Which of the following is the MOST important document regarding the treatment of sensitive data?

Information classification policy

Digital rights management policy

Which of the following is the PRIMARY objective of a risk awareness program?

To enhance organizational risk culture

To demonstrate senior management support

To enhance organizational risk culture

To increase awareness of risk mitigation controls

To clearly define ownership of risk

During a review of the asset life cycle process, a risk practitioner identified several unreturned and unencrypted laptops belonging to former employees. Which of the following is the GREATEST concern with this finding?

Unauthorized access to organizational data

Insufficient laptops for existing employees

Abuse of leavers' account privileges

Unauthorized access to organizational data

Financial cost of replacing the laptops

An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?

Determine whether the impact is outside the risk appetite.

Report the ineffective control for inclusion in the next audit report.

Request a formal acceptance of risk from senior management.

Deploy a compensating control to address the identified deficiencies.

Which of the following is a risk practitioner's BEST recommendation regarding disaster recovery management (DRM) for Software as a Service (SaaS) providers?

Codify availability requirements in the SaaS provider's contract.

Conduct inoremental backups of data in the SaaS environment to a local data center.

Implement segregation of duties between multiple SaaS solution providers.

Codify availability requirements in the SaaS provider's contract.

Conduct performance benchmarking against other SaaS service providers.

Which of the following criteria for assigning owners to IT risk scenarios provides the GREATEST benefit to an organization?

The risk owner understands the effect of loss events on business operations.

The risk owner is a member of senior leadership in the IT organization.

The risk owner has strong technical aptitude across multiple business systems.

The risk owner has extensive risk management experience.

Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?

To provide insight into the effectiveness of the intemnal control environment

To provide a basis for determining the criticality of risk mitigation controls

To provide early warning signs of a potential change in risk level

To provide benchmarks for assessing control design effectiveness against industry peers

To provide insight into the effectiveness of the intemnal control environment

Which of the following is the BEST method to track asset inventory?

Automated asset management software

Periodic asset review by management

Automated asset management software

A risk practitioner has reviewed new international regulations and realizes the new regulations will affect the organization. Which of the following should be the risk practitioner's NEXT course of action?

Update risk scenarios in the risk register.

Conduct a peer response assessment.

Update risk scenarios in the risk register.

Reevaluate the risk management program.

Ensure applications are compliant.

Which of the following is MOST important to consider when determining the value of an asset during the risk identification process?

The vulnerability profile of the asset

The monetary value of the asset

The size of the asset's user base

Which of the following should be done FIRST upon learning that the organization will be affected by a new regulation in its industry?

Determine risk appetite for the new regulation.

Implement specific monitoring controls.

An insurance company handling sensitive and personal information from its customers receives a large volume of telephone requests and electronic communications daily. Which of the following is MOST important to include in a risk awareness training session for the customer service department?

Identifying social engineering attacks

Archiving sensitive information

Understanding the incident management process

Identifying social engineering attacks

Understanding the importance of using a secure password

Which of the following is the BEST key performance indicator (KPI) for a server patch management process?

The percentage of servers patched within required service level agreements

The percentage of servers with allowed patching exceptions

The number of servers with local credentials to install patches

The percentage of servers patched within required service level agreements

The number of servers running the software patching service

What is a risk practitioner's BEST approach to monitor and measure how quickly an exposure to a specific risk can affect the organization?

Create key risk indicators (KRIs).

Create an asset valuation report.

Create key performance indicators (KPls).

Create key risk indicators (KRIs).

Create a risk volatility report.

Which of the following is MOST important to update following a change in organizational risk appetite and tolerance?

Business impact assessment (BIA)

Key performance indicators (KPIs)

Which of the following provides the BEST evidence that risk responses are effective?

Residual risk is within risk tolerance.

Risk with low impact is accepted.

Risk ownership is identified and assigned.

Compliance breaches are addressed in a timely manner.

An organization has an internal control that requires all access for employees be removed within 15 days of their termination date. Which of the following should the risk practitioner use to monitor adherence to the 15-day threshold?

Key performance indicator (KPI)

Operation level agreement (OLA)

Key performance indicator (KPI)

Which of the following is the BEST indication that key risk indicators (KRIs) should be revised?

An increase in the number of risk threshold exceptions

An increase in the number of change events pending management review

A decrease in the number of key performance indicators (KPIs)

A decrease in the number of critical assets covered by risk thresholds

Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?

Indicators for detecting the presence of threatsl)

Solutions for eradicating emerging threats

Cost to mitigate the risk resulting from threats

Indicators for detecting the presence of threatsl)

Source and identity of attackers

After conducting a risk assessment for regulatory compliance, an organization has identified only one possible mitigating control. The cost of the control has been determined to be higher than the penalty of noncompliance. Which of the following would be the risk practitioner's BEST recommendation?

Accept the risk with management sign-off.

Ignore the risk until the regulatory body conducts a compliance check.

Mitigate the risk with the identified control.

Transfer the risk by buying insurance.

Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?

Implement compensating controls until the preferred action can be completed.

Replace the action owner with a more experienced individual.

Implement compensating controls until the preferred action can be completed.

Change the risk response strategy of the relevant risk to risk avoidance.

Develop additional key risk indicators (KRIs) until the preferred action can be completed.

Which of the following should be done FIRST when a new risk scenario has been identified

Establish key risk indicators (KRIs).

Which of the following activities is a responsibility of the second line of defense?

Challenging risk decision making

Developing controls to manage risk scenarios

Implementing risk response plans

Establishing organizational risk appetite

Which of the following is MOST important requirement to include in a Software as a Service (SaaS) vendor contract to ensure data is protected?

The vendor must host data in a specific geographic location.

The vendor must provide periodic independent assurance reports.

The vendor must host data in a specific geographic location.

The vendor must be held liable for regulatory fines for failure to protect data.

The vendor must participate in an annual vendor performance review.

A risk practitioner is defining metrics for security threats that were not identified by antivirus software. Which type of metric is being developed?

Operational level agreement (OLA)

Which of the following BEST mitigates ethical risk?

Awareness of consequences for violations

Routine changes in senior management

Which of the following is the BEST approach for obtaining management buy-in to implement additional IT controls?

Describe IT risk impact on organizational processes in monetary terms.

List requirements based on a commonly accepted IT risk management framework.

Provide information on new governance, risk, and compliance (GRC) platform functionalities.

Describe IT risk impact on organizational processes in monetary terms.

Present new key risk indicators (KRIs) based on industry benchmarks.

Which of the following is the MOST important consideration for the board and senior leadership regarding the organization's approach to risk management for emerging technologies?

Ensuring the risk framework and policies are suitable for emerging technologies

Ensuring the organization follows risk management industry best practices

Ensuring IT risk scenarios are updated and include emerging technologies

Ensuring the risk framework and policies are suitable for emerging technologies

Ensuring threat intelligence services are used to gather data about emerging technologies

Reviewing which of the following would provide the MOST useful information when preparing to evaluate the effectiveness of existing controls?

Risk responses in the risk register

Which of the following BEST enables the integration of IT risk management across an organization?

Enterprise risk management (ERM) framework

Enterprise-wide risk awareness training

Robust risk reporting practices

Isaca CRISC Practice Test 35 - Free Online Exam Prep & Questions

A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite. Which of the following is the risk practitioner's BEST course of action?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 35

Question

Isaca CRISC Practice Tests

Practice Tests