Which of the following would BEST ensure that identified risk scenarios are addressed?

Performing real-time monitoring of threats

Reviewing the implementation of the risk response

Creating a separate risk register for key business units

Performing real-time monitoring of threats

Performing regular risk control self-assessments

The PRIMARY objective of testing the effectiveness of a new control before implementation is to:

confirm control alignment with business objectives.

ensure that risk is mitigated by the control.

measure efficiency of the control process.

confirm control alignment with business objectives.

comply with the organization's policy.

Which of the following is the PRIMARY reason to perform ongoing risk assessments?

The risk environment is subject to change.

Emerging risk must be continuously reported to management.

New system vulnerabilities emerge at frequent intervals.

The risk environment is subject to change.

The information security budget must be justified.

Which of the following is the MOST important foundational element of an effective three lines of defense model for an organization?

Clearly defined roles and responsibilities

A robust risk aggregation tool set

Clearly defined roles and responsibilities

A well-established risk management committee

Well-documented and communicated escalation procedures

Which of the following is the MOST important characteristic of an effective risk management program?

Risk response plans are documented

Controls are mapped to key risk scenarios.

Key risk indicators are defined.

Which of the following should be the PRIMARY input when designing IT controls?

Internal and external risk reports

Benchmark of industry standards

Internal and external risk reports

Recommendations from IT risk experts

Outcome of control self-assessments

A risk practitioners PRIMARY focus when validating a risk response action plan should be that risk response:

reduces risk to an acceptable level

Management has noticed storage costs have increased exponentially over the last 10 years because most users do not delete their emails. Which of the following can BEST alleviate this issue while not sacrificing security?

Implementing record retention tools and techniques

Establishing e-discovery and data loss prevention (DLP)

Sending notifications when near storage quota

Implementing a bring your own device 1BVOD) policy

Which of the following will BEST help mitigate the risk associated with malicious functionality in outsourced application development?

Implement a service level agreement.

Perform an m-depth code review with an expert

Validate functionality by running in a test environment

Implement a service level agreement.

Utilize the change management process.

Which of the following would be the BEST recommendation if the level of risk in the IT risk profile has decreased and is now below management's risk appetite?

Optimize the control environment.

Realign risk appetite to the current risk level.

Decrease the number of related risk scenarios.

Reduce the risk management budget.

A risk assessment has identified that departments have installed their own WiFi access points on the enterprise network. Which of the following would be MOST important to include in a report to senior management?

The WiFi access point configuration

Which of the following should be the HIGHEST priority when developing a risk response?

The risk response aligns with the organization's risk appetite.

The risk response addresses the risk with a holistic view.

The risk response is based on a cost-benefit analysis.

The risk response is accounted for in the budget.

The risk response aligns with the organization's risk appetite.

Which of the following risk register updates is MOST important for senior management to review?

Extending the date of a future action plan by two months

Retiring a risk scenario no longer used

Avoiding a risk that was previously accepted

A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?

An increase in attempted distributed denial of service (DDoS) attacks

An increase in attempted website phishing attacks

A decrease in achievement of service level agreements (SLAs)

A decrease in remediated web security vulnerabilities

Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?

Cost of downtime due to a disaster

Cost of offsite backup premises

Cost of downtime due to a disaster

Cost of testing the business continuity plan

Response time of the emergency action plan

Periodically reviewing and updating a risk register with details on identified risk factors PRIMARILY helps to:

build a threat profile of the organization for management review.

minimize the number of risk scenarios for risk assessment.

aggregate risk scenarios identified across different business units.

build a threat profile of the organization for management review.

provide a current reference to stakeholders for risk-based decisions.

Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?

An increase in the level of residual risk

A decrease in control layering effectiveness

An increase in control vulnerabilities

An increase in the level of residual risk

When determining which control deficiencies are most significant, which of the following would provide the MOST useful information?

Vulnerability assessment results

Which of the following is the MOST important consideration when multiple risk practitioners capture risk scenarios in a single risk register?

Using a consistent method for risk assessment

Aligning risk ownership and control ownership

Developing risk escalation and reporting procedures

Maintaining up-to-date risk treatment plans

Using a consistent method for risk assessment

Reviewing results from which of the following is the BEST way to identify information systems control deficiencies?

Vulnerability and threat analysis

Which of the following would be MOST important for a risk practitioner to provide to the internal audit department during the audit planning process?

Closed management action plans from the previous audit

An updated vulnerability management report

A list of identified generic risk scenarios

The number of tickets to rework application code has significantly exceeded the established threshold. Which of the following would be the risk practitioner s BEST recommendation?

Implement version control software.

Implement training on coding best practices

It is MOST appropriate for changes to be promoted to production after they are:

approved by the business owner.

communicated to business management

approved by the business owner.

Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?

Assess the vulnerability management process.

Conduct a control serf-assessment.

Conduct a vulnerability assessment.

Reassess the inherent risk of the target.

Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios?

Derive scenarios from IT risk policies and standards.

Map scenarios to a recognized risk management framework.

Gather scenarios from senior management.

Benchmark scenarios against industry peers.

Isaca CRISC Practice Test 3 - Free Online Exam Prep & Questions

Which of the following is the BEST way for a risk practitioner to help management prioritize risk response?

Align business objectives to the risk profile.

Assess risk against business objectives

Implement an organization-specific risk taxonomy.

Explain risk details to management.

Comment (0)

Isaca CRISC Practice Test 3

Question

Isaca CRISC Practice Tests

Practice Tests