Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 33

Question list

List of questions

Question 321

(0)

Which of the following would BEST help identify the owner for each risk scenario in a risk register?

Question 322

(0)

A key risk indicator (KRI) indicates a reduction in the percentage of appropriately patched servers. Which of the following is the risk practitioner's BEST course of action?

Question 323

(0)

Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?

Question 324

(0)

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti-virus program?

Question 325

(0)

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?

Question 326

(0)

Performing a background check on a new employee candidate before hiring is an example of what type of control?

Question 327

(0)

When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

Question 328

(0)

A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls. The BEST course of action would be to:

Question 329

(0)

Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

Question 330

(0)

Who is accountable for risk treatment?

Question 321

Which of the following would BEST help identify the owner for each risk scenario in a risk register?

Determining which departments contribute most to risk

Allocating responsibility for risk factors equally to asset owners

Mapping identified risk factors to specific business processes

Determining resource dependency of assets

Show Answer Comment (0)

Question 322

A key risk indicator (KRI) indicates a reduction in the percentage of appropriately patched servers. Which of the following is the risk practitioner's BEST course of action?

Determine changes in the risk level.

Outsource the vulnerability management process.

Review the patch management process.

Add agenda item to the next risk committee meeting.

Show Answer Comment (0)

Question 323

Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?

Vulnerability scanning

Continuous monitoring and alerting

Configuration management

Access controls and active logging

Show Answer Comment (0)

Question 324

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti-virus program?

Frequency of anti-virus software updates

Number of alerts generated by the anti-virus software

Number of false positives detected over a period of time

Percentage of IT assets with current malware definitions

Show Answer Comment (0)

Question 325

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?

Recommend risk remediation of the ineffective controls.

Compare the residual risk to the current risk appetite.

Determine the root cause of the control failures.

Escalate the control failures to senior management.

Show Answer Comment (0)

Question 326

Performing a background check on a new employee candidate before hiring is an example of what type of control?

Detective

Compensating

Corrective

Preventive

Show Answer Comment (0)

Question 327

When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

Risk action plans and associated owners

Recent audit and self-assessment results

Potential losses compared to treatment cost

A list of assets exposed to the highest risk

Show Answer Comment (0)

Question 328

A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls. The BEST course of action would be to:

obtain management approval for policy exception.

develop an improved password software routine.

select another application with strong password controls.

continue the implementation with no changes.

Show Answer Comment (0)

Question 329

Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

Interview control owners.

Observe the control enhancements in operation.

Inspect external audit documentation.

Review management's detailed action plans.

Show Answer Comment (0)