In the three lines of defense model, a PRIMARY objective of the second line is to:

Ensure risks and controls are effectively managed.

Review and evaluate the risk management program.

Ensure risks and controls are effectively managed.

Implement risk management policies regarding roles and responsibilities.

Act as the owner for any operational risk identified as part of the risk program.

Which of the following is the MOST important consideration when prioritizing risk response?

Effectiveness of risk treatment.

Requirements for regulatory obligations.

Cost of control implementation.

Effectiveness of risk treatment.

Number of risk response options.

Which of the following is BEST measured by key control indicators (KCIs)?

Effectiveness of organizational defense in depth.

Historical trends of the organizational risk profile.

Cost efficiency of risk treatment plan projects.

Comprehensiveness of risk assessment procedures.

Effectiveness of organizational defense in depth.

Which of the following is the MOST useful input when developing risk scenarios?

Common attacks in other industries.

Probability of disruptive risk events.

Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization's risk appetite?

Establishing a series of key risk indicators (KRIs).

Adding risk triggers to entries in the risk register.

Implementing key performance indicators (KPIs).

Developing contingency plans for key processes.

An organization's decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:

Risk appetite set by senior management.

The region in which the organization operates.

Risk appetite set by senior management.

Identified business process controls.

An organization needs to send files to a business partner to perform a quality control audit on the organization's record-keeping processes. The files include personal information on the organization's customers. Which of the following is the BEST recommendation to mitigate privacy risk?

Obfuscate the customers' personal information.

Require the business partner to delete personal information following the audit.

Use a secure channel to transmit the files.

Ensure the contract includes provisions for sharing personal information.

Which of the following is the GREATEST concern related to the monitoring of key risk indicators (KRIs)?

Logs are modified before analysis is conducted.

Logs are retained for longer than required.

Logs are stored in a multi-tenant cloud environment.

Logs are modified before analysis is conducted.

A risk action plan has been changed during the risk mitigation effort. Which of the following is MOST important for the risk practitioner to verify?

Approval for the change by the risk owner.

Impact of the change on inherent risk.

Approval for the change by the risk owner.

Business rationale for the change.

Risk to the mitigation effort due to the change.

An organization requires a third party for processing customer personal data. Which of the following is the BEST approach when sharing data over a public network?

Use a virtual private network (VPN) to communicate data.

Include a nondisclosure agreement (NDA) for personal data in the contract.

Implement a digital rights protection tool to monitor data.

Use a virtual private network (VPN) to communicate data.

Transfer a read-only version of the data.

The BEST use of key risk indicators (KRIs) is to provide:

Early indication of increasing exposure to a specific risk.

Lagging indication of major information security incidents.

Early indication of changes to required risk response.

Insight into the performance of a monitored process.

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?

Compare the residual risk to the current risk appetite.

Recommend risk remediation of the ineffective controls.

Implement key control indicators (KCIs).

Escalate the control failures to senior management.

Who is ULTIMATELY accountable for risk treatment?

Enterprise risk management (ERM)

An organization has implemented a policy requiring staff members to take a minimum of five consecutive days' leave per year to mitigate the risk of malicious insider activities. Which of the following is the BEST key performance indicator (KPI) of the effectiveness of this policy?

Number of suspected malicious activities reported since policy implementation

Percentage of staff turnover following five consecutive days of leave

Average number of consecutive days of leave per staff member

Number of suspected malicious activities reported since policy implementation

Financial loss incurred due to malicious activities since policy implementation

Which of the following BEST enables an organization to address new risk associated with an Internet of Things (IoT) solution?

Introducing control procedures early in the life cycle

Updating the risk tolerance to include the new risk

Implementing IoT device monitoring software

An organization is subject to a new regulation that requires nearly real-time recovery of its services following a disruption. Which of the following is the BEST way to manage the risk in this situation?

Review the business continuity plan (BCP) and align it with the new business needs.

Move redundant IT infrastructure to a closer location.

Obtain insurance and ensure sufficient funds are available for disaster recovery.

