Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 60

Question list

List of questions

Question 591

(0)

Which of the following data would be used when performing a business impact analysis (BIA)?

Question 592

(0)

Prudent business practice requires that risk appetite not exceed:

Question 593

(0)

Which of the following MUST be updated to maintain an IT risk register?

Question 594

(0)

Which of the following is the GREATEST benefit when enterprise risk management (ERM) provides oversight of IT risk management?

Question 595

(0)

An organization automatically approves exceptions to security policies on a recurring basis. This practice is MOST likely the result of:

Question 596

(0)

Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?

Question 597

(0)

Which of the following is the BEST indicator of the effectiveness of IT risk management processes?

Question 598

(0)

A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls. Which of the following is the BEST way

Question 599

(0)

Which of the following is the BEST indication of a mature organizational risk culture?

Question 600

(0)

Which of the following should be the MOST important consideration for senior management when developing a risk response strategy?

Question 591

Which of the following data would be used when performing a business impact analysis (BIA)?

Cost-benefit analysis of running the current business

Cost of regulatory compliance

Projected impact of current business on future business

Expected costs for recovering the business

Show Answer Comment (0)

Question 592

Prudent business practice requires that risk appetite not exceed:

inherent risk.

risk tolerance.

risk capacity.

residual risk.

Show Answer Comment (0)

Question 593

Which of the following MUST be updated to maintain an IT risk register?

Expected frequency and potential impact

Risk tolerance

Enterprise-wide IT risk assessment

Risk appetite

Show Answer Comment (0)

Question 594

Which of the following is the GREATEST benefit when enterprise risk management (ERM) provides oversight of IT risk management?

Aligning IT with short-term and long-term goals of the organization

Ensuring the IT budget and resources focus on risk management

Ensuring senior management's primary focus is on the impact of identified risk

Prioritizing internal departments that provide service to customers

Show Answer Comment (0)

Question 595

An organization automatically approves exceptions to security policies on a recurring basis. This practice is MOST likely the result of:

a lack of mitigating actions for identified risk

decreased threat levels

ineffective service delivery

ineffective IT governance

Show Answer Comment (0)

Question 596

Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?

Qualitative measures require less ongoing monitoring.

Qualitative measures are better aligned to regulatory requirements.

Qualitative measures are better able to incorporate expert judgment.

Qualitative measures are easier to update.

Show Answer Comment (0)

Question 597

Which of the following is the BEST indicator of the effectiveness of IT risk management processes?

Percentage of business users completing risk training

Percentage of high-risk scenarios for which risk action plans have been developed

Number of key risk indicators (KRIs) defined

Time between when IT risk scenarios are identified and the enterprise's response

Show Answer Comment (0)

A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls. Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?

Identify previous data breaches using the startup company's audit reports.

Have the data privacy officer review the startup company's data protection policies.

Classify and protect the data according to the parent company's internal standards.

Implement a firewall and isolate the environment from the parent company's network.

Show Answer Comment (0)