A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet. What should be the risk practitioner's FIRST course of action?

invoke the established incident response plan.

Conduct an immediate risk assessment

Which of the following is the MOST effective key performance indicator (KPI) for change management?

Percentage of successful changes

Percentage of changes with a fallback plan

Percentage of successful changes

Average time required to implement a change

An effective control environment is BEST indicated by controls that:

manage risk within the organization's risk appetite.

minimize senior management's risk tolerance.

manage risk within the organization's risk appetite.

reduce the thresholds of key risk indicators (KRIs).

are cost-effective to implement

Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?

Monitoring key access control performance indicators

Updating multi-factor authentication

Monitoring key access control performance indicators

Analyzing access control logs for suspicious activity

Revising the service level agreement (SLA)

A risk assessment has identified that an organization may not be in compliance with industry regulations. The BEST course of action would be to:

conduct a gap analysis against compliance criteria.

identify necessary controls to ensure compliance.

modify internal assurance activities to include control validation.

collaborate with management to meet compliance requirements.

Which of the following criteria is MOST important when developing a response to an attack that would compromise data?

The business significance of the information

The recovery time objective (RTO)

The likelihood of a recurring attack

The organization's risk tolerance

The business significance of the information

Which of the following will BEST help an organization select a recovery strategy for critical systems?

Review the business impact analysis.

Create a business continuity plan.

Analyze previous disaster recovery reports.

A monthly payment report is generated from the enterprise resource planning (ERP) software to validate data against the old and new payroll systems. What is the BEST way to mitigate the risk associated with data integrity loss in the new payroll system after data migration?

Compare processing output from both systems using the previous month's data.

Compare new system reports with functional requirements.

Compare encrypted data with checksums.

Compare results of user acceptance testing (UAT) with the testing criteria.

Compare processing output from both systems using the previous month's data.

Which of the following is the BEST approach for determining whether a risk action plan is effective?

Assessing changes in residual risk

Comparing the remediation cost against budget

Assessing changes in residual risk

Monitoring changes of key performance indicators (KPIs)

Which of the following is the MOST effective way to integrate business risk management with IT operations?

Perform periodic risk assessments.

Perform periodic IT control self-assessments.

Require a risk assessment with change requests.

Provide security awareness training.

Perform periodic risk assessments.

Which of the following should be the PRIMARY objective of a risk awareness training program?

To enable risk-based decision making

To promote awareness of the risk governance function

To clarify fundamental risk management principles

To ensure sufficient resources are available

Which of the following BEST confirms the existence and operating effectiveness of information systems controls?

Review of internal audit and third-party reports

Self-assessment questionnaires completed by management

Review of internal audit and third-party reports

Management review and sign-off on system documentation

First-hand direct observation of the controls in operation

Which of the following BEST confirms the existence and operating effectiveness of information systems controls?

First-hand direct observation of the controls in operation

Self-assessment questionnaires completed by management

Review of internal audit and third-party reports

Management review and sign-off on system documentation

First-hand direct observation of the controls in operation

When establishing leading indicators for the information security incident response process it is MOST important to consider the percentage of reported incidents:

that are verified as actual incidents.

that result in a full root cause analysis.

used for verification within the SLA.

that are verified as actual incidents.

An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes. Which of the following would be the BEST metric to determine if the program is performing as expected?

Ratio of emergency fixes to total changes

Decrease in the time to move changes to production

Ratio of emergency fixes to total changes

Ratio of system changes to total changes

Decrease in number of changes without a fallback plan

Which of the following is MOST helpful in identifying gaps between the current and desired state of the IT risk environment?

Evaluating risk scenarios and assessing current controls

Analyzing risk appetite and tolerance levels

Assessing identified risk and recording results in the risk register

Evaluating risk scenarios and assessing current controls

Reviewing guidance from industry best practices and standards

A control owner responsible for the access management process has developed a machine learning model to automatically identify excessive access privileges. What is the risk practitioner's BEST course of action?

