Zero Trust architecture is designed and deployed with adherence to which of the following basic tenets?

All communication is secured regardless of network location.

Incoming traffic must be inspected before connection is established.

Security frameworks and libraries should be leveraged.

Digital identities should be implemented.

All communication is secured regardless of network location.

Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?

To determine the current risk level

To determine the inherent risk level

To determine the acceptable risk level

To determine the current risk level

To determine the desired risk level

Which of the following BEST prevents control gaps in the Zero Trust model when implementing in the environment?

Establishing a robust technical architecture

Relying on multiple solutions for Zero Trust

Utilizing rapid development during implementation

Establishing a robust technical architecture

Starting with a large initial scope

Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?

A regularly updated risk register

A management-approved risk dashboard

A regularly updated risk register

Regularly updated risk management procedures

Which of the following stakeholders define risk tolerance for an enterprise?

The board and executive management

A risk register BEST facilitates which of the following risk management functions?

Reviewing relevant risk scenarios with stakeholders

Analyzing the organization's risk appetite

Influencing the risk culture of the organization

Reviewing relevant risk scenarios with stakeholders

Articulating senior management's intent

Which of the following is the GREATEST risk of relying on artificial intelligence (Al) within heuristic security systems?

Malicious activity may inadvertently be classified as normal during baselining.

Al may result in less reliance on human intervention.

Malicious activity may inadvertently be classified as normal during baselining.

Risk assessments of heuristic security systems are more difficult.

Predefined patterns of malicious activity may quickly become outdated.

Which of the following BEST mitigates the risk associated with inadvertent data leakage by users who work remotely?

Providing encrypted access to organizational assets

Conducting training on the protection of organizational assets

Configuring devices to use virtual IP addresses

Ensuring patching for end-user devices

Providing encrypted access to organizational assets

A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which of the following should be the risk practitioner's IMMEDIATE concern?

Threats are not being detected.

Multiple corporate build images exist.

The process documentation was not updated.

The IT build process was not followed.

Threats are not being detected.

Which of the following is the GREATEST risk associated with inappropriate classification of data?

Users having unauthorized access to data

Inaccurate record management data

Users having unauthorized access to data

Inaccurate recovery time objectives (RTOs)

Lack of accountability for data ownership

The PRIMARY reason for communicating risk assessment results to data owners is to enable the:

prioritization of response efforts.

design of appropriate controls.

industry benchmarking of controls.

prioritization of response efforts.

classification of information assets.

Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?

Percentage of accounts disabled within the service level agreement (SLA)

Proportion of end users having more than one account

Percentage of accounts disabled within the service level agreement (SLA)

Proportion of privileged to non-privileged accounts

Percentage of accounts that have not been activated

A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the following should be done FIRST?

Recalibrate the key performance indicator (KPI).

Re-evaluate the existing control design.

Senior management has requested more information regarding the risk associated with introducing a new application into the environment. Which of the following should be done FIRST?

Perform a cost-benefit analysis.

An organization's board of directors is concerned about recent data breaches in the news and wants to assess its exposure to similar scenarios. Which of the following is the BEST course of action?

Evaluate the organization's existing data protection controls.

Reassess the risk appetite and tolerance levels of the business.

Evaluate the sensitivity of data that the business needs to handle.

Review the organization's data retention policy and regulatory requirements.

Which of the following is the MOST reliable validation of a new control?

Internal audit review of control design

Approval of the control by senior management

Complete and accurate documentation of control objectives

Control owner attestation of control effectiveness

Internal audit review of control design

Which of the following would BEST indicate to senior management that IT processes are improving?

Changes in the position in the maturity model

Changes in the number of security exceptions

Changes to the structure of the risk register

Changes in the number of intrusions detected

Changes in the position in the maturity model

Which of the following information is MOST useful to a risk practitioner for developing IT risk scenarios?

Events that could potentially impact the business

Published vulnerabilities relevant to the business

Threat actors that can trigger events

Events that could potentially impact the business

IT assets requiring the greatest investment

Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

Granting access based on least privilege

Monitoring user activity using security logs

Revoking access for users changing roles

Granting access based on least privilege

Conducting periodic reviews of authorizations granted

Which of the following is the GREATEST risk associated with inappropriate classification of data?

Users having unauthorized access to data

Inaccurate record management data

Inaccurate recovery time objectives (RTOs)

Lack of accountability for data ownership

Users having unauthorized access to data

Which of the following events is MOST likely to trigger the need to conduct a risk assessment?

Introduction of a new product line

An incident resulting in data loss

Changes in executive management

Updates to the information security policy

Introduction of a new product line

Which of the following is the MOST important for an organization to have in place to ensure IT asset protection?

Procedures for risk assessments on IT assets

An IT asset management checklist

An IT asset inventory populated by an automated scanning tool

A plan that includes processes for the recovery of IT assets

Which of the following is the PRIMARY purpose for ensuring senior management understands the organization's risk universe in relation to the IT risk management program?

To define effective enterprise IT risk appetite and tolerance levels

To execute the IT risk management strategy in support of business objectives

To establish business-aligned IT risk management organizational structures

To assess the capabilities and maturity of the organization's IT risk management efforts

Which of the following BEST indicates the effective implementation of a risk treatment plan?

Residual risk is managed within appetite and tolerance.

Inherent risk is managed within an acceptable level.

Residual risk is managed within appetite and tolerance.

Risk treatments are aligned with industry peers.

Key controls are identified and documented.

Which of the following is the MOST essential characteristic of a good IT risk scenario?

The scenario is aligned to a business objective.

The scenario is aligned to business control processes.

The scenario is aligned to the organization's risk appetite and tolerance.

The scenario is aligned to a business objective.

The scenario is aligned to known vulnerabilities in information technology.

Isaca CRISC Practice Test 37 - Free Online Exam Prep & Questions

Which of the following should a risk practitioner do FIRST to support the implementation of governance around organizational assets within an enterprise risk management (ERM) program?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 37

Question

Isaca CRISC Practice Tests

Practice Tests