ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 57

Question list
Search
Search

Related questions











Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?

A.
Segregation of duties
A.
Segregation of duties
Answers
B.
Three lines of defense
B.
Three lines of defense
Answers
C.
Compliance review
C.
Compliance review
Answers
D.
Quality assurance review
D.
Quality assurance review
Answers
Suggested answer: B

Which of the following provides the MOST up-to-date information about the effectiveness of an organization's overall IT control environment?

A.
Key performance indicators (KPIs)
A.
Key performance indicators (KPIs)
Answers
B.
Risk heat maps
B.
Risk heat maps
Answers
C.
Internal audit findings
C.
Internal audit findings
Answers
D.
Periodic penetration testing
D.
Periodic penetration testing
Answers
Suggested answer: A

An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses. What should be done NEXT in response to this report?

A.
Migrate all data to another compliant service provider.
A.
Migrate all data to another compliant service provider.
Answers
B.
Analyze the impact of the provider's control weaknesses to the business.
B.
Analyze the impact of the provider's control weaknesses to the business.
Answers
C.
Conduct a follow-up audit to verify the provider's control weaknesses.
C.
Conduct a follow-up audit to verify the provider's control weaknesses.
Answers
D.
Review the contract to determine if penalties should be levied against the provider.
D.
Review the contract to determine if penalties should be levied against the provider.
Answers
Suggested answer: B

A global organization is planning to collect customer behavior data through social media advertising. Which of the following is the MOST important business risk to be considered?

A.
Regulatory requirements may differ in each country.
A.
Regulatory requirements may differ in each country.
Answers
B.
Data sampling may be impacted by various industry restrictions.
B.
Data sampling may be impacted by various industry restrictions.
Answers
C.
Business advertising will need to be tailored by country.
C.
Business advertising will need to be tailored by country.
Answers
D.
The data analysis may be ineffective in achieving objectives.
D.
The data analysis may be ineffective in achieving objectives.
Answers
Suggested answer: A

Which of the following is the MOST important component in a risk treatment plan?

A.
Technical details
A.
Technical details
Answers
B.
Target completion date
B.
Target completion date
Answers
C.
Treatment plan ownership
C.
Treatment plan ownership
Answers
D.
Treatment plan justification
D.
Treatment plan justification
Answers
Suggested answer: D

When evaluating enterprise IT risk management it is MOST important to:

A.
create new control processes to reduce identified IT risk scenarios
A.
create new control processes to reduce identified IT risk scenarios
Answers
B.
confirm the organization's risk appetite and tolerance
B.
confirm the organization's risk appetite and tolerance
Answers
C.
report identified IT risk scenarios to senior management
C.
report identified IT risk scenarios to senior management
Answers
D.
review alignment with the organization's investment plan
D.
review alignment with the organization's investment plan
Answers
Suggested answer: B

The MAIN reason for creating and maintaining a risk register is to:

A.
assess effectiveness of different projects.
A.
assess effectiveness of different projects.
Answers
B.
define the risk assessment methodology.
B.
define the risk assessment methodology.
Answers
C.
ensure assets have low residual risk.
C.
ensure assets have low residual risk.
Answers
D.
account for identified key risk factors.
D.
account for identified key risk factors.
Answers
Suggested answer: D

Which of the following is MOST important to the successful development of IT risk scenarios?

A.
Cost-benefit analysis
A.
Cost-benefit analysis
Answers
B.
Internal and external audit reports
B.
Internal and external audit reports
Answers
C.
Threat and vulnerability analysis
C.
Threat and vulnerability analysis
Answers
D.
Control effectiveness assessment
D.
Control effectiveness assessment
Answers
Suggested answer: C

Which of The following should be the FIRST step when a company is made aware of new regulatory requirements impacting IT?

A.
Perform a gap analysis.
A.
Perform a gap analysis.
Answers
B.
Prioritize impact to the business units.
B.
Prioritize impact to the business units.
Answers
C.
Perform a risk assessment.
C.
Perform a risk assessment.
Answers
D.
Review the risk tolerance and appetite.
D.
Review the risk tolerance and appetite.
Answers
Suggested answer: C

Which of the following represents a vulnerability?

A.
An identity thief seeking to acquire personal financial data from an organization
A.
An identity thief seeking to acquire personal financial data from an organization
Answers
B.
Media recognition of an organization's market leadership in its industry
B.
Media recognition of an organization's market leadership in its industry
Answers
C.
A standard procedure for applying software patches two weeks after release
C.
A standard procedure for applying software patches two weeks after release
Answers
D.
An employee recently fired for insubordination
D.
An employee recently fired for insubordination
Answers
Suggested answer: C
Total 1.200 questions
Go to page: of 120