A key risk indicator (KRI) indicates a reduction in the percentage of appropriately patched servers. Which of the following is the risk practitioner's BEST course of action?

Review the patch management process.

Determine changes in the risk level.

Outsource the vulnerability management process.

Review the patch management process.

Add agenda item to the next risk committee meeting.

Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?

Continuous monitoring and alerting

Access controls and active logging

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti-virus program?

Number of false positives detected over a period of time

Frequency of anti-virus software updates

Number of alerts generated by the anti-virus software

Number of false positives detected over a period of time

Percentage of IT assets with current malware definitions

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?

Determine the root cause of the control failures.

Recommend risk remediation of the ineffective controls.

Compare the residual risk to the current risk appetite.

Determine the root cause of the control failures.

Escalate the control failures to senior management.

When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

Risk action plans and associated owners

Recent audit and self-assessment results

Potential losses compared to treatment cost

A list of assets exposed to the highest risk

A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls. The BEST course of action would be to:

develop an improved password software routine.

obtain management approval for policy exception.

develop an improved password software routine.

select another application with strong password controls.

continue the implementation with no changes.

Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

Observe the control enhancements in operation.

Inspect external audit documentation.

Review management's detailed action plans.

Who is accountable for risk treatment?

Enterprise risk management team

Which of the following will BEST help an organization evaluate the control environment of several third-party vendors?

Obtain independent control reports from high-risk vendors.

Review vendors' internal risk assessments covering key risk and controls.

Obtain independent control reports from high-risk vendors.

Review vendors performance metrics on quality and delivery of processes.

Obtain vendor references from third parties.

When prioritizing risk response, management should FIRST:

address high risk factors that have efficient and effective solutions.

evaluate the organization s ability and expertise to implement the solution.

evaluate the risk response of similar organizations.

address high risk factors that have efficient and effective solutions.

determine which risk factors have high remediation costs

An audit reveals that there are changes in the environment that are not reflected in the risk profile. Which of the following is the BEST course of action?

Review the risk identification process.

Inform the risk scenario owners.

Create a risk awareness communication plan.

Which of the following is the MAIN reason for analyzing risk scenarios?

Identifying additional risk scenarios

An organization has granted a vendor access to its data in order to analyze customer behavior. Which of the following would be the MOST effective control to mitigate the risk of customer data leakage?

Restrict access to customer data on a 'need to know'' basis.

Enforce criminal background checks.

Require vendor to sign a confidentiality agreement.

Restrict access to customer data on a 'need to know'' basis.

The MAIN purpose of having a documented risk profile is to:

enable well-informed decision making.

comply with external and internal requirements.

enable well-informed decision making.

prioritize investment projects.

keep the risk register up-to-date.

Which of the following is the GREATEST concern when using a generic set of IT risk scenarios for risk analysis?

Risk factors might not be relevant to the organization

Quantitative analysis might not be possible.

Risk factors might not be relevant to the organization

Implementation costs might increase.

Inherent risk might not be considered.

Which of the following activities should be performed FIRST when establishing IT risk management processes?

Assess the goals and culture of the organization.

Collect data of past incidents and lessons learned.

Conduct a high-level risk assessment based on the nature of business.

Identify the risk appetite of the organization.

Assess the goals and culture of the organization.

An organization has introduced risk ownership to establish clear accountability for each process. To ensure effective risk ownership, it is MOST important that:

senior management has oversight of the process.

process ownership aligns with IT system ownership.

segregation of duties exists between risk and process owners.

risk owners have decision-making authority.

After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:

validate the risk scenarios for business applicability.

record risk scenarios in the risk register for analysis.

validate the risk scenarios for business applicability.

reduce the number of risk scenarios to a manageable set.

perform a risk analysis on the risk scenarios.

The PRIMARY goal of a risk management program is to:

help prevent operational losses.

facilitate resource availability.

help ensure objectives are met.

help prevent operational losses.

Which of the following is the BEST way to determine software license compliance?

Conduct periodic compliance reviews.

List non-compliant systems in the risk register.

Conduct periodic compliance reviews.

Review whistlebtower reports of noncompliance.

Monitor user software download activity.

Which of the following indicates an organization follows IT risk management best practice?

The risk register template uses an industry standard.

The risk register is regularly updated.

All fields in the risk register have been completed.

Controls are listed against risk entries in the register.

Which of the following should be the MAIN consideration when validating an organization's risk appetite?

Cost of risk mitigation options

Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?

Defining expectations in the enterprise risk policy

Increasing organizational resources to mitigate risks

Communicating external audit results

Avoiding risks that could materialize into substantial losses

A software developer has administrative access to a production application. Which of the following should be of GREATEST concern to a risk practitioner?

The administrative access represents a segregation of duties conflict.

The administrative access does not allow for activity log monitoring.

The administrative access does not follow password management protocols.

The administrative access represents a deviation from corporate policy.

The administrative access represents a segregation of duties conflict.

The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of:

new vulnerabilities identified.

Which of the following should a risk practitioner do FIRST when an organization decides to use a cloud service?

Check the contract for appropriate security risk and control provisions.

Review the vendor selection process and vetting criteria.

Assess whether use of service falls within risk tolerance thresholds.

Establish service level agreements (SLAs) with the vendor.

Check the contract for appropriate security risk and control provisions.

Which of the following would BEST help secure online financial transactions from improper users?

Periodic review of audit trails

The purpose of requiring source code escrow in a contractual agreement is to:

ensure that the source code is available if the vendor ceases to exist.

ensure that the source code is valid and exists.

ensure that the source code is available if the vendor ceases to exist.

review the source code for adequacy of controls.

ensure the source code is available when bugs occur.

Which of the following is the BEST indication of the effectiveness of a business continuity program?

Business continuity tests are performed successfully and issues are addressed.

Business impact analyses are reviewed and updated in a timely manner.

Business continuity and disaster recovery plans are regularly updated.

Business units are familiar with the business continuity plans and process.

When reviewing a risk response strategy, senior management's PRIMARY focus should be placed on the:

key performance indicators (KPIs).

Which of the following is MOST important for an organization that wants to reduce IT operational risk?

Minimizing complexity of IT infrastructure

Increasing senior management's understanding of IT operations

Increasing the frequency of data backups

Minimizing complexity of IT infrastructure

Decentralizing IT infrastructure

Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?

Enhance the security awareness program.

Increase the frequency of incident reporting.

Purchase cyber insurance from a third party.

Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?

Cost versus benefit of additional mitigating controls

Annualized loss expectancy (ALE) for the system

Cost of the Information control system

Isaca CRISC Practice Test 9 - Free Online Exam Prep & Questions

Which of the following would BEST help identify the owner for each risk scenario in a risk register?

Become a Premium Member for full access

Unlock Premium Member

Isaca CRISC Practice Test 9

Question

Isaca CRISC Practice Tests

Practice Tests