The percentage of unpatched systems is a:

key performance indicator (KPI).

Which of the following events is MOST likely to trigger the need to conduct a risk assessment?

Introduction of a new product line

An incident resulting in data loss

Introduction of a new product line

Changes in executive management

Updates to the information security policy

Which of the following is BEST used to aggregate data from multiple systems to identify abnormal behavior?

Endpoint detection and response (EDR)

A risk practitioner's BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:

mapped to incident response plans.

aligned with risk management capabilities.

Which of the following is the MOST important update for keeping the risk register current?

Modifying organizational structures when lines of business merge

Adding new risk assessment results annually

Retiring risk scenarios that have been avoided

Changing risk owners due to employee turnover

Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?

A regularly updated risk register

Regularly updated risk management procedures

A management-approved risk dashboard

A regularly updated risk register

During a recent security framework review, it was discovered that the marketing department implemented a non-fungible token asset program. This was done without following established risk procedures. Which of the following should the risk practitioner do FIRST?

Conduct risk awareness training.

An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk practitioner do FIRST?

Review assignments of data ownership for key assets.

Identify staff who have access to the organization's sensitive data.

Identify recent and historical incidents involving data loss.

Review the organization's data inventory.

A robotic process automation (RPA) project has implemented new robots to enhance the efficiency of a sales business process. Which of the following provides the BEST evidence that the new controls have been implemented successfully?

A qualified independent party assessed the new controls as effective.

A post-implementation review has been conducted by key personnel.

A qualified independent party assessed the new controls as effective.

Senior management has signed off on the design of the controls.

Robots have operated without human interference on a daily basis.

Which of the following should be the PRIMARY focus of a disaster recovery management (DRM) framework and related processes?

Ensuring timely recovery of critical business operations

Restoring IT and cybersecurity operations

Assessing the impact and probability of disaster scenarios

Ensuring timely recovery of critical business operations

Determining capacity for alternate sites

A risk practitioner has been notified of a social engineering attack using artificial intelligence (Al) technology to impersonate senior management personnel. Which of the following would BEST mitigate the impact of such attacks?

Training and awareness of employees for increased vigilance

Increased monitoring of executive accounts

Subscription to data breach monitoring sites

Suspension and takedown of malicious domains or accounts

Which of the following presents the GREATEST privacy risk related to personal data processing for a global organization?

Personal data processing occurs in an offshore location with a data sharing agreement.

Privacy risk awareness training has not been conducted across the organization.

The organization has not incorporated privacy into its risk management framework.

The organization allows staff with access to personal data to work remotely.

Personal data processing occurs in an offshore location with a data sharing agreement.

Which of the following describes the relationship between risk appetite and risk tolerance?

Risk tolerance may exceed risk appetite.

Risk appetite is completely independent of risk tolerance.

Risk tolerance is used to determine risk appetite.

Risk appetite and risk tolerance are synonymous.

Risk tolerance may exceed risk appetite.

Which of the following should be the MOST important consideration when determining controls necessary for a highly critical information system?

The level of acceptable risk to the organization

The number of threats to the system

The organization's available budget

The number of vulnerabilities to the system

The level of acceptable risk to the organization

Which of the following is MOST important to ensure risk management practices are effective at all levels within the organization?

Embedding risk management in business activities

Communicating risk awareness materials regularly

Establishing key risk indicators (KRIs) to monitor risk management processes

Ensuring that business activities minimize inherent risk

Embedding risk management in business activities

Which of the following scenarios presents the GREATEST risk of noncompliance with data privacy best practices?

Data being used for purposes the data subjects have not opted into

Making data available to a larger audience of customers

Data not being disposed according to the retention policy

Personal data not being de-identified properly

Data being used for purposes the data subjects have not opted into

A business impact analysis (BIA) enables an organization to determine appropriate IT risk mitigation actions by:

identifying IT assets that support key business processes.

validating whether critical IT risk has been addressed.

assigning accountability for IT risk to business functions.

identifying IT assets that support key business processes.

defining the requirements for an IT risk-aware culture

Which of the following should be reported periodically to the risk committee?

Changes to risk assessment methodology

A risk practitioner is advising management on how to update the IT policy framework to account for the organization s cloud usage. Which of the following should be the FIRST step in this process?

Determine gaps between the current state and target framework.

Consult with industry peers regarding cloud best practices.

Evaluate adherence to existing IT policies and standards.

Determine gaps between the current state and target framework.

Adopt an industry-leading cloud computing framework.

Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise's brand on Internet sites?

Scanning the Internet to search for unauthorized usage

Utilizing data loss prevention (DLP) technology

Monitoring the enterprise's use of the Internet

Scanning the Internet to search for unauthorized usage

Developing training and awareness campaigns

Which of the following BEST enables an organization to address risk associated with technical complexity?

Aligning with a security architecture

Documenting system hardening requirements

Minimizing dependency on technology

Aligning with a security architecture

Establishing configuration guidelines

Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

To ensure program risk events are mitigated in a timely manner

To validate the quality of defined deliverables for the program

To detect increases in program costs

To ensure program risk events are mitigated in a timely manner

To provide timely reporting to the governance steering committee

Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findings. What type of measure has been established?

Key performance indicator (KPI)

A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?

Action plans to address risk scenarios requiring treatment

The methodology used to perform the risk assessment

Action plans to address risk scenarios requiring treatment

Date and status of the last project milestone

The individuals assigned ownership of controls

An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack. Which of the following is the MOST effective control to support this policy?

Conducting periodic vulnerability scanning

Implementing continuous intrusion detection monitoring

During the creation of an organization's IT risk management program, the BEST time to identify key risk indicators (KRIs) is while:

developing a risk monitoring process.

reviewing risk response plans with internal audit.

developing a risk monitoring process.

reviewing an external risk assessment.

During a post-implementation review for a new system, users voiced concerns about missing functionality. Which of the following is the BEST way for the organization to avoid this situation in the future?

Conduct user acceptance testing (UAT).

Test system reliability and performance.

Adopt an Agile development approach.

Conduct user acceptance testing (UAT).

Adopt a phased changeover approach.

A risk practitioner has been asked to propose a risk acceptance framework for an organization. Which of the following is the MOST important consideration for the risk practitioner to address in the framework?

Individuals or roles authorized to approve risk acceptance

Consistent forms to document risk acceptance rationales

Acceptable scenarios to override risk appetite or tolerance thresholds

Individuals or roles authorized to approve risk acceptance

Communication protocols when a risk is accepted

Which of the following BEST mitigates reputational risk associated with disinformation campaigns against an organization?

Engaging public relations personnel to debunk false stories and publications

Monitoring digital platforms that disseminate inaccurate or misleading news stories

Engaging public relations personnel to debunk false stories and publications

Restricting the use of social media on corporate networks during specific hours

Providing awareness training to understand and manage these types of attacks

Isaca CRISC Practice Test 36 - Free Online Exam Prep & Questions

Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 36

Question

Isaca CRISC Practice Tests

Practice Tests