CRISC practice questions 1,141–1,150

1. Question 1141 · 1449 in bank

   Which of the following is the PRIMARY objective of providing an aggregated view of IT risk to business management?

   • ATo provide consistent and clear terminology
   • BTo allow for proper review of risk tolerance
   • CTo identify dependencies for reporting risk
   • DTo enable consistent data on risk to be obtained

   Show answer

   Answer: D

   Explanation

   Agree.An aggregated view of IT risk provides a comprehensive and holistic view of the risks that the organization faces. This view consolidates risk information from different sources and provides a high-level summary of the organization's overall risk posture. By providing this aggregated view, business management can obtain consistent data on risk, which is critical for making informed decisions around risk management.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 1142 · 1449 in bank

   An organization has implemented a preventive control to lock user accounts after three unsuccessful login attempts. This practice has been proven to be unproductive, and a change in the control threshold value has been recommended. Who should authorize changing this threshold?

   • AControl owner
   • BIT security manager
   • CRisk owner
   • DIT system owner

   Show answer

   Answer: C

   Explanation

   Should be “C” The person in whom the organization has invested the authority and accountability for making risk-based decisions and who owns the loss associated with a realized risk

   Source: Adapted from community discussion — Owaissyed

   Next question

3. Question 1143 · 1449 in bank

   A rule-based data loss prevention (DLP) tool has recently been implemented to reduce the risk of sensitive data leakage. Which of the following is MOST likely to change as a result of this implementation?

   • ARisk velocity
   • BRisk impact
   • CRisk likelihood
   • DRisk appetite

   Show answer

   Answer: C

   Explanation

   Risk impact when sensitive data is leaked will remain the same. The DLP will reduce the risk likelihood (Answer C). Any type of data that has a rule in the DLP will be protected.

   Source: Adapted from community discussion — hussmohsin

   Next question

4. Question 1144 · 1449 in bank

   An organization has completed a project to implement encryption on all databases that host customer data. Which of the following elements of the risk register should be updated to reflect this change?

   • ARisk tolerance
   • BInherent risk
   • CRisk appetite
   • DRisk likelihood

   Show answer

   Answer: D

   Explanation

   B is wrong - Inherent is the initial risk, it doesnt change after implementing controls. Residual does - but there is no such choice. In this case D would be the best one - as encryption reduces the probability of risk materialization...

   Source: Adapted from community discussion — fora

   Next question

5. Question 1145 · 1449 in bank

   A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?

   • AAction plans to address risk scenarios requiring treatment
   • BThe team that performed the risk assessment
   • CAn assigned risk manager to provide oversight
   • DThe methodology used to perform the risk assessment

   Show answer

   Answer: A

   Explanation

   I thought the action plan is the most important to capture in a risk register to follow up on risk remediation. Since when did we start capturing risk methodologies in risk registers?

   Source: Adapted from community discussion — JEDDAWy

   Next question

6. Question 1146 · 1449 in bank

   Which of the following is the MOST critical element to maximize the potential for a successful security implementation?

   • AIndustry-leading security tools
   • BThe organization's culture
   • CEase of implementation
   • DThe organization's knowledge

   Show answer

   Answer: B

   Next question

7. Question 1147 · 1449 in bank

   Senior management has asked a risk practitioner to develop technical risk scenarios related to a recently developed enterprise resource planning (ERP) system. These scenarios will be owned by the system manager. Which of the following would be the BEST method to use when developing the scenarios?

   • ABottom-up approach
   • BCause-and-effect diagram
   • CTop-down approach
   • DDelphi technique

   Show answer

   Answer: A

   Explanation

   A. Bottom-up approach When developing technical risk scenarios, especially for a specific system such as an ERP, a bottom-up approach is typically more effective. This approach begins at the technical or operational level and moves upward. It involves a detailed examination of the system components, interactions, vulnerabilities, and threats specific to that system. The bottom-up approach ensures that the unique technical intricacies and risks of the system are taken into consideration. In contrast, a top-down approach begins at the strategic or high-level perspective and moves downward. It's more focused on broader organizational goals and strategies. A cause-and-effect diagram, while useful for understanding the relationship between different factors, isn't the primary tool for scenario development. The Delphi technique is a forecasting method based on the results of multiple rounds of questionnaires sent to a panel of experts. It's not typically the primary method for technical risk scenario development for a specific system.

   Source: Adapted from community discussion — 01010100

   Next question

8. Question 1148 · 1449 in bank

   Which of the following is the MAIN reason for documenting the performance of controls?

   • AJustifying return on investment
   • BDemonstrating effective risk mitigation
   • CProviding accurate risk reporting
   • DObtaining management sign-off

   Show answer

   Answer: B

   Explanation

   But... The main reason for documenting the performance of controls is to demonstrate effective risk mitigation. By documenting the performance of controls, an organization can provide evidence that the controls have been implemented and are operating effectively. This evidence can be used to demonstrate to stakeholders, such as regulators and auditors, that the organization is effectively mitigating the risks that it faces.

   Source: Adapted from community discussion — john_boogieman

   Next question

9. Question 1149 · 1449 in bank

   Which of the following is the MOST important element of a successful risk awareness training program?

   • AMapping to a recognized standard
   • BProviding metrics for measurement
   • CCustomizing content for the audience
   • DProviding incentives to participants

   Show answer

   Answer: C

   Explanation

   I think it should be C, metrics are good for controlling how the good the program is, but tailoring the content is good for effectively putting out the message

   Source: Adapted from community discussion — CL888

   Next question

10. Question 1150 · 1449 in bank

    Whether the results of risk analysis should be presented in quantitative or qualitative terms should be based PRIMARILY on the:

    • Aspecific risk analysis framework being used.
    • Bresults of the risk assessment.
    • Crequirements of management.
    • Dorganizational risk tolerance.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1141. 1449 questions available.