An organization has contracted with a cloud service provider to support the deployment of a new product. Of the following, who should own the associated risk?

The head of enterprise architecture (EA)

The information security manager

It was discovered that a service provider's administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (laaS) model. Which of the following would BEST protect against a future recurrence?

Intrusion prevention system (IPS)

Which of the following is the MOST important reason to communicate control effectiveness to senior management?

To ensure management understands the current risk status

To demonstrate alignment with industry best practices

To assure management that control ownership is assigned

To ensure management understands the current risk status

To align risk management with strategic objectives

Which of the following actions should a risk practitioner do NEXT when an increased industry trend of external cyber attacks is identified?

Conduct a threat and vulnerability analysis.

Notify senior management of the new risk scenario.

Update the risk impact rating in the risk register.

Update the key risk indicator (KRI) in the risk register.

The PRIMARY benefit of selecting an appropriate set of key risk indicators (KRIs) is that they:

provide a warning of emerging high-risk conditions.

serve as a basis for measuring risk appetite.

align with the organization's risk profile.

provide a warning of emerging high-risk conditions.

provide data for updating the risk register.

A large organization recently restructured the IT department and has decided to outsource certain functions. What action should the control owners in the IT department take?

Determine whether risk responses still effectively address risk.

Conduct risk classification for associated IT controls.

Determine whether risk responses still effectively address risk.

Perform vulnerability and threat assessments.

Analyze and update IT control assessments.

Which of the following risk activities is BEST facilitated by enterprise architecture (EA)?

Aligning business unit risk responses to organizational priorities

Determining attack likelihood per business unit

Adjusting business unit risk tolerances

Customizing incident response plans for each business unit

A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization's data-handling policy and local privacy regulations. Which of the following would be the BEST recommendation?

Request an exception from the local regulatory agency.

Request a policy exception from senior management.

Comply with the organizational policy.

Report the noncompliance to the local regulatory agency.

Request an exception from the local regulatory agency.

The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:

a post-implementation risk and control self-assessment (RCSA).

results of a business impact analysis (BIA).

the original risk response plan.

training program and user awareness documentation.

a post-implementation risk and control self-assessment (RCSA).

An organization has restructured its business processes, and the business continuity plan (BCP) needs to be revised accordingly. Which of the following should be identified FIRST?

New potentially disruptive scenarios

Ownership assignment for controls

New potentially disruptive scenarios

Contractual changes with customers

An organization is moving its critical assets to the cloud. Which of the following is the MOST important key performance indicator (KPI) to include in the service level agreement (SLA)?

Percentage of standard supplier uptime

Average time to respond to incidents

Number of assets included in recovery processes

Number of key applications hosted

Which of the following is the MOST important criteria for selecting key risk indicators (KRIs)?

Implementation and reporting effort

Which of the following is the BEST metric to demonstrate the effectiveness of an organization's patch management process?

Percent of patches implemented within established timeframe

Average time to implement patches after vendor release

Number of patches tested prior to deployment

Increase in the frequency of patches deployed into production

Percent of patches implemented within established timeframe

What is the MOST important consideration when selecting key performance indicators (KPIs) for control monitoring?

Source information is consistently available.

Source information is acquired at stable cost.

Source information is tailored by removing outliers.

Source information is readily quantifiable.

Source information is consistently available.

Which of the following has the GREATEST positive impact on ethical compliance within the risk management process?

Senior management demonstrates ethics in their day-to-day decision making.

An independent ethics investigation team has been established.

Employees are required to complete ethics training courses annually.

The risk practitioner is required to consult with the ethics committee.

Which of the following deficiencies identified during a review of an organization's cybersecurity policy should be of MOST concern?

The policy has not been approved by the organization's board.

The policy lacks specifics on how to secure the organization's systems from cyberattacks.

The policy has gaps against relevant cybersecurity standards and frameworks.

The policy has not been reviewed by the cybersecurity team in over a year.

The policy has not been approved by the organization's board.

