Which of the following situations presents the GREATEST challenge to creating a comprehensive IT risk profile of an organization?

Risk-averse organizational risk appetite

Manual vulnerability scanning processes

Organizational reliance on third-party service providers

Inaccurate documentation of enterprise architecture (EA)

Risk-averse organizational risk appetite

Which of the following BEST enables a risk practitioner to understand management's approach to organizational risk?

Risk appetite and risk tolerance

Organizational structure and job descriptions

Risk appetite and risk tolerance

Industry best practices for risk management

Prior year's risk assessment results

Which of the following is the MOST important reason to validate that risk responses have been executed as outlined in the risk response plan''

To ensure completion of the risk assessment cycle

To ensure controls arc operating effectively

To ensure residual risk Is at an acceptable level

To ensure control costs do not exceed benefits

Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

KRIs provide an early warning that a risk threshold is about to be reached.

KRIs assist in the preparation of the organization's risk profile.

KRIs signal that a change in the control environment has occurred.

KRIs provide a basis to set the risk appetite for an organization

KRIs provide an early warning that a risk threshold is about to be reached.

Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?

To support decision-making for risk response

To hold risk owners accountable for risk action plans

To secure resourcing for risk treatment efforts

To enable senior management to compile a risk profile

Which of the following should be the FIRST consideration when establishing a new risk governance program?

Creating policies and standards that are easy to comprehend

Developing an ongoing awareness and training program

Creating policies and standards that are easy to comprehend

Embedding risk management into the organization

Completing annual risk assessments on critical resources

When establishing an enterprise IT risk management program, it is MOST important to:

report identified IT risk scenarios to senior management.

review alignment with the organizations strategy.

understand the organization's information security policy.

validate the organization's data classification scheme.

report identified IT risk scenarios to senior management.

An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?

Develop a business continuity plan (BCP).

Prepare a cost-benefit analysis to evaluate relocation.

Prepare a disaster recovery plan (DRP).

Conduct a business impact analysis (BIA) for an alternate location.

Develop a business continuity plan (BCP).

Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

KRIs provide an early warning that a risk threshold is about to be reached.

KRIs signal that a change in the control environment has occurred.

KRIs provide a basis to set the risk appetite for an organization.

KRIs assist in the preparation of the organization's risk profile.

What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical legacy system?

Segment the system on its own network.

Ensure regular backups take place.

Virtualize the system in the cloud.

Install antivirus software on the system.

Which of the following would provide the MOST helpful input to develop risk scenarios associated with hosting an organization's key IT applications in a cloud environment?

Conducting a risk workshop with key stakeholders

Reviewing the results of independent audits

Performing a site visit to the cloud provider's data center

Performing a due diligence review

Conducting a risk workshop with key stakeholders

A newly incorporated enterprise needs to secure its information assets From a governance perspective which of the following should be done FIRST?

Establish an inventory of information assets

Define information retention requirements and policies

Provide information security awareness training

Establish security management processes and procedures

Establish an inventory of information assets

A highly regulated enterprise is developing a new risk management plan to specifically address legal and regulatory risk scenarios What should be done FIRST by IT governance to support this effort?

Request a regulatory risk reporting methodology

Require critical success factors (CSFs) for IT risks.

Establish IT-specific compliance objectives

Communicate IT key risk indicators (KRIs) and triggers

Business management is seeking assurance from the CIO that IT has a plan in place for early identification of potential issues that could impact the delivery of a new application Which of the following is the BEST way to increase the chances of a successful delivery'?

Include business management on a weekly risk and issues report

Implement a release and deployment plan

Conduct comprehensive regression testing.

Develop enterprise-wide key risk indicators (KRls)

Include business management on a weekly risk and issues report

A root because analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators Who should be accountable for resolving the situation?

Chief information officer (CIO)

Which of the following presents the GREATEST challenge to managing an organization's end-user devices?

Incomplete end-user device inventory

Unsupported end-user applications

Multiple end-user device models

Which of the following is the MOST important outcome of a business impact analysis (BIA)?

Understanding and prioritization of critical processes

Completion of the business continuity plan (BCP)

Identification of regulatory consequences

Reduction of security and business continuity threats

Senior management is deciding whether to share confidential data with the organization's business partners. The BEST course of action for a risk practitioner would be to submit a report to senior management containing the:

possible risk and suggested mitigation plans.

design of controls to encrypt the data to be shared.

project plan for classification of the data.

summary of data protection and privacy legislation.

Which of the following is MOST important for successful incident response?

The timeliness of attack recognition

The quantity of data logged by the attack control tools

Blocking the attack route immediately

The ability to trace the source of the attack

The timeliness of attack recognition

Which of The following BEST represents the desired risk posture for an organization?

Residual risk is lower than risk tolerance.

Inherent risk is lower than risk tolerance.

Operational risk is higher than risk tolerance.

Accepted risk is higher than risk tolerance.

Residual risk is lower than risk tolerance.

An organization is adopting blockchain for a new financial system. Which of the following should be the GREATEST concern for a risk practitioner evaluating the system's production readiness?

Limited organizational knowledge of the underlying technology

Lack of commercial software support

Varying costs related to implementation and maintenance

Slow adoption of the technology across the financial industry

Which of the following should be the PRIMARY basis for prioritizing risk responses?

The replacement cost of the business asset

The cost of risk mitigation controls

The classification of the business asset

Risk appetite should be PRIMARILY driven by which of the following?

Enterprise security architecture roadmap

Legal and regulatory requirements

What is the MAIN benefit of using a top-down approach to develop risk scenarios?

It uses hypothetical and generic risk events specific to the enterprise.

It describes risk events specific to technology used by the enterprise.

It establishes the relationship between risk events and organizational objectives.

It uses hypothetical and generic risk events specific to the enterprise.

It helps management and the risk practitioner to refine risk scenarios.

When developing a response plan to address security incidents regarding sensitive data loss, it is MOST important

review the data classification policy.

revalidate current key risk indicators (KRIs).

revise risk management procedures.

review the data classification policy.

revalidate existing risk scenarios.

Which of the following potential scenarios associated with the implementation of a new database technology presents the GREATEST risk to an organization?

Application and data migration cost for backups may exceed budget.

The organization may not have a sufficient number of skilled resources.

Application and data migration cost for backups may exceed budget.

Data may not be recoverable due to system failures.

The database system may not be scalable in the future.

After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:

analyze changes to aggregate risk.

prepare a follow-up risk assessment.

recommend acceptance of the risk scenarios.

reconfirm risk tolerance levels.

analyze changes to aggregate risk.

Which of the following provides the MOST reliable evidence of a control's effectiveness?

A risk and control self-assessment

Senior management's attestation

A system-generated testing report

An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization's customer service operations overseas. Which of the following would MOST significantly impact management's decision?

Cross-border information transfer restrictions in the outsourcing country

Time zone difference of the outsourcing location

Ongoing financial viability of the outsourcing company

Cross-border information transfer restrictions in the outsourcing country

Historical network latency between the organization and outsourcing location

Which of the following is the MOST effective way for a large and diversified organization to minimize risk associated with unauthorized software on company devices?

Scan end points for applications not included in the asset inventory.

Prohibit the use of cloud-based virtual desktop software.

Conduct frequent reviews of software licenses.

Perform frequent internal audits of enterprise IT infrastructure.

Isaca CRISC Practice Test 27 - Free Online Exam Prep & Questions

A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which ot the following is the risk practitioner's BEST course of action?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 27

Question

Isaca CRISC Practice Tests

Practice Tests