ExamGecko
Home Home / Isaca / CRISC

Isaca CRISC Practice Test - Questions Answers, Page 87

Question list
Search
Search

Related questions











Which of the following is MOST helpful in preventing risk events from materializing?

A.
Prioritizing and tracking issues
A.
Prioritizing and tracking issues
Answers
B.
Establishing key risk indicators (KRIs)
B.
Establishing key risk indicators (KRIs)
Answers
C.
Reviewing and analyzing security incidents
C.
Reviewing and analyzing security incidents
Answers
D.
Maintaining the risk register
D.
Maintaining the risk register
Answers
Suggested answer: A

While reviewing the risk register, a risk practitioner notices that different business units have significant variances in inherent risk for the same risk scenario. Which of the following is the BEST course of action?

A.
Update the risk register with the average of residual risk for both business units.
A.
Update the risk register with the average of residual risk for both business units.
Answers
B.
Review the assumptions of both risk scenarios to determine whether the variance is reasonable.
B.
Review the assumptions of both risk scenarios to determine whether the variance is reasonable.
Answers
C.
Update the risk register to ensure both risk scenarios have the highest residual risk.
C.
Update the risk register to ensure both risk scenarios have the highest residual risk.
Answers
D.
Request that both business units conduct another review of the risk.
D.
Request that both business units conduct another review of the risk.
Answers
Suggested answer: B

Which of the following would be MOST helpful when communicating roles associated with the IT risk management process?

A.
Skills matrix
A.
Skills matrix
Answers
B.
Job descriptions
B.
Job descriptions
Answers
C.
RACI chart
C.
RACI chart
Answers
D.
Organizational chart
D.
Organizational chart
Answers
Suggested answer: A

Which of the following is MOST important to include in a risk assessment of an emerging technology?

A.
Risk response plans
A.
Risk response plans
Answers
B.
Risk and control ownership
B.
Risk and control ownership
Answers
C.
Key controls
C.
Key controls
Answers
D.
Impact and likelihood ratings
D.
Impact and likelihood ratings
Answers
Suggested answer: D

Which of the following is the BEST indicator of an effective IT security awareness program?

A.
Decreased success rate of internal phishing tests
A.
Decreased success rate of internal phishing tests
Answers
B.
Decreased number of reported security incidents
B.
Decreased number of reported security incidents
Answers
C.
Number of disciplinary actions issued for security violations
C.
Number of disciplinary actions issued for security violations
Answers
D.
Number of employees that complete security training
D.
Number of employees that complete security training
Answers
Suggested answer: A

Who should have the authority to approve an exception to a control?

A.
information security manager
A.
information security manager
Answers
B.
Control owner
B.
Control owner
Answers
C.
Risk owner
C.
Risk owner
Answers
D.
Risk manager
D.
Risk manager
Answers
Suggested answer: C

Which type of indicators should be developed to measure the effectiveness of an organization's firewall rule set?

A.
Key risk indicators (KRIs)
A.
Key risk indicators (KRIs)
Answers
B.
Key management indicators (KMIs)
B.
Key management indicators (KMIs)
Answers
C.
Key performance indicators (KPIs)
C.
Key performance indicators (KPIs)
Answers
D.
Key control indicators (KCIs)
D.
Key control indicators (KCIs)
Answers
Suggested answer: D

Which of the following is the MOST appropriate action when a tolerance threshold is exceeded?

A.
Communicate potential impact to decision makers.
A.
Communicate potential impact to decision makers.
Answers
B.
Research the root cause of similar incidents.
B.
Research the root cause of similar incidents.
Answers
C.
Verify the response plan is adequate.
C.
Verify the response plan is adequate.
Answers
D.
Increase human resources to respond in the interim.
D.
Increase human resources to respond in the interim.
Answers
Suggested answer: A

Which of the following will be the GREATEST concern when assessing the risk profile of an organization?

A.
The risk profile was not updated after a recent incident
A.
The risk profile was not updated after a recent incident
Answers
B.
The risk profile was developed without using industry standards.
B.
The risk profile was developed without using industry standards.
Answers
C.
The risk profile was last reviewed two years ago.
C.
The risk profile was last reviewed two years ago.
Answers
D.
The risk profile does not contain historical loss data.
D.
The risk profile does not contain historical loss data.
Answers
Suggested answer: A

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

A.
Monitoring risk responses
A.
Monitoring risk responses
Answers
B.
Applying risk treatments
B.
Applying risk treatments
Answers
C.
Providing assurance of control effectiveness
C.
Providing assurance of control effectiveness
Answers
D.
Implementing internal controls
D.
Implementing internal controls
Answers
Suggested answer: A
Total 1.200 questions
Go to page: of 120