Which of the following is MOST helpful when prioritizing action plans for identified risk?

Comparing risk rating against appetite

Obtaining input from business units

Determining cost of controls to mitigate risk

Ranking the risk based on likelihood of occurrence

Which of the following is the MOST likely reason an organization would engage an independent reviewer to assess its IT risk management program?

To identify gaps in the alignment of IT risk management processes and strategy

To ensure IT risk management is focused on mitigating emerging risk

To confirm that IT risk assessment results are expressed in quantitative terms

To evaluate threats to the organization's operations and strategy

To identify gaps in the alignment of IT risk management processes and strategy

Which of the following is the BEST method to track asset inventory?

Automated asset management software

Periodic asset review by management

Automated asset management software

Which of the following management actions will MOST likely change the likelihood rating of a risk scenario related to remote network access?

Implementing multi-factor authentication

Creating metrics to track remote connections

Updating the organizational policy for remote access

Updating remote desktop software

Implementing multi-factor authentication

An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following should be the risk practitioner's NEXT course of action?

Review the contract and service level agreements (SLAs).

Remove the associated risk from the register.

Validate control effectiveness and update the risk register.

Review the contract and service level agreements (SLAs).

Obtain an assurance report from the third-party provider.

An organization uses a web application hosted by a cloud service that is populated by data sent to the vendor via email on a monthly basis. Which of the following should be the FIRST consideration when analyzing the risk associated with the application?

Whether the data has been appropriately classified

Whether the service provider's data center is located in the same country

Whether the data sent by email has been encrypted

Whether the data has been appropriately classified

Whether the service provider contract allows right of onsite audit

Which of the following is the BEST way to determine the value of information assets for risk management purposes?

Assess the loss impact if the information is inadvertently disclosed.

Calculate the overhead required to keep the information secure throughout its life cycle.

Calculate the replacement cost of obtaining the information from alternate sources.

Assess the market value offered by consumers of the information.

Which of the following BEST facilitates the development of relevant risk scenarios?

Conduct brainstorming sessions with key stakeholders.

Perform quantitative risk analysis of historical data.

Adopt an industry-recognized risk framework.

Use qualitative risk assessment methodologies.

Conduct brainstorming sessions with key stakeholders.

Which of the following is the PRIMARY purpose of a risk register?

To provide a centralized view of risk

To assign control ownership of risk

To provide a centralized view of risk

To identify opportunities to transfer risk

To mitigate organizational risk

A risk practitioner notes control design changes when comparing risk response to a previously approved action plan. Which of the following is MOST important for the practitioner to confirm?

Appropriate approvals for the control changes

The reason the action plan was modified

The risk owner's approval of the revised action plan

The effectiveness of the resulting control

The software version of an enterprise's critical business application has reached end-of-life and is no longer supported by the vendor. IT has decided to develop an in-house replacement application. Which of the following should be the PRIMARY concern?

The business process owner is not an active participant.

The system documentation is not available.

Enterprise risk management (ERM) has not approved the decision.

The board of directors has not approved the decision.

The business process owner is not an active participant.

The PRIMARY focus of an ongoing risk awareness program should be to:

enable better risk-based decisions.

define appropriate controls to mitigate risk.

determine impact of risk scenarios.

expand understanding of risk indicators.

An organization operates in an environment where the impact of ransomware attacks is high, with a low likelihood. After quantifying the impact of the risk associated with ransomware attacks exceeds the organization's risk appetite and tolerance, which of the following is the risk practitioner's BEST recommendation?

Ensure business continuity assessments are up to date.

Obtain adequate cybersecurity insurance coverage.

Ensure business continuity assessments are up to date.

Adjust the organization's risk appetite and tolerance.

Obtain certification to a global information security standard.

Isaca CRISC Practice Test 34 - Free Online Exam Prep & Questions

Which of the following is MOST important when identifying an organization's risk exposure associated with Internet of Things (loT) devices?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 34

Question

Isaca CRISC Practice Tests

Practice Tests