Which of the following should be included in a risk assessment report to BEST facilitate senior management's understanding of the results?

A risk heat map with a summary of risk identified and assessed

Benchmarking parameters likely to affect the results

Tools and techniques used by risk owners to perform the assessments

A risk heat map with a summary of risk identified and assessed

The possible impact of internal and external risk factors on the assessment results

The MOST important reason to aggregate results from multiple risk assessments on interdependent information systems is to:

establish overall impact to the organization

efficiently manage the scope of the assignment

identify critical information systems

facilitate communication to senior management

During a risk assessment, the risk practitioner finds a new risk scenario without controls has been entered into the risk register. Which of the following is the MOST appropriate action?

Include the new risk scenario in the current risk assessment.

Postpone the risk assessment until controls are identified.

Request the risk scenario be removed from the register.

Exclude the new risk scenario from the current risk assessment

Which of the following should be initiated when a high number of noncompliant conditions are observed during review of a control procedure?

A review of the awareness program

Which of the following is the BEST indicator of the effectiveness of a control monitoring program?

Time between control failure and failure detection

Number of key controls as a percentage of total control count

Time spent on internal control assessment reviews

Number of internal control failures within the measurement period

Which of the following provides The MOST useful information when determining a risk management program's maturity level?

A recently reviewed risk register

Key performance indicators (KPIs)

Which of the following is a KEY responsibility of the second line of defense?

Monitoring control effectiveness

Implementing control activities

Monitoring control effectiveness

Conducting control self-assessments

A risk practitioner learns that the organization s industry is experiencing a trend of rising security incidents. Which of the following is the BEST course of action?

Evaluate the relevance of the evolving threats.

Review past internal audit results.

Respond to organizational security threats.

Research industry published studies.

A new regulator/ requirement imposes severe fines for data leakage involving customers' personally identifiable information (Pll). The risk practitioner has recommended avoiding the risk. Which of the following actions would BEST align with this recommendation?

Modify business processes to stop collecting Pll.

Reduce retention periods for Pll data.

Move Pll to a highly-secured outsourced site.

Modify business processes to stop collecting Pll.

Implement strong encryption for Pll.

Which of the following would be MOST helpful to a risk owner when making risk-aware decisions?

Risk exposure expressed in business terms

Recommendations for risk response options

Resource requirements for risk responses

List of business areas affected by the risk

Which of the following is MOST important to enable well-informed cybersecurity risk decisions?

Determine and understand the risk rating of scenarios.

Conduct risk assessment peer reviews.

Identify roles and responsibilities for security controls.

Engage a third party to perform a risk assessment.

An organization with a large number of applications wants to establish a security risk assessment program. Which of the following would provide the MOST useful information when determining the frequency of risk assessments?

Prioritization from business owners

Results of a benchmark analysis

Recommendations from internal audit

Prioritization from business owners

When assessing the maturity level of an organization's risk management framework, which of the following deficiencies should be of GREATEST concern to a risk practitioner?

Use of highly customized control frameworks

Unclear organizational risk appetite

Lack of senior management participation

Use of highly customized control frameworks

Reliance on qualitative analysis methods

A newly enacted information privacy law significantly increases financial penalties for breaches of personally identifiable information (Pll). Which of the following will MOST likely outcome for an organization affected by the new law?

Increase in compliance breaches

Increase in customer complaints

The BEST criteria when selecting a risk response is the:

effectiveness of risk response options

capability to implement the response

importance of IT risk within the enterprise

effectiveness of risk response options

alignment of response to industry standards

A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The contingency plan provides for backup media to be taken to the alternative site.

The alternative site is a hot site with equipment ready to resume processing immediately.

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site does not reside on the same fault to matter how the distance apart.

Which of the following is the GREATEST concern when an organization uses a managed security service provider as a firewall administrator?

Increased number of firewall rules

The FIRST task when developing a business continuity plan should be to:

identify critical business functions and resources.

determine data backup and recovery availability at an alternate site.

identify critical business functions and resources.

define roles and responsibilities for implementation.

identify recovery time objectives (RTOs) for critical business applications.

The MAIN goal of the risk analysis process is to determine the:

frequency and magnitude of loss

A risk practitioner is reviewing the status of an action plan to mitigate an emerging IT risk and finds the risk level has increased. The BEST course of action would be to:

evaluate whether selected controls are still appropriate.

implement the planned controls and accept the remaining risk.

suspend the current action plan in order to reassess the risk.

revise the action plan to include additional mitigating controls.

evaluate whether selected controls are still appropriate.

Which of the following is the MOST important consideration when identifying stakeholders to review risk scenarios developed by a risk analyst? The reviewers are:

independent from the business operations.

accountable for the affected processes.

authorized to select risk mitigation options.

independent from the business operations.

An upward trend in which of the following metrics should be of MOST concern?

Number of security policy exceptions approved

Number of business change management requests

Number of revisions to security policy

Number of security policy exceptions approved

Number of changes to firewall rules

During a control review, the control owner states that an existing control has deteriorated over time. What is the BEST recommendation to the control owner?

Implement compensating controls to reduce residual risk

Escalate the issue to senior management

Discuss risk mitigation options with the risk owner.

Certify the control after documenting the concern.

The MOST effective approach to prioritize risk scenarios is by:

assessing impact to the strategic plan.

aligning with industry best practices.

soliciting input from risk management experts.

evaluating the cost of risk response.

The BEST way to test the operational effectiveness of a data backup procedure is to:

demonstrate a successful recovery from backup files.

conduct an audit of files stored offsite.

interview employees to compare actual with expected procedures.

inspect a selection of audit trails and backup logs.

demonstrate a successful recovery from backup files.

Which of the following would prompt changes in key risk indicator {KRI) thresholds?

Changes in risk appetite or tolerance

Modification to risk categories

Knowledge of new and emerging threats

Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST

review the key risk indicators.

reallocate risk response resources.

Which of the following BEST measures the efficiency of an incident response process?

Average gap between actual and agreed response times

Number of incidents escalated to management

Average time between changes and updating of escalation matrix

Average gap between actual and agreed response times

Number of incidents lacking responses

Isaca CRISC Practice Test 7 - Free Online Exam Prep & Questions

Which of the following is the MOST important input when developing risk scenarios?

Key performance indicators

Business objectives

The organization's risk framework

Risk appetite

Comment (0)

Isaca CRISC Practice Test 7

Question

Isaca CRISC Practice Tests

Practice Tests