Question 1181 · 1449 in bank
Which of the following should an organization perform to forecast the effects of a disaster?
Show answer
Answer: C
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following should an organization perform to forecast the effects of a disaster?
Answer: C
You are working with a vendor on your project. A stakeholder has requested a change for the project, which will add value to the project deliverables. The vendor that you're working with on the project will be affected by the change. What system can help you introduce and execute the stakeholder change request with the vendor?
Answer: A
The contract change control system is part of the project's change control system. It addresses changes with the vendor that may affect the project contract. Change control system, a part of the configuration management system, is a collection of formal documented procedures that define how project deliverables and documentation will be controlled, changed, and approved. Incorrect Answers: B: The scope may change because of the stakeholder change request. Vendor's relationship to the project, hence this choice is not the best answer. C: The cost change control system manages changes to costs in the project. D: There is no indication that the change could affect the project schedule.
Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?
Answer: C
For any deployment, there would be a request and the approval. The requests and Approvals are covered in Configuration Management.
Source: Adapted from community discussion — BituBaba
Which of the following is an example of the second line in the three lines of defense model?
Answer: C
The answer C is correct as it is asking for Level 2. Ref: https://www2.erm-academy.org/publication/risk-management-article/three-lines-defense/ 2. Second-tier defense The second layer of defense is executed by risk management and compliance functions, especially in structured risk management and compliance units e.g. department or risk management and compliance units.
Source: Adapted from community discussion — Rooks
A risk practitioner is reviewing the status of an action plan to mitigate an emerging IT risk and finds the risk level has increased. The BEST course of action would be to:
Answer: A
Maybe all you need to reconfigure the existing controls or maybe you need to change it because its no longer effective. Adding compensating controls directly is not the correct action to take here. So the correct answer is A
Source: Adapted from community discussion — hussmohsin
Mapping open risk issues to an enterprise risk heat map BEST facilitates:
Answer: C
I opted for Response but the right one might be option A, risk ownership. An enterprise risk heat map is a visual representation of an organization's risks, which shows the likelihood and potential impact of each risk. By mapping open risk issues to the enterprise risk heat map, the organization can clearly identify the risks that need to be managed and assign ownership of each risk to a specific person or team. Risk ownership is an essential component of effective risk management, as it ensures that each risk is managed by the appropriate individuals with the necessary expertise and authority. By assigning risk ownership, the organization can ensure that each risk is actively monitored, assessed, and controlled.
Source: Adapted from community discussion — Koulyo
After recent updates to the risk register, management has requested that the overall level of residual risk be reduced. Which of the following is the risk practitioner's BEST course of action?
Answer: C
The risk mitigation plans developed earlier would be tailored to meet the residual risk (that was agreed upon earlier). If the residual risk bar need to be lowered further, the risk practitioner may have to develop new risk plan with mitigation options (after consulting the business owners and other stakeholders). Hence prioritization of remediation plans, can’t be the answer. Any thoughts, guys?
Source: Adapted from community discussion — jseeker
Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?
Answer: B
Which of the following would be MOST helpful to a risk practitioner when ensuring that mitigated risk remains within acceptable limits?
Answer: A
Which of the following is MOST important for maintaining the effectiveness of an IT risk register?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1181. 1449 questions available.
Version 1.0.0. How we source questions