Which of the following should a risk practitioner do NEXT after learning that Internet of Things (loT) devices installed in the production environment lack appropriate security controls for sensitive data?

Assess the threat and associated impact.

Evaluate risk appetite and tolerance levels

Recommend device management controls

Enable role-based access control.

Which of the following process controls BEST mitigates the risk of an employee issuing fraudulent payments to a vendor?

Enforcing segregation of duties between the vendor master file and invoicing

Performing credit verification of third-party vendors prior to payment

Conducting system access reviews to ensure least privilege and appropriate access

Performing regular reconciliation of payments to the check registers

Enforcing segregation of duties between the vendor master file and invoicing

Which of the following is the MOST important reason to restrict access to the risk register on a need-to-know basis?

It contains vulnerabilities and threats.

The risk methodology is intellectual property.

Contents may be used as auditable findings.

Risk scenarios may be misinterpreted.

The BEST way for management to validate whether risk response activities have been completed is to review:

control effectiveness test results.

Which of the following is the PRIMARY benefit of integrating risk and security requirements in an organization's enterprise architecture (EA)?

Consistent management of information assets

Adherence to legal and compliance requirements

Reduction in the number of test cases in the acceptance phase

Establishment of digital forensic architectures

Consistent management of information assets

A key risk indicator (KRI) that incorporates data from external open-source threat intelligence sources has shown changes in risk trend data. Which of the following is MOST important to update in the risk register?

Legal aspects of risk realization

A risk practitioner discovers that an IT operations team manager bypassed web filtering controls by using a mobile device, in violation of the network security policy. Which of the following should the risk practitioner do FIRST?

Plan a security awareness session.

Which of the following is the BEST control for a large organization to implement to effectively mitigate risk related to fraudulent transactions?

Clear roles and responsibilities

Which of the following is the GREATEST concern if user acceptance testing (UAT) is not conducted when implementing a new application?

The application could fail to meet defined business requirements

The probability of application defects will increase

Data confidentiality could be compromised

Increase in the use of redundant processes

The application could fail to meet defined business requirements

Which of the following is the PRIMARY reason to ensure policies and standards are properly documented within the risk management process?

It establishes a means for senior management to formally approve risk practices.

It facilitates the use of a framework for risk management.

It establishes a means for senior management to formally approve risk practices.

It encourages risk-based decision making for stakeholders.

It provides a basis for benchmarking against industry standards.

A risk assessment has revealed that the probability of a successful cybersecurity attack is increasing. The potential loss could exceed the organization's risk appetite. Which of the following ould be the MOST effective course of action?

Review cybersecurity incident response procedures.

Re-evaluate the organization's risk appetite.

Outsource the cybersecurity function.

Purchase cybersecurity insurance.

Review cybersecurity incident response procedures.

Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?

Implement compensating controls until the preferred action can be completed.

Develop additional key risk indicators (KRIs) until the preferred action can be completed.

Replace the action owner with a more experienced individual.

Change the risk response strategy of the relevant risk to risk avoidance.

An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers. Which of the following should be the MOST important consideration for a risk-based review of the user requirements?

Impact to the accuracy of claim calculation

Number of claims affected by the user requirements

Impact to the accuracy of claim calculation

Level of resources required to implement the user requirements

Which of the following is the BEST indicator of the effectiveness of a control?

Number of control deviations detected

The number of exceptions granted

Number of steps necessary to operate process

Number of control deviations detected

Key control indicators (KCls) help to assess the effectiveness of the internal control environment PRIMARILY by:

providing information on the degree to which controls are meeting intended objectives.

ensuring controls are operating efficiently and facilitating productivity.

enabling senior leadership to better understand the level of risk the organization is facing.

monitoring changes in the likelihood of adverse events due to ineffective controls.

providing information on the degree to which controls are meeting intended objectives.

A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two years ago. Which of the following is the GREATEST concern with this request?

Participation in the risk assessment may constitute a conflict of interest.

The risk assessment team may be overly confident of its ability to identify issues.

The risk practitioner may be unfamiliar with recent application and process changes.

The risk practitioner may still have access rights to the financial system.

Participation in the risk assessment may constitute a conflict of interest.

