ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 58

Question list
Search
Search

List of questions

Search

Related questions











Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?

A.
To measure business exposure to risk
A.
To measure business exposure to risk
Answers
B.
To identify control vulnerabilities
B.
To identify control vulnerabilities
Answers
C.
To monitor the achievement of set objectives
C.
To monitor the achievement of set objectives
Answers
D.
To raise awareness of operational issues
D.
To raise awareness of operational issues
Answers
Suggested answer: C

The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:

A.
stakeholder risk tolerance.
A.
stakeholder risk tolerance.
Answers
B.
benchmarking criteria.
B.
benchmarking criteria.
Answers
C.
suppliers used by the organization.
C.
suppliers used by the organization.
Answers
D.
the control environment.
D.
the control environment.
Answers
Suggested answer: D

Which of the following is the BEST course of action to help reduce the probability of an incident recurring?

A.
Perform a risk assessment.
A.
Perform a risk assessment.
Answers
B.
Perform root cause analysis.
B.
Perform root cause analysis.
Answers
C.
Initiate disciplinary action.
C.
Initiate disciplinary action.
Answers
D.
Update the incident response plan.
D.
Update the incident response plan.
Answers
Suggested answer: B

Which of the following is MOST important to the integrity of a security log?

A.
Least privilege access
A.
Least privilege access
Answers
B.
Inability to edit
B.
Inability to edit
Answers
C.
Ability to overwrite
C.
Ability to overwrite
Answers
D.
Encryption
D.
Encryption
Answers
Suggested answer: B

Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

A.
Obtain objective assessment of the control environment.
A.
Obtain objective assessment of the control environment.
Answers
B.
Ensure the risk profile is defined and communicated.
B.
Ensure the risk profile is defined and communicated.
Answers
C.
Validate the threat management process.
C.
Validate the threat management process.
Answers
D.
Obtain an objective view of process gaps and systemic errors.
D.
Obtain an objective view of process gaps and systemic errors.
Answers
Suggested answer: A

An organization has been notified that a disgruntled, terminated IT administrator has tried to break into the corporate network. Which of the following discoveries should be of GREATEST concern to the organization?

A.
Authentication logs have been disabled.
A.
Authentication logs have been disabled.
Answers
B.
An external vulnerability scan has been detected.
B.
An external vulnerability scan has been detected.
Answers
C.
A brute force attack has been detected.
C.
A brute force attack has been detected.
Answers
D.
An increase in support requests has been observed.
D.
An increase in support requests has been observed.
Answers
Suggested answer: A

A management team is on an aggressive mission to launch a new product to penetrate new markets and overlooks IT risk factors, threats, and vulnerabilities. This scenario BEST demonstrates an organization's risk:

A.
management.
A.
management.
Answers
B.
tolerance.
B.
tolerance.
Answers
C.
culture.
C.
culture.
Answers
D.
analysis.
D.
analysis.
Answers
Suggested answer: C

Which of the following should be done FIRST when developing a data protection management plan?

A.
Perform a cost-benefit analysis.
A.
Perform a cost-benefit analysis.
Answers
B.
Identify critical data.
B.
Identify critical data.
Answers
C.
Establish a data inventory.
C.
Establish a data inventory.
Answers
D.
Conduct a risk analysis.
D.
Conduct a risk analysis.
Answers
Suggested answer: B

Which of the following is the BEST way to determine whether new controls mitigate security gaps in a business system?

A.
Complete an offsite business continuity exercise.
A.
Complete an offsite business continuity exercise.
Answers
B.
Conduct a compliance check against standards.
B.
Conduct a compliance check against standards.
Answers
C.
Perform a vulnerability assessment.
C.
Perform a vulnerability assessment.
Answers
D.
Measure the change in inherent risk.
D.
Measure the change in inherent risk.
Answers
Suggested answer: C

A vulnerability assessment of a vendor-supplied solution has revealed that the software is susceptible to cross-site scripting and SQL injection attacks. Which of the following will BEST mitigate this issue?

A.
Monitor the databases for abnormal activity
A.
Monitor the databases for abnormal activity
Answers
B.
Approve exception to allow the software to continue operating
B.
Approve exception to allow the software to continue operating
Answers
C.
Require the software vendor to remediate the vulnerabilities
C.
Require the software vendor to remediate the vulnerabilities
Answers
D.
Accept the risk and let the vendor run the software as is
D.
Accept the risk and let the vendor run the software as is
Answers
Suggested answer: C
Total 1.200 questions
Go to page: of 120