of identifying appropriate risk owners?

Accountability is established for risk treatment decisions

Stakeholders are consulted about risk treatment options

Risk owners are informed of risk treatment options

Responsibility is established for risk treatment decisions.

A risk practitioner recently discovered that personal information from the production environment is required for testing purposes in non-production environments. Which of the following is the BEST recommendation to address this situation?

De-identify data before being transferred to the test environment.

Enable data encryption in the test environment.

Prevent the use of production data in the test environment

De-identify data before being transferred to the test environment.

Enforce multi-factor authentication within the test environment.

Which of the following is the GREATEST concern when establishing key risk indicators (KRIs)?

High percentage of lagging indicators

Incomplete documentation for KRI monitoring

Ineffective methods to assess risk

Which of the following provides the MOST useful information to assess the magnitude of identified deficiencies in the IT control environment?

Business impact analysis (BIA) results

Which of the following provides the BEST assurance of the effectiveness of vendor security controls?

Require independent control assessments.

Review vendor control self-assessments (CSA).

Review vendor service level agreement (SLA) metrics.

Require independent control assessments.

Obtain vendor references from existing customers.

The MAIN purpose of selecting a risk response is to.

ensure organizational awareness of the risk level

ensure compliance with local regulatory requirements

demonstrate the effectiveness of risk management practices.

ensure organizational awareness of the risk level

mitigate the residual risk to be within tolerance

Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?

Software support contract expiration

Which of the following is the BEST way to ensure data is properly sanitized while in cloud storage?

Cryptographically scrambling the data

Deleting the data from the file system

Cryptographically scrambling the data

Formatting the cloud storage at the block level

Degaussing the cloud storage media

An organization's recovery team is attempting to recover critical data backups following a major flood in its data center. However, key team members do not know exactly what steps should be taken to address this crisis. Which of the following is the MOST likely cause of this situation?

Failure to test the disaster recovery plan (DRP)

Lack of well-documented business impact analysis (BIA)

Lack of annual updates to the disaster recovery plan (DRP)

Significant changes in management personnel

A control process has been implemented in response to a new regulatory requirement, but has significantly reduced productivity. Which of the following is the BEST way to resolve this concern?

Escalate the issue to senior management

Absorb the loss in productivity.

Request a waiver to the requirements.

Escalate the issue to senior management

Remove the control to accommodate business objectives.

Isaca CRISC Practice Test 26 - Free Online Exam Prep & Questions

Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board''

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 26

Question

Isaca CRISC Practice Tests

Practice Tests