When outsourcing a business process to a cloud service provider, it is MOST important to understand that:

accountability for the risk will remain with the organization.

insurance could be acquired for the risk associated with the outsourced process.

service accountability remains with the cloud service provider.

a risk owner must be designated within the cloud service provider.

accountability for the risk will remain with the organization.

Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization's risk register?

Limit access to senior management only.

Require users to sign a confidentiality agreement.

Which of the following BEST enables an organization to determine whether risk management is aligned with its goals and objectives?

The organization has an approved enterprise architecture (EA) program.

The organization has approved policies that provide operational boundaries.

Organizational controls are in place to effectively manage risk appetite.

Environmental changes that impact risk are continually evaluated.

The organization has an approved enterprise architecture (EA) program.

Which of the following is the BEST method for determining an enterprise's current appetite for risk?

Interviews with senior management

Comparative analysis of peer companies

Reviews of brokerage firm assessments

Interviews with senior management

Trend analysis using prior annual reports

Which of the following is the MOST important course of action to foster an ethical, risk-aware culture?

Establish an enterprise-wide ethics training and awareness program.

Implement a fraud detection and prevention framework.

Ensure the alignment of the organization's policies and standards to the defined risk appetite.

Establish an enterprise-wide ethics training and awareness program.

Perform a comprehensive review of all applicable legislative frameworks and requirements.

An online payment processor would be severely impacted if the fraud detection system has an outage. Which of the following is the BEST way to address this risk?

Introduce recovery control procedures.

Implement continuous control monitoring.

Communicate the risk to management.

Introduce recovery control procedures.

A risk practitioner is developing a set of bottom-up IT risk scenarios. The MOST important time to involve business stakeholders is when:

documenting the risk scenarios.

identifying risk mitigation controls.

Which of the following is MOST important to identify when developing top-down risk scenarios?

Senior management's risk appetite

Which of the following is the BEST course of action for a system administrator who suspects a colleague may be intentionally weakening a system's validation controls in order to pass through fraudulent transactions?

Share the concern through a whistleblower communication channel.

Implement compensating controls to deter fraud attempts.

Share the concern through a whistleblower communication channel.

Monitor the activity to collect evidence.

Determine whether the system environment has flaws that may motivate fraud attempts.

An organization has updated its acceptable use policy to mitigate the risk of employees disclosing confidential information. Which of the following is the BEST way to reinforce the effectiveness of this policy?

Train all staff on relevant information security best practices.

Communicate sanctions for policy violations to all staff.

Obtain signed acceptance of the new policy from employees.

Train all staff on relevant information security best practices.

Implement data loss prevention (DLP) within the corporate network.

Which of the following situations would BEST justify escalation to senior management?

Residual risk exceeds acceptable limits.

Residual risk is inadequately recorded.

Residual risk remains after controls have been applied.

Residual risk equals current risk.

Which of the following is MOST important for management to consider when deciding whether to invest in an IT initiative that exceeds management's risk appetite?

Risk management industry trends

Which of the following is MOST important to review when evaluating the ongoing effectiveness of the IT risk register?

The status of identified risk scenarios

The costs associated with mitigation options

The status of identified risk scenarios

The cost-benefit analysis of each risk response

The timeframes for risk response actions

An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?

Determine whether the impact is outside the risk appetite.

Request a formal acceptance of risk from senior management.

Report the ineffective control for inclusion in the next audit report.

Deploy a compensating control to address the identified deficiencies.

A risk practitioner is performing a risk assessment of recent external advancements in quantum computing. Which of the following would pose the GREATEST concern for the risk practitioner?

The organization has not reviewed its encryption standards.

The organization has incorporated blockchain technology in its operations.

The organization has not reviewed its encryption standards.

The organization has implemented heuristics on its network firewall.

The organization has not adopted Infrastructure as a Service (laaS) for its operations.

Which of the following will MOST likely change as a result of the decrease in risk appetite due to a new privacy regulation?

Key risk indicator (KRI) thresholds

Key performance indicators (KPIs)

Isaca CRISC Practice Test 33 - Free Online Exam Prep & Questions

A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk to acceptable levels. Which of the following should the risk practitioner do FIRST?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 33

Question

Isaca CRISC Practice Tests

Practice Tests