CRISC practice questions 1,131–1,140

1. Question 1131 · 1449 in bank

   An organization is considering allowing users to access company data from their personal devices. Which of the following is the MOST important factor when assessing the risk?

   • AClassification of the data
   • BType of device
   • CRemote management capabilities
   • DVolume of data

   Show answer

   Answer: A

   Explanation

   Because the classification of the data determines its level of sensitivity and the level of protection required to secure it. This is the most important factor to consider when assessing the risk of allowing access to company data from personal devices, as it will help determine the necessary measures to ensure that the data is protected from unauthorized access, modification, or loss. Other factors, such as the type of device, remote management capabilities, and volume of data, may also play a role in the risk assessment but the classification of the data is the primary concern.

   Source: Adapted from community discussion — Boubou480

   Next question

2. Question 1132 · 1449 in bank

   Whose risk tolerance matters MOST when making a risk decision?

   • ACustomers who would be affected by a breach
   • BThe information security manager
   • CThe business process owner of the exposed assets
   • DAuditors, regulators, and standards organizations

   Show answer

   Answer: C

   Explanation

   Because the business process owner is responsible for the assets and the processes that use them. They understand the potential impact of a security breach on the business operations, and therefore have the most relevant information and insight on the acceptable level of risk. The business process owner's risk tolerance will impact the decisions they make regarding the allocation of resources to mitigate risk, as well as their willingness to accept certain risks in order to achieve business goals. The views and concerns of customers, information security managers, auditors, regulators, and standards organizations are important, but the business process owner's risk tolerance is the most relevant when making a risk decision.

   Source: Adapted from community discussion — Boubou480

   Next question

3. Question 1133 · 1449 in bank

   Which of the following is the MOST effective way to mitigate identified risk scenarios?

   • ADocument the risk tolerance of the organization.
   • BAssign ownership of the risk response plan.
   • CProvide awareness in early detection of risk.
   • DPerform periodic audits on identified risk areas.

   Show answer

   Answer: B

   Explanation

   Because assigning ownership of the risk response plan provides accountability and responsibility for mitigating the risk. By having a designated individual or team responsible for the risk response plan, the organization can ensure that the appropriate resources and actions are in place to effectively mitigate the risk. Assigning ownership also helps to ensure that the risk response plan is regularly reviewed and updated, and that the necessary steps are taken to implement it in a timely and effective manner. The other options (documenting the risk tolerance of the organization, providing awareness in early detection of risk, and performing periodic audits on identified risk areas) are also important components of risk management, but assigning ownership is the most effective way to ensure that the risk response plan is executed and monitored effectively.

   Source: Adapted from community discussion — Boubou480

   Next question

4. Question 1134 · 1449 in bank

   Management has required information security awareness training to reduce the risk associated with credential compromise. What is the BEST way to assess the effectiveness of the training?

   • AConduct social engineering testing.
   • BPerform a vulnerability assessment.
   • CAudit security awareness training materials.
   • DAdminister an end-of-training quiz.

   Show answer

   Answer: A

   Next question

5. Question 1135 · 1449 in bank

   Which of the following is the MOST important outcome of reviewing the risk management process?

   • AImproving the competencies of employees who performed the review
   • BAssuring the risk profile supports the IT objectives
   • CDetermining what changes should be made to IS policies to reduce risk
   • DDetermining that procedures used in risk assessment are appropriate

   Show answer

   Answer: B

   Explanation

   The risk profile is based on the overall risk posture of the organization, which is a relevant output of the risk management process.

   Source: Adapted from community discussion — john_boogieman

   Next question

6. Question 1136 · 1449 in bank

   Which of the following is the MOST important characteristic of an effective risk management program?

   • ARisk response plans are documented.
   • BKey risk indicators are defined.
   • CRisk ownership is assigned.
   • DControls are mapped to key risk scenarios.

   Show answer

   Answer: C

   Explanation

   I'm inclined to go for C. Yet again, risk management won't go far without clear ownership of the risk, be it for ownership or response.

   Source: Adapted from community discussion — travdaman

   Next question

7. Question 1137 · 1449 in bank

   The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:

   • Abackup recovery requests.
   • Bresources to monitor backups.
   • Crestoration monitoring reports.
   • Drecurring restore failures.

   Show answer

   Answer: D

   Explanation

   Garbage answers in this test by ExamTopics. Nobody should subscribe to this bs. I wrote to the team and they did not even bother to reply.

   Source: Adapted from community discussion — Ceecil1959

   Next question

8. Question 1138 · 1449 in bank

   When prioritizing risk response, management should FIRST:

   • Aevaluate the organization's ability and expertise to implement the solution.
   • Bevaluate the risk response of similar organizations.
   • Cdetermine which risk factors have high remediation costs.
   • Daddress high risk factors that have efficient and effective solutions.

   Show answer

   Answer: D

   Explanation

   Management would go with high risk factors FIRST, expertise are not relevant as can be outsource, hired, contracted.... should be D

   Source: Adapted from community discussion — BituBaba

   Next question

9. Question 1139 · 1449 in bank

   Out of several risk responses, which of the following risk responses is used for negative risk events?

   • AShare
   • BEnhance
   • CExploit
   • DAccept

   Show answer

   Answer: D

   Explanation

   Among the given choices only Acceptance response is used for negative risk events. Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active. ✑ Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk. Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks. Incorrect Answers: A, B, C: These all are used to deal with opportunities or positive risks, and not with negative risks.

   Source: Adapted from community discussion — ARAMiS

   

   Next question

10. Question 1140 · 1449 in bank

    Which of the following is the PRIMARY reason to perform ongoing risk assessments?

    • AThe risk environment is subject to change.
    • BThe information security budget must be justified.
    • CEmerging risk must be continuously reported to management.
    • DNew system vulnerabilities emerge at frequent intervals.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1131. 1449 questions available.