The MAJOR reason to classify information assets is

establish recovery time objectives (RTOs)

maintain a current inventory and catalog of information assets

determine their sensitivity and critical

establish recovery time objectives (RTOs)

Which of the following key performance indicators (KPis) would BEST measure me risk of a service outage when using a Software as a Service (SaaS) vendors

Frequency and duration of unplanned downtime

Frequency of business continuity plan (BCP) lasting

Frequency and number of new software releases

Frequency and duration of unplanned downtime

Number of IT support staff available after business hours

Which of the following BEST balances the costs and benefits of managing IT risk*?

Prioritizing and addressing risk in line with risk appetite . Eliminating risk through preventive and detective controls

Considering risk that can be shared with a third party

Evaluating the probability and impact of risk scenarios

A MAJOR advantage of using key risk indicators (KRis) is that (hey

assess risk scenarios that exceed defined thresholds

identify when risk exceeds defined thresholds

assess risk scenarios that exceed defined thresholds

identify scenarios that exceed defined risk appetite

help with internal control assessments concerning risk appellate

Who is MOST appropriate to be assigned ownership of a control

The individual accountable for monitoring control effectiveness

The individual responsible for control operation

The individual informed of the control effectiveness

The individual responsible for resting the control

The individual accountable for monitoring control effectiveness

Which stakeholder is MOST important to include when defining a risk profile during me selection process for a new third party application'?

The information security manager

An internal audit report reveals that a legacy system is no longer supported Which of the following is the risk practitioner's MOST important action before recommending a risk response'

Assess the potential impact and cost of mitigation

Review historical application down me and frequency

Assess the potential impact and cost of mitigation

identify other legacy systems within the organization

Explore the feasibility of replacing the legacy system

Which of the following would be of GREATEST concern regarding an organization's asset management?

Lack of a mature records management program

Lack of a dedicated asset management team

To define the risk management strategy which of the following MUST be set by the board of directors?

Annualized loss expectancy (ALE)

Which of the following is the PRIMARY reason to engage business unit managers in risk management processes'?

Enhanced understanding of enterprise architecture (EA)

Improved alignment will technical risk

Better-informed business decisions

Enhanced understanding of enterprise architecture (EA)

Improved business operations efficiency

An organization retains footage from its data center security camera for 30 days when the policy requires 90-day retention The business owner challenges whether the situation is worth remediating Which of the following is the risk manager s BEST response'

Highlight news articles about data breaches

Identify the regulatory bodies that may highlight this gap

Highlight news articles about data breaches

Evaluate the risk as a measure of probable loss

Verify if competitors comply with a similar policy

An organization has been experiencing an increasing number of spear phishing attacks Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?

Require strong password complexity

implement a security awareness program

Implement two-factor authentication

During a risk assessment, a risk practitioner learns that an IT risk factor is adequately mitigated by compensating controls in an associated business process. Which of the following would enable the MOST effective management of the residual risk?

Schedule periodic reviews of the compensating controls' effectiveness.

Report the use of compensating controls to senior management.

Recommend additional IT controls to further reduce residual risk.

Request that ownership of the compensating controls is reassigned to IT

Which of the following will BEST ensure that controls adequately support business goals and objectives?

Using the risk management process

Enforcing strict disciplinary procedures in case of noncompliance

Reviewing results of the annual company external audit

Adopting internationally accepted controls

Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?

Percentage of projects with developed controls on scope creep

Percentage of projects with key risk accepted by the project steering committee

Reduction in risk policy noncompliance findings

Percentage of projects with developed controls on scope creep

Reduction in audits involving external risk consultants

Which of the following is MOST likely to introduce risk for financial institutions that use blockchain?

Implementation of unproven applications

Disruption to business processes

Increase in attack surface area

Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?

Chief information officer (CIO)

A risk practitioner is reviewing accountability assignments for data risk in the risk register. Which of the following would pose the GREATEST concern?

The risk owner is listed as the department responsible for decision making.

The risk owner is not the control owner for associated data controls.

The risk owner is in a business unit and does not report through the IT department.

The risk owner is listed as the department responsible for decision making.

The risk owner is a staff member rather than a department manager.

A penetration test reveals several vulnerabilities in a web-facing application. Which of the following should be the FIRST step in selecting a risk response?

Assess the level of risk associated with the vulnerabilities.

Correct the vulnerabilities to mitigate potential risk exposure.

Develop a risk response action plan with key stakeholders.

Assess the level of risk associated with the vulnerabilities.

Communicate the vulnerabilities to the risk owner.

After an annual risk assessment is completed, which of the following would be MOST important to communicate to stakeholders?

An increase in reported vulnerabilities

An increase in identified risk scenarios

Which of the following would MOST likely cause management to unknowingly accept excessive risk?

Risk tolerance being set too low

The MOST important measure of the effectiveness of risk management in project implementation is the percentage of projects:

introduced into production without high-risk issues.

having the risk register updated regularly.

having key risk indicators (KRIs) established to measure risk.

having an action plan to remediate overdue issues.

Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?

Encrypt data before it leaves the organization.

Use an encrypted tunnel lo connect to the cloud.

Encrypt the data in the cloud database.

Encrypt physical hard drives within the cloud.

Encrypt data before it leaves the organization.

When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?

Results of benchmarking studies

Number of emergency change requests

Which of the following is the ULTIMATE goal of conducting a privacy impact analysis (PIA)?

To identify gaps in data protection controls

To develop a customer notification plan

To identify personally identifiable information (Pll)

To determine gaps in data identification processes

Isaca CRISC Practice Test 29 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CRISC Practice Test 29

Question

Isaca CRISC Practice Tests

Practice Tests