Which of the following observations would be GREATEST concern to a risk practitioner reviewing the implementation status of management action plans?

Management has not secured resources for mitigation activities.

Management has not determined a final implementation date.

Management has not completed an early mitigation milestone.

Management has not secured resources for mitigation activities.

Management has not begun the implementation.

Which of the following would BEST enable mitigation of newly identified risk factors related to internet of Things (loT)?

Introducing control procedures early in the life cycle

Implementing loT device software monitoring

Performing periodic risk assessments of loT

Which of the following would be a weakness in procedures for controlling the migration of changes to production libraries?

The programming project leader solely reviews test results before approving the transfer to production.

Test and production programs are in distinct libraries.

Only operations personnel are authorized to access production libraries.

A synchronized migration of executable and source code from the test environment to the production environment is allowed.

The PRIMARY purpose of using control metrics is to evaluate the:

amount of risk reduced by compensating controls.

amount of risk present in the organization.

Risk aggregation in a complex organization will be MOST successful when:

using the same scales in assessing risk

using reliable qualitative data for risk Hems

including primarily low level risk factors

Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?

Potential business impacts are within acceptable levels

Availability of additional compensating controls

Potential business impacts are within acceptable levels

The risk associated with inadvertent disclosure of database records from a public cloud service provider (CSP) would MOST effectively be reduced by:

including a nondisclosure clause in the CSP contract

assessing the data classification scheme

reviewing CSP access privileges

The PRIMARY basis for selecting a security control is:

to achieve the desired level of maturity.

Which of the following BEST helps to balance the costs and benefits of managing IT risk?

Evaluating risk based on frequency and probability

Considering risk factors that can be quantified

Managing the risk by using controls

Which of the following should management consider when selecting a risk mitigation option?

Maturity of the enterprise architecture

Reliability of key performance indicators (KPIs)

Reliability of key risk indicators (KPIs)

Which of the following is the BEST measure of the effectiveness of an employee deprovisioning process?

Number of days taken to remove access after staff separation dates

Number of days taken for IT to remove access after receipt of HR instructions

Number of termination requests processed per reporting period

Number of days taken for HR to provide instructions to IT after staff separation dates

Which of the following is the PRIMARY reason to update a risk register with risk assessment results?

To communicate the level and priority of assessed risk to management

To provide a comprehensive inventory of risk across the organization

To assign a risk owner to manage the risk

To enable the creation of action plans to address nsk

The PRIMARY reason for establishing various Threshold levels for a set of key risk indicators (KRIs) is to:

ensure accurate and reliable monitoring.

highlight trends of developing risk.

ensure accurate and reliable monitoring.

take appropriate actions in a timely manner.

set different triggers for each stakeholder.

The risk associated with data loss from a website which contains sensitive customer information is BEST owned by:

the third-party website manager

The MOST significant benefit of using a consistent risk ranking methodology across an organization is that it enables:

clear understanding of risk levels

allocation of available resources

clear understanding of risk levels

assignment of risk to the appropriate owners

risk to be expressed in quantifiable terms

Which of the following presents the GREATEST challenge for an IT risk practitioner who wants to report on trends in historical IT risk levels?

Qualitative measures for potential loss events

Changes in owners for identified IT risk scenarios

Changes in methods used to calculate probability

Frequent use of risk acceptance as a treatment option

What should a risk practitioner do FIRST upon learning a risk treatment owner has implemented a different control than what was specified in the IT risk action plan?

Reassess the risk level associated with the new control.

Seek approval from the control owner.

Update the action plan in the risk register.

Reassess the risk level associated with the new control.

Validate that the control has an established testing method.

The maturity of an IT risk management program is MOST influenced by:

the organization's risk culture

benchmarking results against similar organizations

industry-specific regulatory requirements

expertise available within the IT department

Which of the following is the BEST approach for performing a business impact analysis (BIA) of a supply-chain management application?

Interviewing groups of key stakeholders

Reviewing the organization's policies and procedures

Interviewing groups of key stakeholders

Circulating questionnaires to key internal stakeholders

Accepting IT personnel s view of business issues

Which of the following will provide the BEST measure of compliance with IT policies?

Evaluate past policy review reports.

Conduct regular independent reviews.

Test staff on their compliance responsibilities.

Which of the following is a KEY outcome of risk ownership?

Risk responsibilities are addressed.

Risk-related information is communicated.

Risk-oriented tasks are defined.

Business process risk is analyzed.

Which of the following is MOST important for an organization to have in place when developing a risk management framework?

A strategic approach to risk including an established risk appetite

A risk-based internal audit plan for the organization

A control function within the risk management team

An organization-wide risk awareness training program

Which of the following is MOST important for a risk practitioner to ensure once a risk action plan has been completed?

The risk register has been updated.

The risk owner has validated outcomes.

The risk register has been updated.

The control objectives are mapped to risk objectives.

The requirements have been achieved.

An organization has opened a subsidiary in a foreign country. Which of the following would be the BEST way to measure the effectiveness of the subsidiary's IT systems controls?

Evaluate compliance with legal and regulatory requirements.

Implement IT systems in alignment with business objectives.

Review metrics and key performance indicators (KPIs).

Review design documentation of IT systems.

Evaluate compliance with legal and regulatory requirements.

When communicating changes in the IT risk profile, which of the following should be included to BEST enable stakeholder decision making?

Gaps between current and desired states of the control environment

List of recent incidents affecting industry peers

Results of external attacks and related compensating controls

Gaps between current and desired states of the control environment

Review of leading IT risk management practices within the industry

Which of the following is the MOST important consideration when selecting either a qualitative or quantitative risk analysis?

Resources available for data analysis

Expertise in both methodologies

Maturity of the risk management program

Time available for risk analysis

Resources available for data analysis

Which of the following would be of GREATEST concern to a risk practitioner reviewing current key risk indicators (KRIs)?

The KRIs' source data lacks integrity.

The KRIs do not allow for trend analysis.

An organization's risk tolerance should be defined and approved by which of the following?

The chief executive officer (CEO)

The chief information officer (CIO)

It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:

identify potential sources of risk.

perform a business impact analysis.

identify potential sources of risk.

Isaca CRISC Practice Test 6 - Free Online Exam Prep & Questions

When updating a risk register with the results of an IT risk assessment, the risk practitioner should log:

high impact scenarios.

high likelihood scenarios.

treated risk scenarios.

known risk scenarios.

Comment (0)

Isaca CRISC Practice Test 6

Question

Isaca CRISC Practice Tests

Practice Tests