CRISC practice questions 111–120

1. Question 111 · 1449 in bank

   Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?

   • AThe number of executives attending IT security awareness training
   • BThe percentage of incidents presented to the board
   • CThe percentage of corporate budget allocated to IT risk activities
   • DThe number of stakeholders involved in IT risk identification workshops

   Show answer

   Answer: C

   Explanation

   The percentage of corporate budget allocated to IT risk activities is a good indicator of executive management's support for IT risk mitigation efforts. When executive management allocates a significant portion of the corporate budget to IT risk activities, it demonstrates their commitment to identifying and mitigating IT risks that could negatively impact the organization.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 112 · 1449 in bank

   The BEST metric to demonstrate that servers are configured securely is the total number of servers:

   • Aexperiencing hardware failures
   • Bexceeding availability thresholds
   • Cexceeding current patching standards
   • Dmeeting the baseline for hardening.

   Show answer

   Answer: D

   Next question

3. Question 113 · 1449 in bank

   Which of the following is the MOST important goal of a security awareness program?

   • ATo enforce consequences related to the organization's security policy
   • BTo reduce costs associated with security incidents
   • CTo strengthen the security culture by changing user behavior
   • DTo strengthen control performance related to regulatory requirements

   Show answer

   Answer: C

   Next question

4. Question 114 · 1449 in bank

   A recent big data project has resulted in the creation of an application used to support important investment decisions. Which of the following should be of GREATEST concern to the risk practitioner?

   • AData redundancy
   • BMaintenance costs
   • CData quality
   • DSystem integration

   Show answer

   Answer: C

   Next question

5. Question 115 · 1449 in bank

   You are the project manager of GHT project. Your project team is in the process of identifying project risks on your current project. The team has the option to use all of the following tools and techniques to diagram some of these potential risks EXCEPT for which one?

   • AProcess flowchart
   • BIshikawa diagram
   • CInfluence diagram
   • DDecision tree diagram

   Show answer

   Answer: D

   Explanation

   Decision tree diagrams are used during the Quantitative risk analysis process and not in risk identification. Incorrect Answers: A, B, C: All these options are diagrammatical techniques used in the Identify risks process.

   Next question

6. Question 116 · 1449 in bank

   An organization has initiated quarterly briefings for executive management with a focus on increasing risk awareness. Which of the following is MOST relevant to include in this briefing?

   • AThe risk register
   • BRisk management best practices
   • CUpdates to security policies
   • DRecent security incidents

   Show answer

   Answer: A

   Explanation

   I would go with A. Its more comprehensive than just specific security incidents. Plus the incidents are already incorporated in the RR.

   Source: Adapted from community discussion — Koulyo

   Next question

7. Question 117 · 1449 in bank

   During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk practitioner do NEXT?

   • AEscalate the non-cooperation to management
   • BExclude applicable controls from the assessment
   • CReview the supplier's contractual obligations
   • DRequest risk acceptance from the business process owner

   Show answer

   Answer: C

   Next question

8. Question 118 · 1449 in bank

   When implementing a key performance indicator (KPI) for control performance monitoring, it is MOST important to:

   • Adefine the unit of measurement
   • Bdefine the target or planned value
   • Cbenchmark the target value against an industry standard
   • Ddefine data sources and reporting frequency

   Show answer

   Answer: B

   Next question

9. Question 119 · 1449 in bank

   The PRIMARY reason for defining risk ownership in an organization is to ensure:

   • Aresponsibility for risk treatment
   • Baccountability for risk management
   • Cresponsibility for risk assessments
   • Daccountability for risk register updates

   Show answer

   Answer: B

   References

   • isaca.org documentation

   Next question

10. Question 120 · 1449 in bank

    Which of the following is the MOST important step to ensure regulatory requirements are adequately addressed within an organization?

    • AEmploy IT solutions that meet regulatory requirements
    • BPerform a gap analysis against regulatory requirements
    • CObtain necessary resources to address regulatory requirements
    • DDevelop a policy framework that addresses regulatory requirements

    Show answer

    Answer: D

    Explanation

    The question clearly states that the regulation is not new. What is the MOST important step to ensure regulatory requirements are adequately addressed within an organization? Gap analysis can be done if the regulation is new – or if there is a change in regulation. This is focused more towards adequately addressing regulatory requirements which start from the policy development. policy is not just a guidance it needs to be adhered to or an approved exception needs to be in place

    Source: Adapted from community discussion — jseeker

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 111. 1449 questions available.