Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 70

Question list

List of questions

Question 691

(0)

Which of the following approaches BEST identifies information systems control deficiencies?

Question 692

(0)

Which of the following is the BEST recommendation to senior management when the results of a risk and control assessment indicate a risk scenario can only be partially mitigated?

Question 693

(0)

A violation of segregation of duties is when the same:

Question 694

(0)

Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?

Question 695

(0)

Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Question 696

(0)

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an antivirus program?

Question 697

(0)

Which of the following is the BEST source for identifying key control indicators (KCIs)?

Question 698

(0)

An organization discovers significant vulnerabilities in a recently purchased commercial off-the-shelf software product which will not be corrected until the next release. Which of the following is

Question 699

(0)

The BEST way to improve a risk register is to ensure the register:

Question 700

(0)

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:

Question 691

Which of the following approaches BEST identifies information systems control deficiencies?

Countermeasures analysis

Best practice assessment

Gap analysis

Risk assessment

Show Answer Comment (0)

Question 692

Which of the following is the BEST recommendation to senior management when the results of a risk and control assessment indicate a risk scenario can only be partially mitigated?

Implement controls to bring the risk to a level within appetite and accept the residual risk.

Implement a key performance indicator (KPI) to monitor the existing control performance.

Accept the residual risk in its entirety and obtain executive management approval.

Separate the risk into multiple components and avoid the risk components that cannot be mitigated.

Show Answer Comment (0)

Question 693

A violation of segregation of duties is when the same:

user requests and tests the change prior to production.

user authorizes and monitors the change post-implementation.

programmer requests and tests the change prior to production.

programmer writes and promotes code into production.

Show Answer Comment (0)

Question 694

Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?

Number of times the recovery plan is reviewed

Number of successful recovery plan tests

Percentage of systems with outdated virus protection

Percentage of employees who can work remotely

Show Answer Comment (0)

Question 695

Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Including trend analysis of risk metrics

Using an aggregated view of organizational risk

Relying on key risk indicator (KRI) data

Ensuring relevance to organizational goals

Show Answer Comment (0)

Question 696

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an antivirus program?

Percentage of IT assets with current malware definitions

Number of false positives defected over a period of time

Number of alerts generated by the anti-virus software

Frequency of anti-vinjs software updates

Show Answer Comment (0)

Question 697

Which of the following is the BEST source for identifying key control indicators (KCIs)?

Privileged user activity monitoring controls

Controls mapped to organizational risk scenarios

Recent audit findings of control weaknesses

A list of critical security processes

Show Answer Comment (0)

An organization discovers significant vulnerabilities in a recently purchased commercial off-the-shelf software product which will not be corrected until the next release. Which of the following is the risk manager's BEST course of action?

Review the risk of implementing versus postponing with stakeholders.

Run vulnerability testing tools to independently verify the vulnerabilities.

Review software license to determine the vendor's responsibility regarding vulnerabilities.

Require the vendor to correct significant vulnerabilities prior to installation.

Show Answer Comment (0)

Question 699

The BEST way to improve a risk register is to ensure the register:

is updated based upon significant events.

documents possible countermeasures.

contains the risk assessment completion date.

is regularly audited.

Show Answer Comment (0)

Question 700

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:

reset the alert threshold based on peak traffic

analyze the traffic to minimize the false negatives

analyze the alerts to minimize the false positives

sniff the traffic using a network analyzer

Show Answer Comment (0)

Total 1.200 questions