Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following BEST enables the identification of trends in risk levels?
Answer: A
Repeatable - A KRI must be repeatable and able to be measured on a regular basis to show trends and patterns in activity and results.
Source: Adapted from community discussion — thedood
To implement the MOST effective monitoring of key risk indicators (KRIs), which of the following needs to be in place?
Answer: D
Which of the following would MOST likely result in updates to an IT risk appetite statement?
Answer: A
Changes in senior management is Correct from the choices given. External audit is an independent judgement, and more to do with the stipulated process, gaps, proper execution, documentation, and compliance. Nothing to do with Risk appetite.
Source: Adapted from community discussion — Ceecil1959
Which of the following would be MOST helpful to understand the impact of a new technology system on an organization's current risk profile?
Answer: C
Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?
Answer: B
A review of an organization's controls has determined its data loss prevention (DLP) system is currently failing to detect outgoing emails containing credit card data. Which of the following would be MOST impacted?
Answer: B
Sorry, 'B', reason: Residual risk is the level of risk that remains after controls have been implemented to mitigate inherent risk. In this case, the failure of the DLP system to detect outgoing emails containing credit card data would mean that the residual risk of credit card data leakage would be higher than anticipated, as the control (the DLP system) is not working as intended.
Source: Adapted from community discussion — john_boogieman
During an IT department reorganization, the manager of a risk mitigation action plan was replaced. The new manager has begun implementing a new control after identifying a more effective option. Which of the following is the risk practitioner's BEST course of action?
Answer: A
C. Modify the action plan in the risk register When a new manager of a risk mitigation action plan identifies a more effective control and begins implementing it, it's essential to update the risk register and action plan to reflect the change. This ensures that the organization's documentation accurately represents the current risk management status and control measures in plac
Source: Adapted from community discussion — eblue
A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption. Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?
Answer: D
D. Raise awareness of encryption requirements for sensitive data. The most effective approach to mitigate the risk associated with users sending sensitive information by email without using encryption is "D. Raise awareness of encryption requirements for sensitive data." Increasing user awareness about the importance of encrypting sensitive data before sending it via email can help prevent accidental data leaks and ensure that employees are following the organization's security protocols. While the other options (implementing a violation reporting tool, blocking unencrypted outgoing emails, implementing a disciplinary process) can also contribute to risk mitigation, raising awareness is a proactive step that addresses the root cause of the issue by educating users about the proper procedures for handling sensitive data.
Source: Adapted from community discussion — Staanlee
Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST:
Answer: C
Which of the following would be considered a vulnerability?
Answer: A
A vulnerability refers to a weakness or gap in a security program that can be exploited by threats to gain unauthorized access to an asset. In the given options: A. Delayed removal of employee access This is a vulnerability because it's a procedural weakness that could allow ex-employees or employees who have changed roles to have inappropriate or unauthorized access to systems or data. The other options describe outcomes, events, or conditions resulting from vulnerabilities, but they are not vulnerabilities themselves.
Source: Adapted from community discussion — 01010100
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 991. 1449 questions available.
Version 1.0.0. How we source questions