ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 62

Question list
Search
Search

Related questions











When reviewing a business continuity plan (BCP). which of the following would be the MOST significant deficiency?

A.
BCP testing is net in conjunction with the disaster recovery plan (DRP)
A.
BCP testing is net in conjunction with the disaster recovery plan (DRP)
Answers
B.
Recovery time objectives (RTOs) do not meet business requirements.
B.
Recovery time objectives (RTOs) do not meet business requirements.
Answers
C.
BCP is often tested using the walk-through method.
C.
BCP is often tested using the walk-through method.
Answers
D.
Each business location has separate, inconsistent BCPs.
D.
Each business location has separate, inconsistent BCPs.
Answers
Suggested answer: B

Which of the following is the STRONGEST indication an organization has ethics management issues?

A.
Employees do not report IT risk issues for fear of consequences.
A.
Employees do not report IT risk issues for fear of consequences.
Answers
B.
Internal IT auditors report to the chief information security officer (CISO).
B.
Internal IT auditors report to the chief information security officer (CISO).
Answers
C.
Employees face sanctions for not signing the organization's acceptable use policy.
C.
Employees face sanctions for not signing the organization's acceptable use policy.
Answers
D.
The organization has only two lines of defense.
D.
The organization has only two lines of defense.
Answers
Suggested answer: A

Which of the following is the BEST evidence that a user account has been properly authorized?

A.
An email from the user accepting the account
A.
An email from the user accepting the account
Answers
B.
Notification from human resources that the account is active
B.
Notification from human resources that the account is active
Answers
C.
User privileges matching the request form
C.
User privileges matching the request form
Answers
D.
Formal approval of the account by the user's manager
D.
Formal approval of the account by the user's manager
Answers
Suggested answer: C

Which of the following is the BEST way to manage the risk associated with malicious activities performed by database administrators (DBAs)?

A.
Activity logging and monitoring
A.
Activity logging and monitoring
Answers
B.
Periodic access review
B.
Periodic access review
Answers
C.
Two-factor authentication
C.
Two-factor authentication
Answers
D.
Awareness training and background checks
D.
Awareness training and background checks
Answers
Suggested answer: A

Which of the following would BEST assist in reconstructing the sequence of events following a security incident across multiple IT systems in the organization's network?

A.
Network monitoring infrastructure
A.
Network monitoring infrastructure
Answers
B.
Centralized vulnerability management
B.
Centralized vulnerability management
Answers
C.
Incident management process
C.
Incident management process
Answers
D.
Centralized log management
D.
Centralized log management
Answers
Suggested answer: D

To communicate the risk associated with IT in business terms, which of the following MUST be defined?

A.
Compliance objectives
A.
Compliance objectives
Answers
B.
Risk appetite of the organization
B.
Risk appetite of the organization
Answers
C.
Organizational objectives
C.
Organizational objectives
Answers
D.
Inherent and residual risk
D.
Inherent and residual risk
Answers
Suggested answer: C

Which of the following is the GREATEST risk associated with the misclassification of data?

A.
inadequate resource allocation
A.
inadequate resource allocation
Answers
B.
Data disruption
B.
Data disruption
Answers
C.
Unauthorized access
C.
Unauthorized access
Answers
D.
Inadequate retention schedules
D.
Inadequate retention schedules
Answers
Suggested answer: A

Which of the following is the MOST critical element to maximize the potential for a successful security implementation?

A.
The organization's knowledge
A.
The organization's knowledge
Answers
B.
Ease of implementation
B.
Ease of implementation
Answers
C.
The organization's culture
C.
The organization's culture
Answers
D.
industry-leading security tools
D.
industry-leading security tools
Answers
Suggested answer: C

Which of the following is the PRIMARY purpose of periodically reviewing an organization's risk profile?

A.
Align business objectives with risk appetite.
A.
Align business objectives with risk appetite.
Answers
B.
Enable risk-based decision making.
B.
Enable risk-based decision making.
Answers
C.
Design and implement risk response action plans.
C.
Design and implement risk response action plans.
Answers
D.
Update risk responses in the risk register
D.
Update risk responses in the risk register
Answers
Suggested answer: B

Which of the following is necessary to enable an IT risk register to be consolidated with the rest of the organization's risk register?

A.
Risk taxonomy
A.
Risk taxonomy
Answers
B.
Risk response
B.
Risk response
Answers
C.
Risk appetite
C.
Risk appetite
Answers
D.
Risk ranking
D.
Risk ranking
Answers
Suggested answer: A
Total 1.200 questions
Go to page: of 120