Question 1041 · 1449 in bank
Which of the following is the MAIN reason to continuously monitor IT-related risk?
Show answer
Answer: A
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the MAIN reason to continuously monitor IT-related risk?
Answer: A
A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet. What should be the risk practitioner's FIRST course of action?
Answer: C
Which of the following is the MOST important consideration when sharing risk management updates with executive management?
Answer: C
During an IT risk scenario review session, business executives question why they have been assigned ownership of IT-related risk scenarios. They feel IT risk is technical in nature and therefore should be owned by IT. Which of the following is the BEST way for the risk practitioner to address these concerns?
Answer: C
An organization operates in an environment where reduced time-to-market for new software products is a top business priority. Which of the following should be the risk practitioner's GREATEST concern?
Answer: B
Which of the following is MOST effective in continuous risk management process improvement?
Answer: B
While reviewing a contract of a cloud services vendor, it was discovered that the vendor refuses to accept liability for a sensitive data breach. Which of the following controls will BEST reduce the risk associated with such a data breach?
Answer: A
ok, after reading it several more times I have understood the meaning of this. Once a data breach has occurred, it is no longer possible to prevent the breach from happening. However, there are still controls that can be implemented to mitigate the risk associated with the data breach. In the scenario presented, if the vendor refuses to accept liability for a sensitive data breach, one of the best controls to reduce the risk associated with the breach would be to engage a third party to validate the vendor's operational controls. This would help ensure that the vendor has implemented appropriate security controls to protect the data and would provide an independent assessment of the vendor's security posture. While ensuring the vendor does not know the encryption key could also be a useful control in preventing unauthorized access to the data, this control would not be effective in mitigating the risk associated with a data breach that has already occurred.
Source: Adapted from community discussion — john_boogieman
When reviewing a risk response strategy, senior management's PRIMARY focus should be placed on the:
Answer: B
Senior management's primary focus should be placed on the alignment with risk appetite when reviewing a risk response strategy because risk appetite defines the organization's overall willingness to accept risk in pursuit of its objectives. Ensuring that the risk response strategy aligns with the risk appetite helps senior management make informed decisions that balance potential opportunities and risks, while maintaining the desired level of risk exposure.
Source: Adapted from community discussion — Broesweelies
After the review of a risk record, internal audit questioned why the risk was lowered from medium to low. Which of the following is the BEST course of action in responding to this inquiry?
Answer: C
Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?
Answer: D
Answer should be D. Your inherent risk stays the same unless you start new business activities. It is the risk that exists without controls. The controls modify the inherent risk to give you residual risk. If there is a control in place, modifications to the control could impact the amount of risk that is being mitigated which would result in a change in residual risk.
Source: Adapted from community discussion — CbtL
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1041. 1449 questions available.
Version 1.0.0. How we source questions