A risk practitioner recently discovered that sensitive data from the production environment is required for testing purposes in non-production environments. Which of the following i the BEST recommendation to address this situation?

Implement equivalent security in the test environment.

Enable data encryption in the test environment

Implement equivalent security in the test environment.

Prevent the use of production data for test purposes

Mask data before being transferred to the test environment.

IT stakeholders have asked a risk practitioner for IT risk profile reports associated with specific departments to allocate resources for risk mitigation. The BEST way to address this request would be to use:

information from the risk register.

the cost associated with each control.

information from the risk register.

Which of the following is the MAIN benefit of involving stakeholders in the selection of key risk indicators (KRIs)?

Obtaining buy-in from risk owners

Optimizing risk treatment decisions

Which of the following BEST indicates effective information security incident management?

Frequency of information security incident response plan testing

Monthly trend of information security-related incidents

Average time to identify critical information security incidents

Frequency of information security incident response plan testing

Percentage of high risk security incidents

Whose risk tolerance matters MOST when making a risk decision?

The business process owner of the exposed assets

Customers who would be affected by a breach

Auditors, regulators and standards organizations

The business process owner of the exposed assets

The information security manager

After identifying new risk events during a project, the project manager s NEXT step should be to:

record the scenarios into the risk register.

determine if the scenarios need 10 be accepted or responded to.

record the scenarios into the risk register.

continue with a qualitative risk analysis.

continue with a quantitative risk analysis.

Which of the following is the BEST way to identify changes in the risk profile of an organization?

Monitor key risk indicators (KRIs).

Monitor key performance indicators (KPIs).

Which of the following statements BEST describes risk appetite?

The amount of risk an organization is willing to accept

The effective management of risk and internal control environments

Acceptable variation between risk thresholds and business objectives

The acceptable variation relative to the achievement of objectives

What can be determined from the risk scenario chart?

Relative positions on the risk map

Capability of enterprise to implement

The multiple risk factors addressed by a chosen response

As part of an overall IT risk management plan, an IT risk register BEST helps management:

understand the organizational risk profile.

align IT processes with business objectives.

communicate the enterprise risk management policy.

stay current with existing control status.

understand the organizational risk profile.

To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:

vulnerability assessment results

Which of the following key risk indicators (KRIs) is MOST effective for monitoring risk related to a bring your own device (BYOD) program?

Number of devices enrolled in the BYOD program

Number of users who have signed a BYOD acceptable use policy

Number of incidents originating from BYOD devices

Budget allocated to the BYOD program security controls

Number of devices enrolled in the BYOD program

Which of the following is the BEST course of action when risk is found to be above the acceptable risk appetite?

Analyze the effectiveness of controls.

Which of the following is MOST critical to the design of relevant risk scenarios?

The scenarios are linked to probable organizational situations.

The scenarios are based on past incidents.

The scenarios are linked to probable organizational situations.

The scenarios are mapped to incident management capabilities.

The scenarios are aligned with risk management capabilities.

Which of the following BEST indicates that an organizations risk management program is effective?

Fewer security incidents have been reported.

The number of audit findings has decreased.

What is the GREATEST concern with maintaining decentralized risk registers instead of a consolidated risk register?

Standardization of risk management practices may be difficult to enforce.

Aggregated risk may exceed the enterprise's risk appetite and tolerance.

Duplicate resources may be used to manage risk registers.

Standardization of risk management practices may be difficult to enforce.

Risk analysis may be inconsistent due to non-uniform impact and likelihood scales.

Which of the following is the PRIMARY role of the board of directors in corporate risk governance?

Ensuring the effectiveness of the risk management program

Approving operational strategies and objectives

Monitoring the results of actions taken to mitigate risk

Ensuring the effectiveness of the risk management program

Ensuring risk scenarios are identified and recorded in the risk register

Which of the following BEST contributes to the implementation of an effective risk response action plan?

Assigned roles and responsibilities

Disaster recovery and continuity testing

Assigned roles and responsibilities

Which of the following would be the BEST justification to invest in the development of a governance, risk, and compliance (GRC) solution?

Facilitating risk-aware decision making by stakeholders

Demonstrating management commitment to mitigate risk

Closing audit findings on a timely basis

Ensuring compliance to industry standards

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability management process?

Percentage of vulnerabilities remediated within the agreed service level

Number of vulnerabilities identified during the period

Number of vulnerabilities re-opened during the period

Percentage of vulnerabilities escalated to senior management

An IT license audit has revealed that there are several unlicensed copies of co be to:

centralize administration rights on laptops so that installations are controlled

immediately uninstall the unlicensed software from the laptops

centralize administration rights on laptops so that installations are controlled

report the issue to management so appropriate action can be taken.

procure the requisite licenses for the software to minimize business impact.

Which of the following conditions presents the GREATEST risk to an application?

Developers have access to production environment.

Application controls are manual.

Application development is outsourced.

Developers have access to production environment.

The annualized loss expectancy (ALE) method of risk analysis:

can be used m a cost-benefit analysts

helps in calculating the expected cost of controls

uses qualitative risk rankings such as low. medium and high.

can be used m a cost-benefit analysts

can be used to determine the indirect business impact.

During an IT department reorganization, the manager of a risk mitigation action plan was replaced. The new manager has begun implementing a new control after identifying a more effective option. Which of the following is the risk practitioner's BEST course of action?

Communicate the decision to the risk owner for approval

Seek approval from the previous action plan manager.

Identify an owner for the new control.

Modify the action plan in the risk register.

The GREATEST concern when maintaining a risk register is that:

significant changes in risk factors are excluded.

impacts are recorded in qualitative terms.

executive management does not perform periodic reviews.

IT risk is not linked with IT assets.

significant changes in risk factors are excluded.

Which of the following is the BEST way to support communication of emerging risk?

Include it in the risk register for ongoing monitoring.

Update residual risk levels to reflect the expected risk impact.

Adjust inherent risk levels upward.

Include it on the next enterprise risk committee agenda.

Include it in the risk register for ongoing monitoring.

Which of the following is the BEST indication that an organization's risk management program has not reached the desired maturity level?

Large fluctuations in risk ratings between assessments

Significant increases in risk mitigation budgets

Large fluctuations in risk ratings between assessments

A steady increase in the time to recover from incidents

A large number of control exceptions

An IT organization is replacing the customer relationship management (CRM) system. Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?

Chief information security officer

Isaca CRISC Practice Test 8 - Free Online Exam Prep & Questions

Quantifying the value of a single asset helps the organization to understand the:

overall effectiveness of risk management

consequences of risk materializing

necessity of developing a risk strategy,

organization s risk threshold.

Comment (0)

Isaca CRISC Practice Test 8

Question

Isaca CRISC Practice Tests

Practice Tests