ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 117

Question list
Search
Search

List of questions

Search

Related questions











Which of the following is MOST important to determine as a result of a risk assessment?

A.
Process ownership
A.
Process ownership
Answers
B.
Risk appetite statement
B.
Risk appetite statement
Answers
C.
Risk tolerance levels
C.
Risk tolerance levels
Answers
D.
Risk response options
D.
Risk response options
Answers
Suggested answer: D

Which of the following is the GREATEST benefit of using IT risk scenarios?

A.
They support compliance with regulations.
A.
They support compliance with regulations.
Answers
B.
They provide evidence of risk assessment.
B.
They provide evidence of risk assessment.
Answers
C.
They facilitate communication of risk.
C.
They facilitate communication of risk.
Answers
D.
They enable the use of key risk indicators (KRls)
D.
They enable the use of key risk indicators (KRls)
Answers
Suggested answer: C

When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?

A.
Before defining a framework
A.
Before defining a framework
Answers
B.
During the risk assessment
B.
During the risk assessment
Answers
C.
When evaluating risk response
C.
When evaluating risk response
Answers
D.
When updating the risk register
D.
When updating the risk register
Answers
Suggested answer: B

After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to

A.
recommend a program that minimizes the concerns of that production system.
A.
recommend a program that minimizes the concerns of that production system.
Answers
B.
inform the process owner of the concerns and propose measures to reduce them.
B.
inform the process owner of the concerns and propose measures to reduce them.
Answers
C.
inform the IT manager of the concerns and propose measures to reduce them.
C.
inform the IT manager of the concerns and propose measures to reduce them.
Answers
D.
inform the development team of the concerns and together formulate risk reduction measures.
D.
inform the development team of the concerns and together formulate risk reduction measures.
Answers
Suggested answer: B

Which of the following is the PRIMARY objective of risk management?

A.
Identify and analyze risk.
A.
Identify and analyze risk.
Answers
B.
Achieve business objectives
B.
Achieve business objectives
Answers
C.
Minimi2e business disruptions.
C.
Minimi2e business disruptions.
Answers
D.
Identify threats and vulnerabilities.
D.
Identify threats and vulnerabilities.
Answers
Suggested answer: B

An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of risk is MOST likely to materialize?

A.
Confidentiality breach
A.
Confidentiality breach
Answers
B.
Institutional knowledge loss
B.
Institutional knowledge loss
Answers
C.
Intellectual property loss
C.
Intellectual property loss
Answers
D.
Unauthorized access
D.
Unauthorized access
Answers
Suggested answer: B

One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner's BEST recommendation?

A.
Additional mitigating controls should be identified.
A.
Additional mitigating controls should be identified.
Answers
B.
The system should not be used until the application is changed
B.
The system should not be used until the application is changed
Answers
C.
The organization's IT risk appetite should be adjusted.
C.
The organization's IT risk appetite should be adjusted.
Answers
D.
The associated IT risk should be accepted by management.
D.
The associated IT risk should be accepted by management.
Answers
Suggested answer: A

An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?

A.
Initiate a retest of the full control
A.
Initiate a retest of the full control
Answers
B.
Retest the control using the new application as the only sample.
B.
Retest the control using the new application as the only sample.
Answers
C.
Review the corresponding change control documentation
C.
Review the corresponding change control documentation
Answers
D.
Re-evaluate the control during (he next assessment
D.
Re-evaluate the control during (he next assessment
Answers
Suggested answer: A

Which of the following would present the GREATEST challenge for a risk practitioner during a merger of two organizations?

A.
Variances between organizational risk appetites
A.
Variances between organizational risk appetites
Answers
B.
Different taxonomies to categorize risk scenarios
B.
Different taxonomies to categorize risk scenarios
Answers
C.
Disparate platforms for governance, risk, and compliance (GRC) systems
C.
Disparate platforms for governance, risk, and compliance (GRC) systems
Answers
D.
Dissimilar organizational risk acceptance protocols
D.
Dissimilar organizational risk acceptance protocols
Answers
Suggested answer: A

An organization has introduced risk ownership to establish clear accountability for each process. To ensure effective risk ownership, it is MOST important that:

A.
senior management has oversight of the process.
A.
senior management has oversight of the process.
Answers
B.
process ownership aligns with IT system ownership.
B.
process ownership aligns with IT system ownership.
Answers
C.
segregation of duties exists between risk and process owners.
C.
segregation of duties exists between risk and process owners.
Answers
D.
risk owners have decision-making authority.
D.
risk owners have decision-making authority.
Answers
Suggested answer: A
Total 1.200 questions
Go to page: of 120