Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
An organization has provided legal text explaining the rights and expected behavior of users accessing a system from geographic locations that have strong privacy regulations. Which of the following control types has been applied?
Answer: B
An organization will be impacted by a new data privacy regulation due to the location of its production facilities. What action should the risk practitioner take when evaluating the new regulation?
Answer: A
Which of the following is MOST helpful in preventing risk events from materializing?
Answer: C
Key risk indicators (KRIs) are measurable values that can indicate the probability of a risk occurring or the potential impact of a risk. By monitoring KRIs, an organization can identify when a risk is increasing and take proactive measures to prevent the risk event from occurring. Prioritizing and tracking issues, on the other hand, helps an organization manage risks that have already occurred or are currently ongoing, but does not necessarily prevent new risks from materializing.
Source: Adapted from community discussion — john_boogieman
Who is PRIMARILY accountable for risk treatment decisions?
Answer: D
Stephen is the project manager of the GBB project. He has worked with two subject matter experts and his project team to complete the risk assessment technique. There are approximately 47 risks that have a low probability and a low impact on the project. Which of the following answers best describes what Stephen should do with these risk events?
Answer: B
Which of the following is the GREATEST benefit of identifying appropriate risk owners?
Answer: A
The risk related to the abuse of administrator privileges can BEST be reduced by:
Answer: C
In the three lines of defense model, which of the following activities would be completed by the FIRST line of defense?
Answer: C
After a second analysis, I must rectify this answer. In the three lines of defense model, the activities completed by the FIRST line of defense generally involve the day-to-day operations of the organization and include implementing and maintaining effective internal controls to manage risks. Therefore, the activity "Control owners review a monthly report on the operation of high-risk controls" would typically be completed by the FIRST line of defense. This activity involves the control owners, who are responsible for implementing and maintaining internal controls within their area of responsibility, reviewing a report that summarizes the operation of high-risk controls.
Source: Adapted from community discussion — john_boogieman
Which of these documents is MOST important to request from a cloud service provider during a vendor risk assessment?
Answer: C
A new risk practitioner finds that decisions for implementing risk response plans are not being made. Which of the following would MOST likely explain this situation?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 101. 1449 questions available.
Version 1.0.0. How we source questions