An audit reveals that several terminated employee accounts maintain access. Which of the following should be the FIRST step to address the risk?

Develop an access control policy.

Which of the following would be- MOST helpful to understand the impact of a new technology system on an organization's current risk profile?

Hire consultants specializing m the new technology.

Review existing risk mitigation controls.

Which of the following should be the PRIMARY consideration when assessing the automation of control monitoring?

Cost-benefit analysis of automation

impact due to failure of control

Frequency of failure of control

Contingency plan for residual risk

Cost-benefit analysis of automation

The PRIMARY advantage of implementing an IT risk management framework is the:

establishment of a reliable basis for risk-aware decision making.

compliance with relevant legal and regulatory requirements.

improvement of controls within the organization and minimized losses.

alignment of business goals with IT objectives.

Which of the following is the BEST indication of an effective risk management program?

Residual risk is within the organizational risk appetite

Risk action plans are approved by senior management.

Residual risk is within the organizational risk appetite

Mitigating controls are designed and implemented.

Risk is recorded and tracked in the risk register

An organization has outsourced its IT security operations to a third party. Who is ULTIMATELY accountable for the risk associated with the outsourced operations?

The control operators at the third party

The organization's vendor management office

The BEST way to justify the risk mitigation actions recommended in a risk assessment would be to:

benchmark with competitor s actions.

Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?

The number of newly identified security incidents

The number of security incidents escalated to senior management

The number of resolved security incidents

The number of newly identified security incidents

The number of recurring security incidents

Which of the following is MOST important when developing key performance indicators (KPIs)?

Alerts when risk thresholds are reached

Alignment to management reports

Alerts when risk thresholds are reached

Which of the following is the BEST method to ensure a terminated employee's access to IT systems is revoked upon departure from the organization?

The human resources (HR) system automatically revokes system access.

Login attempts are reconciled to a list of terminated employees.

A list of terminated employees is generated for reconciliation against current IT access.

A process to remove employee access during the exit interview is implemented.

The human resources (HR) system automatically revokes system access.

Which of the following is the BEST way to determine the ongoing efficiency of control processes?

Analyze key performance indicators (KPIs).

Perform annual risk assessments.

Analyze key performance indicators (KPIs).

Which of the following is the BEST indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees?

An increase in the number of identified system flaws

A reduction in the number of help desk calls

An increase in the number of identified system flaws

A reduction in the number of user access resets

An increase in the number of incidents reported

After undertaking a risk assessment of a production system, the MOST appropriate action is for the risk manager to:

recommend a program that minimizes the concerns of that production system.

inform the development team of the concerns, and together formulate risk reduction measures.

inform the process owner of the concerns and propose measures to reduce them

inform the IT manager of the concerns and propose measures to reduce them.

Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?

A decrease in the number of key controls

Which of the following is the GREATEST benefit of incorporating IT risk scenarios into the corporate risk register?

Exposure is integrated into the organization's risk profile.

Corporate incident escalation protocols are established.

Exposure is integrated into the organization's risk profile.

Risk appetite cascades to business unit management

The organization-wide control budget is expanded.

Which of the following is the FIRST step in managing the risk associated with the leakage of confidential data?

Define and implement a data classification policy

Maintain and review the classified data inventor.

Implement mandatory encryption on data

Conduct an awareness program for data owners and users.

Define and implement a data classification policy

An unauthorized individual has socially engineered entry into an organization's secured physical premises. Which of the following is the BEST way to prevent future occurrences?

Conduct security awareness training.

Require security access badges.

Which of the following would be MOST useful when measuring the progress of a risk response action plan?

Percentage of mitigated risk scenarios

Annual loss expectancy (ALE) changes

Resource expenditure against budget

Which of the following is the MOST cost-effective way to test a business continuity plan?

Conduct interviews with key stakeholders.

Conduct a disaster recovery exercise.

Conduct a full functional exercise.

Which of the following is the PRIMARY reason for a risk practitioner to use global standards related to risk management?

To continuously improve risk management processes

To build an organizational risk-aware culture

To continuously improve risk management processes

To comply with legal and regulatory requirements

To identify gaps in risk management practices

Which of the following is the FIRST step in managing the security risk associated with wearable technology in the workplace?

Develop risk awareness training.

A risk practitioner observes that hardware failure incidents have been increasing over the last few months. However, due to built-in redundancy and fault-tolerant architecture, there have been no interruptions to business operations. The risk practitioner should conclude that:

a root cause analysis is required

controls are effective for ensuring continuity

no action is required as there was no impact

Which of the following controls will BEST detect unauthorized modification of data by a database administrator?

Reviewing database activity logs

Reviewing database access rights

Reviewing database activity logs

Comparing data to input records

Reviewing changes to edit checks

Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?

Automated logs collected from different systems

Directives from legal and regulatory authorities

Audit reports from internal information systems audits

Automated logs collected from different systems

Trend analysis of external risk factors

When reviewing management's IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?

Re-evaluate the risk scenarios associated with the control

Assess management's risk tolerance.

Recommend management accept the low risk scenarios.

Re-evaluate the risk scenarios associated with the control

During an IT risk scenario review session, business executives question why they have been assigned ownership of IT-related risk scenarios. They feel IT risk is technical in nature and therefore should be owned by IT. Which of the following is the BEST way for the risk practitioner to address these concerns?

Describe IT risk scenarios in terms of business risk.

Recommend the formation of an executive risk council to oversee IT risk.

Provide an estimate of IT system downtime if IT risk materializes.

Educate business executives on IT risk concepts.

A global organization is considering the acquisition of a competitor. Senior management has requested a review of the overall risk profile from the targeted organization. Which of the following components of this review would provide the MOST useful information?

Enterprise risk management framework

An organization has determined a risk scenario is outside the defined risk tolerance level. What should be the NEXT course of action?

Develop a compensating control.

Allocate remediation resources.

Perform a cost-benefit analysis.

During testing, a risk practitioner finds the IT department's recovery time objective (RTO) for a key system does not align with the enterprise's business continuity plan (BCP). Which of the following should be done NEXT?

Report the gap to senior management

Consult with the IT department to update the RTO

Complete a risk exception form.

Consult with the business owner to update the BCP

A risk practitioner is assisting with the preparation of a report on the organization s disaster recovery (DR) capabilities. Which information would have the MOST impact on the overall recovery profile?

The percentage of systems with long recovery target times has decreased.

The percentage of systems meeting recovery target times has increased.

The number of systems tested in the last year has increased.

The number of systems requiring a recovery plan has increased.

The percentage of systems with long recovery target times has decreased.

Which of the following elements of a risk register is MOST likely to change as a result of change in management's risk appetite?

Key risk indicator (KRI) thresholds

Isaca CRISC Practice Test 4 - Free Online Exam Prep & Questions

The PRIMARY benefit of maintaining an up-to-date risk register is that it helps to:

implement uniform controls for common risk scenarios.

ensure business unit risk is uniformly distributed.

build a risk profile for management review.

quantify the organization's risk appetite.

Comment (0)

Isaca CRISC Practice Test 4

Question

Isaca CRISC Practice Tests

Practice Tests