Which of the following is the GREATEST benefit of using IT risk scenarios?

They facilitate communication of risk.

They support compliance with regulations.

They provide evidence of risk assessment.

They facilitate communication of risk.

They enable the use of key risk indicators (KRls)

When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?

When updating the risk register

After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to

inform the process owner of the concerns and propose measures to reduce them.

recommend a program that minimizes the concerns of that production system.

inform the process owner of the concerns and propose measures to reduce them.

inform the IT manager of the concerns and propose measures to reduce them.

inform the development team of the concerns and together formulate risk reduction measures.

Which of the following is the PRIMARY objective of risk management?

Identify threats and vulnerabilities.

One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner's BEST recommendation?

Additional mitigating controls should be identified.

The system should not be used until the application is changed

The organization's IT risk appetite should be adjusted.

The associated IT risk should be accepted by management.

An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?

Initiate a retest of the full control

Retest the control using the new application as the only sample.

Review the corresponding change control documentation

Re-evaluate the control during (he next assessment

Which of the following would present the GREATEST challenge for a risk practitioner during a merger of two organizations?

Variances between organizational risk appetites

Different taxonomies to categorize risk scenarios

Disparate platforms for governance, risk, and compliance (GRC) systems

Dissimilar organizational risk acceptance protocols

An organization has introduced risk ownership to establish clear accountability for each process. To ensure effective risk ownership, it is MOST important that:

senior management has oversight of the process.

process ownership aligns with IT system ownership.

segregation of duties exists between risk and process owners.

risk owners have decision-making authority.

Which of the following should be the PRIMARY focus of a risk owner once a decision is made to mitigate a risk?

Ensuring that control design reduces risk to an acceptable level

Updating the risk register to include the risk mitigation plan

Determining processes for monitoring the effectiveness of the controls

Ensuring that control design reduces risk to an acceptable level

Confirming to management the controls reduce the likelihood of the risk

An organization plans to implement a new Software as a Service (SaaS) speech-to-text solution Which of the following is MOST important to mitigate risk associated with data privacy?

Secure encryption protocols are utilized.

Multi-factor authentication is set up for users.

The solution architecture is approved by IT.

A risk transfer clause is included in the contact

When creating a separate IT risk register for a large organization, which of the following is MOST important to consider with regard to the existing corporate risk 'register?

Leveraging business risk professionals

Relying on generic IT risk scenarios

Describing IT risk in business terms

Which of the following is the PRIMARY accountability for a control owner?

Ensure the control operates effectively.

Communicate risk to senior management.

Own the associated risk the control is mitigating.

Ensure the control operates effectively.

Identify and assess control weaknesses.

A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner s NEXT step? r

Update the risk register with the results.

Prepare a business case for the response options.

Identify resources for implementing responses.

Develop a mechanism for monitoring residual risk.

Update the risk register with the results.

Which of the following should be a risk practitioner's NEXT step after learning of an incident that has affected a competitor?

Activate the incident response plan.

Implement compensating controls.

WhichT5f the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?

Conduct organization-w>de phishing simulations.

Enforce sanctions for noncompliance with security procedures.

Conduct organization-w>de phishing simulations.

Require training on the data handling policy.

Require regular testing of the data breach response plan.

Which of the following BEST enables senior management lo compare the ratings of risk scenarios?

Key performance indicators (KPIs)

Which of the following is the PRIMARY reason for an organization to include an acceptable use banner when users log in?

To reduce the likelihood of insider threat

To eliminate the possibility of insider threat

To enable rapid discovery of insider threat

To reduce the impact of insider threat

A recent regulatory requirement has the potential to affect an organization's use of a third party to supply outsourced business services. Which of the following is the BEST course of action?

Terminate the outsourcing agreement.

Identify compensating controls.

Transfer risk to the third party.

Which of the following is MOST important to include when reporting the effectiveness of risk management to senior management?

Changes in residual risk levels against acceptable levels

Changes in the organization's risk appetite and risk tolerance levels

Impact due to changes in external and internal risk factors

Changes in residual risk levels against acceptable levels

Gaps in best practices and implemented controls across the industry

Which of the following proposed benefits is MOST likely to influence senior management approval to reallocate budget for a new security initiative?

Reduction in the number of incidents

Reduction in the number of known vulnerabilities

Which of the following is the MOST important course of action for a risk practitioner when reviewing the results of control performance monitoring?

Analyze appropriateness of key performance indicators (KPIs).

Evaluate changes to the organization's risk profile.

Validate whether the controls effectively mitigate risk.

Confirm controls achieve regulatory compliance.

Analyze appropriateness of key performance indicators (KPIs).

Which of the following is MOST important to ensure when reviewing an organization's risk register?

Vulnerabilities have separate entries.

Residual risk is less than inherent risk.

Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?

Conduct a simulated phishing attack.

Revise the acceptable use policy

Strengthen disciplinary procedures

Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management's action plan?

Require annual end user policy acceptance.

Review awareness training assessment results

Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?

Key third-party personnel have recently been replaced.

Service level agreements (SLAs) have not been met over the last quarter.

The service contract is up for renewal in less than thirty days.

Key third-party personnel have recently been replaced.

Monthly service charges are significantly higher than industry norms.

Which of the following is the MOST important characteristic of a key risk indicator (KRI) to enable decision-making?

Illustrating changes in risk trends

Monitoring the risk until the exposure is reduced

Setting minimum sample sizes to ensure accuracy

Listing alternative causes for risk events

Illustrating changes in risk trends

Which of the following is MOST important when determining risk appetite?

Assessing regulatory requirements

Benchmarking against industry standards

Which of the following should be management's PRIMARY consideration when approving risk response action plans?

Changes in residual risk after implementing the plans

Ability of the action plans to address multiple risk scenarios

Ease of implementing the risk treatment solution

Changes in residual risk after implementing the plans

Prioritization for implementing the action plans

When classifying and prioritizing risk responses, the areas to address FIRST are those with:

high cost effectiveness ratios and high risk levels

low cost effectiveness ratios and high risk levels

high cost effectiveness ratios and low risk levels.

high cost effectiveness ratios and high risk levels

low cost effectiveness ratios and low risk levels.

A legacy application used for a critical business function relies on software that has reached the end of extended support Which of the following is the MOST effective control to manage this application?

Increase the frequency of regular system and data backups.

Subscribe to threat intelligence to monitor external attacks.

Apply patches for a newer version of the application.

Segment the application within the existing network.

Increase the frequency of regular system and data backups.

Who is MOST important lo include in the assessment of existing IT risk scenarios?

Technology subject matter experts

Isaca CRISC Practice Test 30 - Free Online Exam Prep & Questions

Which of the following is MOST important to determine as a result of a risk assessment?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 30

Question

Isaca CRISC Practice Tests

Practice Tests