Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following helps ensure compliance with a non-repudiation policy requirement for electronic transactions?
Answer: A
A : Nonrepudiation is the property of agreeing to adhere to an obligation. More specifically, it is the inability to refute responsibility. For example, if you take a pen and sign a (legal) contract your signature is a nonrepudiation device
Source: Adapted from community discussion — [Removed]
A risk practitioner observes that hardware failure incidents have been increasing over the last few months. However, due to built-in redundancy and fault-tolerant architecture, there have been no interruptions to business operations. The risk practitioner should conclude that:
Answer: D
While a root cause analysis may still be beneficial in identifying the underlying causes of the increase in hardware failure incidents, the absence of business interruptions suggests that the controls in place are currently sufficient to manage the risks associated with these incidents. Therefore, the risk practitioner should acknowledge the effectiveness of the controls in place and continue to monitor the situation to ensure that the controls remain effective and that any underlying issues are identified and addressed.
Source: Adapted from community discussion — john_boogieman
Which of the following would MOST effectively enable a business operations manager to identify events exceeding risk thresholds?
Answer: D
Which of the following would provide executive management with the BEST information to make risk decisions as a result of a risk assessment?
Answer: C
A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls. The BEST course of action would be to:
Answer: A
I think it's A, you can't change Off the shelf software, you need management approval and implement a compensating control for strong password generation
Source: Adapted from community discussion — MusMus
Who is BEST suited to determine whether a new control properly mitigates data loss risk within a system?
Answer: A
I will go with B , system owner can do testing but ultimately risk owner to agree and endorse that risk are mitigated after the use of the controls
Source: Adapted from community discussion — Raj1510
Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti-virus program?
Answer: C
Sorry, agree 'C'. Explain: This KPI measures the percentage of IT assets that have the most up-to-date malware definitions installed, which is a critical component of an effective antivirus program. If the percentage of IT assets with current malware definitions is high, it indicates that the antivirus program is doing a good job of keeping the system protected from known threats. The number of false positives detected over a period of time is not a good KPI for measuring the effectiveness of an antivirus program because false positives do not necessarily indicate that the antivirus program is ineffective. False positives occur when the antivirus program mistakenly identifies a harmless file or activity as malicious, and while they can be frustrating for users, they are not indicative of a problem with the antivirus program's ability to detect real threats.
Source: Adapted from community discussion — john_boogieman
A risk manager has determined there is excessive risk with a particular technology. Who is the BEST person to own the unmitigated risk of the technology?
Answer: A
Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?
Answer: A
Monitoring key access control performance indicators is the best option for providing an early warning that network access of terminated employees is not being revoked in accordance with the SLA because it directly involves tracking and assessing the effectiveness of access control measures. By regularly monitoring these performance indicators, you can identify any discrepancies or delays in revoking access for terminated employees and take corrective action. The other options are not as effective in providing an early warning for this specific issue: C. Analyzing access control logs for suspicious activity can help detect unauthorized access, but it may not provide an early warning about delays in revoking access for terminated employees. It is a reactive measure rather than a proactive one.
Source: Adapted from community discussion — Broesweelies
Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1021. 1449 questions available.
Version 1.0.0. How we source questions