The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

obtain a holistic view of IT strategy risk.

identify specific project risk.

obtain a holistic view of IT strategy risk.

understand risk associated with complex processes.

incorporate subject matter expertise.

A risk assessment has been completed on an application and reported to the application owner. The report includes validated vulnerability findings that require mitigation. Which of the following should be the NEXT step?

Prepare a risk response that is aligned to the organization's risk tolerance.

Report the findings to executive management to enable treatment decisions.

Reassess each vulnerability to evaluate the risk profile of the application.

Conduct a penetration test to determine how to mitigate the vulnerabilities.

Prepare a risk response that is aligned to the organization's risk tolerance.

Which of the following BEST enables the development of a successful IT strategy focused on business risk mitigation?

Obtaining input from business management

Providing risk awareness training for business units

Obtaining input from business management

Understanding the business controls currently in place

Conducting a business impact analysis (BIA)

Which of the following activities should only be performed by the third line of defense?

Providing assurance on risk management processes

Operating controls for risk mitigation

Testing the effectiveness and efficiency of internal controls

Providing assurance on risk management processes

Recommending risk treatment options

Which of the following is MOST important for managing ethical risk?

Establishing a code of conduct for employee behavior

Involving senior management in resolving ethical disputes

Developing metrics to trend reported ethics violations

Identifying the ethical concerns of each stakeholder

Establishing a code of conduct for employee behavior

What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner's business impact analysis (BIA)?

Determine the business purpose of the application.

Include the application in the business continuity plan (BCP).

Determine the business purpose of the application.

Segregate the application from the network.

Report the finding to management.

Which of the following is a risk practitioner's BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?

Redesign key risk indicators (KRIs).

An organization has established workflows in its service desk to support employee reports of security-related concerns. Which of the following is the MOST efficient approach to analyze these concerns?

Prioritize concerns based on frequency of reports.

Map concerns to organizational assets.

Prioritize concerns based on frequency of reports.

Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?

Enterprise architecture (EA) documentation

Organizational risk appetite statement

Enterprise architecture (EA) documentation

Which of the following would BEST facilitate the maintenance of data classification requirements?

Implementing technical controls over the assets

Establishing a data loss prevention (DLP) solution

Which of the following is the PRIMARY reason for a risk practitioner to report changes and trends in the IT risk profile to senior management?

To ensure IT risk is managed within acceptable limits

To ensure risk owners understand their responsibilities

To ensure IT risk is managed within acceptable limits

To ensure the organization complies with legal requirements

To ensure the IT risk awareness program is effective

Continuous monitoring of key risk indicators (KRIs) will:

provide an early warning so that proactive action can be taken.

ensure that risk will not exceed the defined risk appetite of the organization.

provide an early warning so that proactive action can be taken.

provide a snapshot of the risk profile.

ensure that risk tolerance and risk appetite are aligned.

An organization allows programmers to change production systems in emergency situations. Which of the following is the BEST control?

Implementing an emergency change authorization process

Periodically reviewing operator logs

Limiting the number of super users

Reviewing the programmers' emergency change reports

Which of the following is the BEST recommendation when a key risk indicator (KRI) is generating an excessive volume of events?

Reevaluate the design of the KRIs.

Develop a corresponding key performance indicator (KPI).

Monitor KRIs within a specific timeframe.

Activate the incident response plan.

Which of the following is MOST important to consider when determining the value of an asset during the risk identification process?

The monetary value of the asset

The vulnerability profile of the asset

The size of the asset's user base

Which of the following is the MOST effective way to validate organizational awareness of cybersecurity risk?

Implementing mock phishing exercises

Conducting security awareness training

Updating the information security policy

Implementing mock phishing exercises

Requiring two-factor authentication

A risk practitioner wants to identify potential risk events that affect the continuity of a critical business process. Which of the following should the risk practitioner do FIRST?

Review the methodology used to conduct the business impact analysis (BIA).

Evaluate current risk management alignment with relevant regulations.

Determine if business continuity procedures are reviewed and updated on a regular basis.

Review the methodology used to conduct the business impact analysis (BIA).

Conduct a benchmarking exercise against industry peers.

Which of the following is the BEST risk management approach for the strategic IT planning process?

Risk scenarios associated with IT strategic initiatives are identified and assessed.

Key performance indicators (KPIs) are established to track IT strategic initiatives.

The IT strategic plan is reviewed by the chief information security officer (CISO) and enterprise risk management (ERM).

The IT strategic plan is developed from the organization-wide risk management plan.

Risk scenarios associated with IT strategic initiatives are identified and assessed.

Which of the following would be MOST helpful in assessing the risk associated with data loss due to human vulnerabilities?

Conducting social engineering exercises

Reviewing password change history

Performing periodic access recertification

Conducting social engineering exercises

Reviewing the results of security awareness surveys

Which of the following will BEST help to improve an organization's risk culture?

Establishing a risk awareness program

Maintaining a documented risk register

Establishing a risk awareness program

Rewarding employees for reporting security incidents

Allocating resources for risk remediation

Which of the following should be the FIRST course of action if the risk associated with a new technology is found to be increasing?

Revise the current risk action plan.

Escalate the risk to senior management.

Which of the following is the PRIMARY benefit of consistently recording risk assessment results in the risk register?

Assessment of organizational risk appetite

Which of the following is a risk practitioner's BEST recommendation to help reduce IT risk associated with scheduling overruns when starting a new application development project?

Involve the development team in planning.

Implement a tool to track the development team's deliverables.

Review the software development life cycle.

Involve the development team in planning.

Assign more developers to the project team.

A migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing. Which part of the risk register should be updated FIRST?

Payroll system risk mitigation plans

Payroll administrative controls

Which of the following is the BEST key performance indicator (KPI) to measure the ability to deliver uninterrupted IT services?

Mean time between failures (MTBF)

Which of the following is MOST important for a multinational organization to consider when developing its security policies and standards?

Differences in regulatory requirements

Regional competitors' policies and standards

Ability to monitor and enforce compliance

Differences in regulatory requirements

When determining the accuracy of a key risk indicator (KRI), it is MOST important that the indicator:

is correlated to risk and tracks variances in the risk.

is assigned to IT processes and projects with a low level of risk.

has a high correlation with the process outcome.

triggers response based on risk thresholds.

Which of the following should be of MOST concern to a risk practitioner reviewing the system development life cycle (SDLC)?

Testing is completed by IT support users without input from end users.

Testing is completed in phases, with user testing scheduled as the final phase.

Segregation of duties controls are overridden during user testing phases.

Data anonymization is used during all cycles of end-user testing.

Testing is completed by IT support users without input from end users.

Which of the following is the BEST response when a potential IT control deficiency has been identified?

Verify the deficiency and then notify the business process owner.

Remediate and report the deficiency to the enterprise risk committee.

Verify the deficiency and then notify the business process owner.

Verify the deficiency and then notify internal audit.

Remediate and report the deficiency to senior executive management.

An organization's stakeholders are unable to agree on appropriate risk responses. Which of the following would be the BEST course of action?

Identify a risk transfer option.

Benchmark with similar industries.

Which of the following is the MOST important success factor when introducing risk management in an organization?

Establishing executive management support

Defining a risk mitigation strategy and plan

Establishing executive management support

Isaca CRISC Practice Test 32 - Free Online Exam Prep & Questions

Which of the following should be a risk practitioner's GREATEST concern upon learning of failures in a data migration activity?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 32

Question

Isaca CRISC Practice Tests

Practice Tests