ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 23

Question list
Search
Search

Related questions











An organization has decided to implement an emerging technology and incorporate the new capabilities into its strategic business plan. Business operations for the technology will be outsourced. What will be the risk practitioner's PRIMARY role during the change?

A.
Managing third-party risk
A.
Managing third-party risk
Answers
B.
Developing risk scenarios
B.
Developing risk scenarios
Answers
C.
Managing the threat landscape
C.
Managing the threat landscape
Answers
D.
Updating risk appetite
D.
Updating risk appetite
Answers
Suggested answer: B

Who is PRIMARILY accountable for risk treatment decisions?

A.
Risk owner
A.
Risk owner
Answers
B.
Business manager
B.
Business manager
Answers
C.
Data owner
C.
Data owner
Answers
D.
Risk manager
D.
Risk manager
Answers
Suggested answer: A

Which of the following presents the GREATEST challenge for an IT risk practitioner who wants to report on trends in historical IT risk levels?

A.
Qualitative measures for potential loss events
A.
Qualitative measures for potential loss events
Answers
B.
Changes in owners for identified IT risk scenarios
B.
Changes in owners for identified IT risk scenarios
Answers
C.
Changes in methods used to calculate probability
C.
Changes in methods used to calculate probability
Answers
D.
Frequent use of risk acceptance as a treatment option
D.
Frequent use of risk acceptance as a treatment option
Answers
Suggested answer: A

When presenting risk, the BEST method to ensure that the risk is measurable against the organization's risk appetite is through the use of a:

A.
risk map
A.
risk map
Answers
B.
cause-and-effect diagram
B.
cause-and-effect diagram
Answers
C.
maturity model
C.
maturity model
Answers
D.
technology strategy plan.
D.
technology strategy plan.
Answers
Suggested answer: C

What should a risk practitioner do FIRST upon learning a risk treatment owner has implemented a different control than what was specified in the IT risk action plan?

A.
Seek approval from the control owner.
A.
Seek approval from the control owner.
Answers
B.
Update the action plan in the risk register.
B.
Update the action plan in the risk register.
Answers
C.
Reassess the risk level associated with the new control.
C.
Reassess the risk level associated with the new control.
Answers
D.
Validate that the control has an established testing method.
D.
Validate that the control has an established testing method.
Answers
Suggested answer: C

The maturity of an IT risk management program is MOST influenced by:

A.
the organization's risk culture
A.
the organization's risk culture
Answers
B.
benchmarking results against similar organizations
B.
benchmarking results against similar organizations
Answers
C.
industry-specific regulatory requirements
C.
industry-specific regulatory requirements
Answers
D.
expertise available within the IT department
D.
expertise available within the IT department
Answers
Suggested answer: A

Which of the following is the BEST approach for performing a business impact analysis (BIA) of a supply-chain management application?

A.
Reviewing the organization's policies and procedures
A.
Reviewing the organization's policies and procedures
Answers
B.
Interviewing groups of key stakeholders
B.
Interviewing groups of key stakeholders
Answers
C.
Circulating questionnaires to key internal stakeholders
C.
Circulating questionnaires to key internal stakeholders
Answers
D.
Accepting IT personnel s view of business issues
D.
Accepting IT personnel s view of business issues
Answers
Suggested answer: B

Which of the following will provide the BEST measure of compliance with IT policies?

A.
Evaluate past policy review reports.
A.
Evaluate past policy review reports.
Answers
B.
Conduct regular independent reviews.
B.
Conduct regular independent reviews.
Answers
C.
Perform penetration testing.
C.
Perform penetration testing.
Answers
D.
Test staff on their compliance responsibilities.
D.
Test staff on their compliance responsibilities.
Answers
Suggested answer: C

From a risk management perspective, which of the following is the PRIMARY benefit of using automated system configuration validation tools?

A.
Residual risk is reduced.
A.
Residual risk is reduced.
Answers
B.
Staff costs are reduced.
B.
Staff costs are reduced.
Answers
C.
Operational costs are reduced.
C.
Operational costs are reduced.
Answers
D.
Inherent risk is reduced.
D.
Inherent risk is reduced.
Answers
Suggested answer: C

Which of the following is a KEY outcome of risk ownership?

A.
Risk responsibilities are addressed.
A.
Risk responsibilities are addressed.
Answers
B.
Risk-related information is communicated.
B.
Risk-related information is communicated.
Answers
C.
Risk-oriented tasks are defined.
C.
Risk-oriented tasks are defined.
Answers
D.
Business process risk is analyzed.
D.
Business process risk is analyzed.
Answers
Suggested answer: A
Total 1.200 questions
Go to page: of 120