CRISC practice questions 1,091–1,100

1. Question 1091 · 1449 in bank

   Which of the following is the BEST course of action when risk is found to be above the acceptable risk appetite?

   • AExecute the risk response plan.
   • BAnalyze the effectiveness of controls.
   • CMaintain the current controls.
   • DReview risk tolerance levels.

   Show answer

   Answer: A

   Explanation

   Correction, reason: The risk response plan outlines the actions that should be taken when a risk exceeds the acceptable risk level. The response could be to mitigate the risk, transfer the risk, avoid the risk, or accept the risk. The plan should have been developed during the risk management planning phase and should be reviewed periodically to ensure that it remains relevant and effective. Therefore, executing the risk response plan would be the most appropriate action to take in this situation.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 1092 · 1449 in bank

   A risk assessment has identified that departments have installed their own WiFi access points on the enterprise network. Which of the following would be MOST important to include in a report to senior management?

   • APlanned remediation actions
   • BThe network security policy
   • CThe WiFi access point configuration
   • DPotential business impact

   Show answer

   Answer: D

   Next question

3. Question 1093 · 1449 in bank

   Which of the following would be a risk practitioner's BEST recommendation for preventing cyber intrusion?

   • AImplement data loss prevention (DLP) tools.
   • BImplement network segregation.
   • CEstablish a cyber response plan.
   • DStrengthen vulnerability remediation efforts.

   Show answer

   Answer: D

   Explanation

   Of possible answers D makes the most sense, as it is the widest. Then, second choice would be B. A makes little sens (does not prevent intrusion, but might prevent harm to be made by intrusion), and C is reaction, not prevention.

   Source: Adapted from community discussion — fora

   Next question

4. Question 1094 · 1449 in bank

   Which of the following should be the risk practitioner's PRIMARY focus when determining whether controls are adequate to mitigate risk?

   • ACost-benefit analysis
   • BSensitivity analysis
   • CLevel of residual risk
   • DRisk appetite

   Show answer

   Answer: C

   Explanation

   CBA not check adequacy of controls , CBA used at the time of risk treatment decision to finalize which treatment suitable to mitigate risk. adequacy of control points to residual risk hence answer C is right

   Source: Adapted from community discussion — Raj1510

   Next question

5. Question 1095 · 1449 in bank

   An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system. The risk practitioner is documenting the risk in the risk register. The risk should be owned by the:

   • Abusiness process owner.
   • Bchief information officer.
   • Cproject manager.
   • Dchief risk officer.

   Show answer

   Answer: A

   Next question

6. Question 1096 · 1449 in bank

   The MAIN reason for creating and maintaining a risk register is to:

   • Aaccount for identified key risk factors.
   • Bensure assets have low residual risk.
   • Cdefine the risk assessment methodology.
   • Dassess effectiveness of different projects.

   Show answer

   Answer: A

   Explanation

   A. account for identified key risk factors. Here's why: Documentation of Identified Risks: A risk register serves as a comprehensive record of all identified risks that an organization might face. It is a central repository where key risk factors are listed, along with their characteristics such as likelihood, impact, and potential mitigation strategies. Tool for Risk Management: The risk register is an essential tool for ongoing risk management. It helps in tracking and monitoring risks over time, assessing how they evolve, and evaluating the effectiveness of risk response strategies. Facilitates Risk Communication: Maintaining a risk register aids in communicating the risks across various levels of the organization. It ensures that all stakeholders are aware of the risks and understand their potential impact on the organization.

   Source: Adapted from community discussion — Kennethlim79

   Next question

7. Question 1097 · 1449 in bank

   A risk practitioner's PRIMARY focus when validating a risk response action plan should be that risk response:

   • Aadvances business objectives.
   • Bquantifies risk impact.
   • Creduces risk to an acceptable level.
   • Daligns with business strategy.

   Show answer

   Answer: C

   Explanation

   It is business that decides what level of risk is acceptable or not - taking int account all the important factors, including the business strategy. Therefore C should be better than D.

   Source: Adapted from community discussion — fora

   Next question

8. Question 1098 · 1449 in bank

   Which of the following is the MAIN benefit of involving stakeholders in the selection of key risk indicators (KRIs)?

   • ALeveraging existing metrics
   • BOptimizing risk treatment decisions
   • CObtaining buy-in from risk owners
   • DImproving risk awareness

   Show answer

   Answer: C

   Explanation

   7th CRISC manual, 'KRI selecction' section, 'the risk practitioner should work with all stakeholders to ensure greater buy-in and ownership.'.

   Source: Adapted from community discussion — john_boogieman

   Next question

9. Question 1099 · 1449 in bank

   Which of the following is MOST critical when designing controls?

   • AInvolvement of process owner
   • BInvolvement of internal audit
   • CIdentification of key risk indicators
   • DQuantitative impact of the risk

   Show answer

   Answer: A

   Next question

10. Question 1100 · 1449 in bank

    An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST?

    • AThe risk owner who also owns the business service enabled by this infrastructure
    • BThe site manager who is required to provide annual risk assessments under the contract
    • CThe data center manager who is also employed under the managed hosting services contract
    • DThe chief information officer (CIO) who is responsible for the hosted services

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1091. 1449 questions available.