An organization recently experienced a cyber attack that resulted in the loss of confidential customer data. Which of the following is the risk practitioner's BEST recommendation after recovery steps have been completed?

Develop new key risk indicators (KRIs).

Recommend the purchase of cyber insurance.

Review the incident response plan.

An organization wants to transfer risk by purchasing cyber insurance. Which of the following would be MOST important for the risk practitioner to communicate to senior management for contract negotiation purposes?

Current annualized loss expectancy report

Most recent IT audit report results

Current annualized loss expectancy report

Cyber insurance industry benchmarking report

An organizational policy requires critical security patches to be deployed in production within three weeks of patch availability. Which of the following is the BEST metric to verify adherence to the policy?

Maximum time gap between patch availability and deployment

Percentage of critical patches deployed within three weeks

Minimum time gap between patch availability and deployment

Number of critical patches deployed within three weeks

Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?

To provide early warning signs of a potential change in risk level

To provide insight into the effectiveness of the internal control environment

To provide a basis for determining the criticality of risk mitigation controls

To provide benchmarks for assessing control design effectiveness against industry peers

To provide early warning signs of a potential change in risk level

An organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system. Which of the following is the risk practitioner's BEST course of action?

Escalate the risk to senior management.

An organization's capability to implement a risk management framework is PRIMARILY influenced by the:

guidance of the risk practitioner.

competence of the staff involved.

Which of the following BEST supports the management of identified risk scenarios?

Using key risk indicators (KRIs)

Well-developed, data-driven risk measurements should be:

focused on providing a forward-looking view.

reflective of the lowest organizational level.

a data feed taken directly from operational production systems.

reported to management the same day data is collected.

focused on providing a forward-looking view.

Which of the following should be the PRIMARY driver for an organization on a multi-year cloud implementation to publish a cloud security policy?

Establishing minimum cloud security requirements

Evaluating gaps in the on-premise and cloud security profiles

Establishing minimum cloud security requirements

Enforcing compliance with cloud security parameters

Educating IT staff on variances between on premise and cloud security

The PRIMARY reason to implement a formalized risk taxonomy is to:

reduce subjectivity in risk management.

comply with regulatory requirements.

demonstrate best industry practice.

improve visibility of overall risk exposure.

Which of the following scenarios is MOST important to communicate to senior management?

Accepted risk scenarios with impact exceeding the risk tolerance

Accepted risk scenarios with detailed plans for monitoring

Risk scenarios that have been shared with vendors and third parties

Accepted risk scenarios with impact exceeding the risk tolerance

Risk scenarios that have been identified, assessed, and responded to by the risk owners

Which organizational role should be accountable for ensuring information assets are appropriately classified?

Chief information officer (CIO)

Which of the following provides the MOST reliable evidence to support conclusions after completing an information systems controls assessment?

Information generated by the systems

Risk and control self-assessment (CSA) reports

Information generated by the systems

Confirmation from industry peers

A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The alternative site does not reside on the same fault no matter how far the distance apart.

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site is a hot site with equipment ready to resume processing immediately.

The alternative site does not reside on the same fault no matter how far the distance apart.

Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?

To ensure IT risk impact can be compared to the IT risk appetite

To ensure IT risk appetite is communicated across the organization

To ensure IT risk impact can be compared to the IT risk appetite

To ensure IT risk ownership is assigned at the appropriate organizational level

To ensure IT risk scenarios are consistently assessed within the organization

Which of the following will BEST help to ensure implementation of corrective action plans?

Assigning accountability to risk owners

Establishing employee awareness training

Setting target dates to complete actions

Assigning accountability to risk owners

Which of the following is the GREATEST benefit of updating the risk register to include outcomes from a risk assessment?

It facilitates timely risk-based decisions.

It maintains evidence of compliance with risk policy.

It facilitates timely risk-based decisions.

It validates the organization's risk appetite.

It helps to mitigate internal and external risk factors.

Which strategy employed by risk management would BEST help to prevent internal fraud?

Ensure segregation of duties are implemented within key systems or processes.

Require control owners to conduct an annual control certification.

Conduct regular internal and external audits on the systems supporting financial reporting.

Ensure segregation of duties are implemented within key systems or processes.

Require the information security officer to review unresolved incidents.

An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?

Assess the impact of applying the patches on the production environment.

Survey other enterprises regarding their experiences with applying these patches.

Seek information from the software vendor to enable effective application of the patches.

Determine in advance an off-peak period to apply the patches.

An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?

Lack of common understanding of the organization's risk culture

Lack of cross-functional risk assessment workshops within the organization

Lack of common understanding of the organization's risk culture

Lack of quantitative methods to aggregate the total risk exposure

Lack of an integrated risk management system to aggregate risk scenarios

After the announcement of a new IT regulatory requirement, it is MOST important for a risk practitioner to;

review the impact to the IT environment.

prepare an IT risk mitigation strategy.

perform a cost-benefit analysis.

review the impact to the IT environment.

Which of the following scenarios is MOST likely to cause a risk practitioner to request a formal risk acceptance sign-off?

Residual risk in excess of the risk appetite cannot be mitigated.

Inherent risk is too high, resulting in the cancellation of an initiative.

Risk appetite has changed to align with organizational objectives.

Residual risk remains at the same level over time without further mitigation.

An organization's IT team has proposed the adoption of cloud computing as a cost-saving measure for the business. Which of the following should be of GREATEST concern to the risk practitioner?

Due diligence for the recommended cloud vendor has not been performed.

The business can introduce new Software as a Service (SaaS) solutions without IT approval.

The maintenance of IT infrastructure has been outsourced to an Infrastructure as a Service (laaS) provider.

Architecture responsibilities may not be clearly defined.

A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite. Which of the following is the risk practitioner's BEST course of action?

Conduct a risk assessment with stakeholders.

Conduct third-party resilience tests.

Update the risk register with the process changes.

Review risk related to standards and regulations.

Which of the following is the MOST significant indicator of the need to perform a penetration test?

An increase in the number of security incidents

An increase in the number of high-risk audit findings

An increase in the number of security incidents

An increase in the percentage of turnover in IT personnel

An increase in the number of infrastructure changes

An organization's IT department wants to complete a proof of concept (POC) for a security tool. The project lead has asked for approval to use the production data for testing purposes as it will yield the best results. Which of the following is the risk practitioner's BEST recommendation?

Assess the risk of using production data for testing before making a decision.

Accept the risk of using the production data to ensure accurate results.

Assess the risk of using production data for testing before making a decision.

Benchmark against what peer organizations are doing with POC testing environments.

Deny the request, as production data should not be used for testing purposes.

Which of the following is the BEST recommendation of a risk practitioner for an organization that recently changed its organizational structure?

Communicate the new risk profile.

Implement a new risk assessment process.

Revalidate the corporate risk appetite.

Review and adjust key risk indicators (KRIs).

Which of the following is the MOST important document regarding the treatment of sensitive data?

Information classification policy

Digital rights management policy

Information classification policy

The results of a risk assessment reveal risk scenarios with high impact and low likelihood of occurrence. Which of the following would be the BEST action to address these scenarios?

Assemble an incident response team.

Create a disaster recovery plan (DRP).

Initiate a business impact analysis (BIA).

Isaca CRISC Practice Test 31 - Free Online Exam Prep & Questions

Which of the following is the MOST essential factor for managing risk in a highly dynamic environment?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 31

Question

Isaca CRISC Practice Tests

Practice Tests