Review the business continuity plan (BCP) and align it with the new business needs.

Outsource disaster recovery services to a third-party IT service provider.

A user has contacted the risk practitioner regarding malware spreading laterally across the organization's corporate network. Which of the following is the risk practitioner's BEST course of action?

Notify the cybersecurity incident response team.

Review all log files generated during the period of malicious activity.

Notify the cybersecurity incident response team.

Which of the following BEST reduces the likelihood of fraudulent activity that occurs through use of a digital wallet?

Require multi-factor authentication (MFA) to access the digital wallet.

Require public key infrastructure (PKI) to authorize transactions.

Require multi-factor authentication (MFA) to access the digital wallet.

Use a digital key to encrypt the contents of the wallet.

Enable audit logging on the digital wallet's device.

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Providing assurance of control effectiveness

A global organization is considering the transfer of its customer information systems to an overseas cloud service provider in the event of a disaster. Which of the following should be the MOST important risk consideration?

Regulatory restrictions for cross-border data transfer

Service level objectives in the vendor contract

Organizational culture differences between each country

Management practices within each company

An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack. Which of the following is the MOST effective control to support this policy?

Conducting periodic vulnerability scanning

Implementing continuous intrusion detection monitoring

Recent penetration testing of an organization's software has identified many different types of security risks. Which of the following is the MOST likely root cause for the identified risk?

Threat modeling was not utilized in the software design process.

SIEM software is producing faulty alerts.

Threat modeling was not utilized in the software design process.

The configuration management process is not applied consistently during development.

An identity and access management (IAM) tool has not been properly integrated into the software.

Which of the following would BEST facilitate the implementation of data classification requirements?

Implementing technical controls over the assets

Implementing a data loss prevention (DLP) solution

An organization has implemented a policy requiring staff members to take a minimum of five consecutive days' leave per year to mitigate the risk of malicious insider activities. Which of the following is the BEST key performance indicator (KPI) of the effectiveness of this policy?

Number of suspected malicious activities reported since policy implementation

Financial loss incurred due to malicious activities since policy implementation

Average number of consecutive days of leave per staff member

Number of suspected malicious activities reported since policy implementation

Percentage of staff turnover following five consecutive days of leave

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Providing assurance of control effectiveness

Which of the following outcomes of disaster recovery planning is MOST important to enable the initiation of necessary actions during a disaster?

Recovery time and maximum acceptable data loss thresholds

Definition of disaster recovery plan (DRP) scope and key stakeholders

Recovery time and maximum acceptable data loss thresholds

A checklist including equipment, location of data backups, and backup sites

A list of business areas and critical functions subject to risk analysis

When assigning control ownership, it is MOST important to verify that the owner has accountability for:

The budget for control implementation.

A risk practitioner's BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:

Aligned with risk management capabilities.

Mapped to incident response plans.

Which of the following presents the GREATEST security risk associated with Internet of Things (IoT) technology?

The lack of updates for vulnerable firmware

The inability to monitor via network management solutions

The lack of relevant IoT security frameworks to guide the risk assessment process

The heightened level of IoT threats via the widespread use of smart devices

The lack of updates for vulnerable firmware

Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise's brand on Internet sites?

Scanning the Internet to search for unauthorized usage

Utilizing data loss prevention (DLP) technology

Monitoring the enterprise's use of the Internet

Scanning the Internet to search for unauthorized usage

Developing training and awareness campaigns

Which of the following BEST enables an organization to address risk associated with technical complexity?

Establishing configuration guidelines

Documenting system hardening requirements

Minimizing dependency on technology

Aligning with a security architecture

Establishing configuration guidelines

Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

To ensure program risk events are mitigated in a timely manner

To validate the quality of defined deliverables for the program

To detect increases in program costs

To ensure program risk events are mitigated in a timely manner

To provide timely reporting to the governance steering committee

Isaca CRISC Practice Test 39 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CRISC Practice Test 39

Question

Isaca CRISC Practice Tests

Practice Tests