Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 102

Question list

List of questions

Question 1011

(0)

Which of the following is the BEST approach for an organization in a heavily regulated industry to comprehensively test application functionality?

Question 1012

(0)

An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:

Question 1013

(0)

Which of the following is the PRIMARY purpose of creating and documenting control procedures?

Question 1014

(0)

Of the following, who is responsible for approval when a change in an application system is ready for release to production?

Question 1015

(0)

During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do NE

Question 1016

(0)

Which of the following findings of a security awareness program assessment would cause the GREATEST concern to a risk practitioner?

Question 1017

(0)

Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

Question 1018

(0)

When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes

Question 1019

(0)

Following an acquisition, the acquiring company's risk practitioner has been asked to update the organization's IT risk profile What is the MOST important information to review from the acquired com

Question 1020

(0)

An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to address this situat

Question 1011

Which of the following is the BEST approach for an organization in a heavily regulated industry to comprehensively test application functionality?

Use production data in a non-production environment

Use masked data in a non-production environment

Use test data in a production environment

Use anonymized data in a non-production environment

Show Answer Comment (0)

Question 1012

An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:

risk mitigation.

risk evaluation.

risk appetite.

risk tolerance.

Show Answer Comment (0)

Question 1013

Which of the following is the PRIMARY purpose of creating and documenting control procedures?

To facilitate ongoing audit and control testing

To help manage risk to acceptable tolerance levels

To establish and maintain a control inventory

To increase the likelihood of effective control operation

Show Answer Comment (0)

Question 1014

Of the following, who is responsible for approval when a change in an application system is ready for release to production?

Information security officer

IT risk manager

Business owner

Chief risk officer (CRO)

Show Answer Comment (0)

During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do NEXT?

Escalate the non-cooperation to management

Exclude applicable controls from the assessment.

Review the supplier's contractual obligations.

Request risk acceptance from the business process owner.

Show Answer Comment (0)

Question 1016

Which of the following findings of a security awareness program assessment would cause the GREATEST concern to a risk practitioner?

The program has not decreased threat counts.

The program has not considered business impact.

The program has been significantly revised

The program uses non-customized training modules.

Show Answer Comment (0)

Question 1017

Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

Accountability may not be clearly defined.

Risk ratings may be inconsistently applied.

Different risk taxonomies may be used.

Mitigation efforts may be duplicated.

Show Answer Comment (0)

Question 1018

When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes

risk exposure in business terms

a detailed view of individual risk exposures

a summary of incidents that have impacted the organization.

recommendations by an independent risk assessor.

Show Answer Comment (0)

Question 1019

Following an acquisition, the acquiring company's risk practitioner has been asked to update the organization's IT risk profile What is the MOST important information to review from the acquired company to facilitate this task?

Internal and external audit reports

Risk disclosures in financial statements

Risk assessment and risk register

Business objectives and strategies

Show Answer Comment (0)

Question 1020

An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to address this situation?

Recommend additional controls to address the risk.

Update the risk tolerance level to acceptable thresholds.

Update the incident-related risk trend in the risk register.

Recommend a root cause analysis of the incidents.

Show Answer Comment (0)

Total 1.200 questions