Review the design of the machine learning model against control objectives.

Adopt the machine learning model as a replacement for current manual access reviews.

Ensure the model assists in meeting regulatory requirements for access controls.

Discourage the use of emerging technologies in key processes.

The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:

verify Internet firewall control settings.

ensure policy and regulatory compliance.

assess the proliferation of new threats.

verify Internet firewall control settings.

identify vulnerabilities in the system.

A control owner has completed a year-long project To strengthen existing controls. It is MOST important for the risk practitioner to:

update the risk register to reflect the correct level of residual risk.

ensure risk monitoring for the project is initiated.

conduct and document a business impact analysis (BIA).

verify cost-benefit of the new controls being implemented.

Which of the following is MOST important to review when determining whether a potential IT service provider's control environment is effective?

MOST important to update when an

Service level agreements (SLAs)

Which stakeholders are PRIMARILY responsible for determining enterprise IT risk appetite?

Executive management and the board of directors

Audit and compliance management

The chief information officer (CIO) and the chief financial officer (CFO)

Enterprise risk management and business process owners

Executive management and the board of directors

An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following is the risk practitioner s BEST course of action?

Mitigate the risk with compensating controls enforced by the third-party cloud provider.

Accept the risk and document contingency plans for data disruption.

Remove the associated risk scenario from the risk register due to avoidance.

Mitigate the risk with compensating controls enforced by the third-party cloud provider.

Validate the transfer of risk and update the register to reflect the change.

Which of the following should be a risk practitioner's MOST important consideration when developing IT risk scenarios?

Potential threats and vulnerabilities that may have an impact on the business

The impact of controls on the efficiency of the business in delivering services

Linkage of identified risk scenarios with enterprise risk management

Potential threats and vulnerabilities that may have an impact on the business

Results of network vulnerability scanning and penetration testing

A bank has outsourced its statement printing function to an external service provider. Which of the following is the MOST critical requirement to include in the contract?

Confidentiality of customer data

Provision of internal audit reports

Notification of sub-contracting arrangements

Confidentiality of customer data

The PRIMARY objective of The board of directors periodically reviewing the risk profile is to help ensure:

the risk strategy is appropriate

performance of controls is adequate

the risk monitoring process has been established

A risk practitioner notices that a particular key risk indicator (KRI) has remained below its established trigger point for an extended period of time. Which of the following should be done FIRST?

Recommend a re-evaluation of the current threshold of the KRI.

Notify management that KRIs are being effectively managed.

Update the risk rating associated with the KRI In the risk register.

Update the risk tolerance and risk appetite to better align to the KRI.

Which of the following is the MOST important consideration when performing a risk assessment of a fire suppression system within a data center?

Onsite replacement availability

Deviation from a mitigation action plan's completion date should be determined by which of the following?

The risk owner as determined by risk management processes

Change management as determined by a change control board

Benchmarking analysis with similar completed projects

Project governance criteria as determined by the project office

The risk owner as determined by risk management processes

Which of the following is the PRIMARY reason for an organization to ensure the risk register is updated regularly?

Risk information is available to enable risk-based decisions.

Risk assessment results are accessible to senior management and stakeholders.

Risk mitigation activities are managed and coordinated.

Key risk indicators (KRIs) are evaluated to validate they are still within the risk threshold.

Risk information is available to enable risk-based decisions.

Which of the following is the MOST effective way to help ensure an organization's current risk scenarios are relevant?

Involvement of stakeholders in risk assessment

Adoption of industry best practices

Involvement of stakeholders in risk assessment

Review of risk scenarios by independent parties

Documentation of potential risk in business cases

Isaca CRISC Practice Test 5 - Free Online Exam Prep & Questions

The PRIMARY reason a risk practitioner would be interested in an internal audit report is to:

Isaca CRISC Practice Test 5

Question

Isaca CRISC Practice Tests

Practice Tests