Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?
Answer: A
Choice B C&D do not prevent or reduce the risk. Choice A does not either but at the very least it goes towards eventually figuring out how to prevent that risk from materializing
Source: Adapted from community discussion — jseeker
The PRIMARY objective for requiring an independent review of an organizations IT risk management process should be to:
Answer: C
C because: An independent review of an organization's IT risk management process involves a comprehensive evaluation of the effectiveness of IT risk management practices, policies, and procedures. The objective of this review is to identify any gaps or weaknesses in the IT risk management process, as well as to evaluate the alignment of the IT risk management strategy with the organization's overall objectives.
Source: Adapted from community discussion — Koulyo
After the implementation of Internet of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?
Answer: C
C. To confirm the impact to the risk profile. The primary reason to report new risk scenarios identified after implementing IoT devices to risk owners is to confirm the impact on the risk profile. This will help risk owners understand how the new scenarios may affect the organization's overall risk exposure and make informed decisions about risk management and mitigation strategies.
Source: Adapted from community discussion — Broesweelies
Which of the following is the BEST indication of the effectiveness of a business continuity program?
Answer: A
Several network user accounts were recently created without the required management approvals. Which of the following would be the risk practitioner's BEST recommendation to address this situation?
Answer: A
Which of the following is MOST important when discussing risk within an organization?
Answer: A
A: Adopting a common risk Taxonomy. A risk taxonomy is a comprehensive, common and stable set of risk categories that are used within an organization. By providing a comprehensive set of risk categories, it encourages those involved in risk identification to consider all types of risks that could affect the organization's objectives.
Source: Adapted from community discussion — Ceecil1959
Which of the following tools is MOST helpful when mapping IT risk management outcomes to organizational objectives?
Answer: D
An organization has just started accepting credit card payments from customers via the corporate website. Which of the following is MOST likely to increase as a result of this new initiative?
Answer: D
Yes, its a new type of business, so all risk related to credit card would be applicable.Hence the overall inherent risk will increase.
Source: Adapted from community discussion — Suchib
An application runs a scheduled job that compiles financial data from multiple business systems and updates the financial reporting system. If this job runs too long, it can delay financial reporting. Which of the following is the risk practitioner's BEST recommendation?
Answer: D
Which of the following can be used to assign a monetary value to risk?
Answer: A
The ALE value tells the company that if it wants to put in controls to protect the asset (e.g. warehouse) from this threat (e.g fire), it can sensibly spend this "$ "or less per year to provide the necessary level of protection. This "$" amount calculated based on ALE= SLE*ARO. So basically ALE tells maximum amount can be expend to mitigate particular risk. Agree with A
Source: Adapted from community discussion — Raj1510
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1191. 1449 questions available.
Version 1.0.0. How we source questions