Which of the following is a risk practitioner's BEST recommendation upon learning that an employee inadvertently disclosed sensitive data to a vendor?

Invoke the incident response plan.

Enroll the employee in additional security training.

Invoke the incident response plan.

Instruct the vendor to delete the data.

Which of the following is the BEST method to maintain a common view of IT risk within an organization?

Collecting data for IT risk assessment

Establishing and communicating the IT risk profile

Performing and publishing an IT risk analysis

Which of the following is the MOST important information to cover a business continuity awareness Ira nine, program for all employees of the organization?

Recovery time objectives (RTOs)

Which of the following is the BEST approach for selecting controls to minimize risk?

Control-effectiveness evaluation

The MAIN reason for prioritizing IT risk responses is to enable an organization to:

define key performance indicators (KPIs).

An organization has experienced a cyber attack that exposed customer personally identifiable information (Pll) and caused extended outages of network services. Which of the following stakeholders are MOST important to include in the cyber response team to determine response actions?

Risk owners based on risk impact

Security control owners based on control failures

Cyber risk remediation plan owners

Risk owners based on risk impact

Enterprise risk management (ERM) team

Which of the following is the PRIMARY reason for a risk practitioner to review an organization's IT asset inventory?

To understand vulnerabilities associated with the use of the assets

To plan for the replacement of assets at the end of their life cycles

To assess requirements for reducing duplicate assets

To understand vulnerabilities associated with the use of the assets

To calculate mean time between failures (MTBF) for the assets

A risk practitioner implemented a process to notify management of emergency changes that may not be approved. Which of the following is the BEST way to provide this information to management?

Change management meeting minutes

Which of the following should be the GREATEST concern to a risk practitioner when process documentation is incomplete?

Inability to identify the risk owner

Inability to allocate resources efficiently

Inability to identify the risk owner

Inability to complete the risk register

Inability to identify process experts

Which of the following is the MOST effective way to help ensure accountability for managing risk?

Assign process owners to key risk areas.

Obtain independent risk assessments.

Assign incident response action plan responsibilities.

Create accurate process narratives.

Which of the following would be of MOST concern to a risk practitioner reviewing risk action plans for documented IT risk scenarios?

Target dates for completion are missing from some action plans.

Individuals outside IT are managing action plans for the risk scenarios.

Target dates for completion are missing from some action plans.

Senior management approved multiple changes to several action plans.

Many action plans were discontinued after senior management accepted the risk.

Which of the following is MOST important for an organization to consider when developing its IT strategy?

The organization's risk appetite statement

Organizational goals and objectives

The organization's risk appetite statement

Legal and regulatory requirements

Which of the following is the BEST way to ensure adequate resources will be allocated to manage identified risk?

Assigning risk ownership to appropriate roles

Prioritizing risk within each business unit

Reviewing risk ranking methodology

Promoting an organizational culture of risk awareness

Assigning risk ownership to appropriate roles

Which of the following provides the MOST comprehensive information when developing a risk profile for a system?

Results of a business impact analysis (BIA)

A mapping of resources to business processes

An organization has decided to implement a new Internet of Things (loT) solution. Which of the following should be done FIRST when addressing security concerns associated with this new technology?

Develop new loT risk scenarios.

Implement loT device monitoring software.

Introduce controls to the new threat environment.

Engage external security reviews.

Which of the following is MOST important to consider before determining a response to a vulnerability?

Lack of data to measure threat events

The likelihood and impact of threat events

The cost to implement the risk response

Lack of data to measure threat events

Which of the following is the PRIMARY objective of maintaining an information asset inventory?

To provide input to business impact analyses (BIAs)

To manage information asset licensing

Which of the following provides the MOST useful information for developing key risk indicators (KRIs)?

Business impact analysis (BIA) results

Possible causes of materialized risk

Which of the following should be used as the PRIMARY basis for evaluating the state of an organization's cloud computing environment against leading practices?

The cloud environment's capability maturity model

The cloud environment's risk register

The cloud computing architecture

The organization's strategic plans for cloud computing

An organization is implementing robotic process automation (RPA) to streamline business processes. Given that implementation of this technology is expected to impact existing controls, which of the following is the risk practitioner's BEST course of action?

Reassess whether mitigating controls address the known risk in the processes.

Update processes to address the new technology.

Update the data governance policy to address the new technology.

Perform a gap analysis of the impacted processes.

Which of the following is the MOST important consideration for effectively maintaining a risk register?

The register is updated frequently.

An IT owner is assigned for each risk scenario.

The register is updated frequently.

The register is shared with executive management.

Compensating controls are identified.

Which of the following activities BEST facilitates effective risk management throughout the organization?

Conducting periodic risk assessments

Reviewing risk-related process documentation

Conducting periodic risk assessments

Performing a business impact analysis (BIA)

Which of the following is the MOST important benefit of reporting risk assessment results to senior management?

Facilitation of risk-aware decision making

Promotion of a risk-aware culture

Compilation of a comprehensive risk register

Alignment of business activities

Facilitation of risk-aware decision making

When performing a risk assessment of a new service to support a core business process, which of the following should be done FIRST to ensure continuity of operations?

Identify conditions that may cause disruptions.

Define metrics for restoring availability.

Identify conditions that may cause disruptions.

Review incident response procedures.

Evaluate the probability of risk events.

What should be the PRIMARY consideration related to data privacy protection when there are plans for a business initiative to make use of personal information?

Ensure all data is encrypted at rest and during transit.

Do not collect or retain data that is not needed.

Limit access to the personal data.

Ensure all data is encrypted at rest and during transit.

Which of the following has the GREATEST influence on an organization's risk appetite?

Management culture and behavior

Internal and external risk factors

Business objectives and strategies

Management culture and behavior

Which organization is implementing a project to automate the purchasing process, including the modification of approval controls. Which of the following tasks is lie responsibility of the risk practitioner*?

Test approval process controls once the project is completed

Verify that existing controls continue to properly mitigate defined risk

Test approval process controls once the project is completed

Update the existing controls for changes in approval processes from this project

Perform a gap analysis of the impacted control processes

Which of the following is MOST important to determine when assessing the potential risk exposure of a loss event involving personal data?

The length of time between identification and containment of the incident

The cost associated with incident response activities The composition and number of records in the information asset

The maximum levels of applicable regulatory fines

The length of time between identification and containment of the incident

Which of the following s MOST likely to deter an employee from engaging in inappropriate use of company owned IT systems?

Communication of employee activity monitoring

A centralized computer security response team

Regular performance reviews and management check-ins

Code of ethics training for all employees

Communication of employee activity monitoring

Which of the following is the GREATEST benefit of a three lines of defense structure?

Clear accountability for risk management processes

An effective risk culture that empowers employees to report risk

Effective segregation of duties to prevent internal fraud

Clear accountability for risk management processes

Improved effectiveness and efficiency of business operations

Which of the following is the PRIMARY objective of establishing an organization's risk tolerance and appetite?

To assist management in decision making

To align with board reporting requirements

To assist management in decision making

To create organization-wide risk awareness

To minimize risk mitigation efforts

Isaca CRISC Practice Test 28 - Free Online Exam Prep & Questions

Which of the following BEST facilitates the identification of appropriate key performance indicators (KPIs) for a risk management program?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 28

Question

Isaca CRISC Practice Tests

Practice Tests