Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
A management team is on an aggressive mission to launch a new product to penetrate new markets and overlooks IT risk factors, threats, and vulnerabilities. This scenario BEST demonstrates an organization's risk:
Answer: C
The risk associated with an asset before controls are applied can be expressed as:
Answer: C
Malware has recently affected an organization. The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:
Answer: B
I think B is correct. See R2-106. Impact analysis will not directly help with mitigation for a specific security incident.
Source: Adapted from community discussion — aselunar
When using a third party to perform penetration testing, which of the following is the MOST important control to minimize operational impact?
Answer: D
Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?
Answer: C
An external security audit has reported multiple findings related to control noncompliance. Which of the following would be MOST important for the risk practitioner to communicate to senior management?
Answer: D
ha ha ha C: Correct answer?. Who answers here to mislead people. Pathetic man. D is the correct answer. External audit. Non-compliance - communicated to Senior Mgtm about eht impact to the organization.
Source: Adapted from community discussion — Ceecil1959
A risk practitioner is organizing a training session to communicate risk assessment methodologies to ensure a consistent risk view within the organization. Which of the following is the MOST important topic to cover in this training?
Answer: C
Which of the following role carriers will decide the Key Risk Indicator of the enterprise? Each correct answer represents a part of the solution. Choose two.
Answer: AB
An enterprise may have hundreds of risk indicators such as logs, alarms and reports. The CRISC will usually need to work with senior management and business leaders to determine which risk indicators will be monitored on a regular basis and be recognized as KRIs. Incorrect Answers: C, D: Chief financial officer and human resource only overview common risk view, but are not involved in risk based decisions.
Source: Adapted from community discussion — SuperMax
An organization wants to assess the maturity of its internal control environment. The FIRST step should be to:
Answer: D
The FIRST step that an organization should take to assess the maturity of its internal control environment would be to conduct a baseline assessment. A baseline assessment involves conducting a comprehensive evaluation of the organization's current control environment, including the design and operation of its controls. This assessment would provide a starting point for the organization to understand the current state of its control environment and identify areas that need improvement. Once the baseline assessment is complete, the organization can then move on to identify key process owners, validate control process execution, and determine if controls are effective.
Source: Adapted from community discussion — Koulyo
A risk practitioner recently discovered that sensitive data from the production environment is required for testing purposes in non-production environments. Which of the following is the BEST recommendation to address this situation?
Answer: A
Best answer is D, don't use prod data in test, but if you have to then the data must be protected with equivalent security.
Source: Adapted from community discussion — [Removed]
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1111. 1449 questions available.
Version 1.0.0. How we source questions