ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 24

Question list
Search
Search

List of questions

Search

Related questions











A risk practitioner has learned that an effort to implement a risk mitigation action plan has stalled due to lack of funding. The risk practitioner should report that the associated risk has been:

A.
mitigated
A.
mitigated
Answers
B.
accepted
B.
accepted
Answers
C.
avoided
C.
avoided
Answers
D.
deferred
D.
deferred
Answers
Suggested answer: B

Which of the following is MOST important for an organization to have in place when developing a risk management framework?

A.
A strategic approach to risk including an established risk appetite
A.
A strategic approach to risk including an established risk appetite
Answers
B.
A risk-based internal audit plan for the organization
B.
A risk-based internal audit plan for the organization
Answers
C.
A control function within the risk management team
C.
A control function within the risk management team
Answers
D.
An organization-wide risk awareness training program
D.
An organization-wide risk awareness training program
Answers
Suggested answer: A

Which of the following is MOST important for a risk practitioner to ensure once a risk action plan has been completed?

A.
The risk owner has validated outcomes.
A.
The risk owner has validated outcomes.
Answers
B.
The risk register has been updated.
B.
The risk register has been updated.
Answers
C.
The control objectives are mapped to risk objectives.
C.
The control objectives are mapped to risk objectives.
Answers
D.
The requirements have been achieved.
D.
The requirements have been achieved.
Answers
Suggested answer: B

An organization has opened a subsidiary in a foreign country. Which of the following would be the BEST way to measure the effectiveness of the subsidiary's IT systems controls?

A.
Implement IT systems in alignment with business objectives.
A.
Implement IT systems in alignment with business objectives.
Answers
B.
Review metrics and key performance indicators (KPIs).
B.
Review metrics and key performance indicators (KPIs).
Answers
C.
Review design documentation of IT systems.
C.
Review design documentation of IT systems.
Answers
D.
Evaluate compliance with legal and regulatory requirements.
D.
Evaluate compliance with legal and regulatory requirements.
Answers
Suggested answer: D

When communicating changes in the IT risk profile, which of the following should be included to BEST enable stakeholder decision making?

A.
List of recent incidents affecting industry peers
A.
List of recent incidents affecting industry peers
Answers
B.
Results of external attacks and related compensating controls
B.
Results of external attacks and related compensating controls
Answers
C.
Gaps between current and desired states of the control environment
C.
Gaps between current and desired states of the control environment
Answers
D.
Review of leading IT risk management practices within the industry
D.
Review of leading IT risk management practices within the industry
Answers
Suggested answer: C

Which of the following is the MOST important consideration when selecting either a qualitative or quantitative risk analysis?

A.
Expertise in both methodologies
A.
Expertise in both methodologies
Answers
B.
Maturity of the risk management program
B.
Maturity of the risk management program
Answers
C.
Time available for risk analysis
C.
Time available for risk analysis
Answers
D.
Resources available for data analysis
D.
Resources available for data analysis
Answers
Suggested answer: D

Which of the following would be of GREATEST concern to a risk practitioner reviewing current key risk indicators (KRIs)?

A.
The KRIs' source data lacks integrity.
A.
The KRIs' source data lacks integrity.
Answers
B.
The KRIs are not automated.
B.
The KRIs are not automated.
Answers
C.
The KRIs are not quantitative.
C.
The KRIs are not quantitative.
Answers
D.
The KRIs do not allow for trend analysis.
D.
The KRIs do not allow for trend analysis.
Answers
Suggested answer: A

Which of the following risk register elements is MOST likely to be updated if the attack surface or exposure of an asset is reduced?

A.
Likelihood rating
A.
Likelihood rating
Answers
B.
Control effectiveness
B.
Control effectiveness
Answers
C.
Assessment approach
C.
Assessment approach
Answers
D.
Impact rating
D.
Impact rating
Answers
Suggested answer: A

An organization's risk tolerance should be defined and approved by which of the following?

A.
The chief risk officer (CRO)
A.
The chief risk officer (CRO)
Answers
B.
The board of directors
B.
The board of directors
Answers
C.
The chief executive officer (CEO)
C.
The chief executive officer (CEO)
Answers
D.
The chief information officer (CIO)
D.
The chief information officer (CIO)
Answers
Suggested answer: B

It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:

A.
perform a business impact analysis.
A.
perform a business impact analysis.
Answers
B.
identify potential sources of risk.
B.
identify potential sources of risk.
Answers
C.
establish risk guidelines.
C.
establish risk guidelines.
Answers
D.
understand control design.
D.
understand control design.
Answers
Suggested answer: B
Total 1.200 questions
Go to page: of 120