CRISC practice questions 1,201–1,210

1. Question 1201 · 1449 in bank

   Which of the following would BEST help secure online financial transactions from improper users?

   • AMulti-factor authentication
   • BPeriodic review of audit trails
   • CMulti-level authorization
   • DReview of log-in attempts

   Show answer

   Answer: A

   Explanation

   Multi-level authorization alone may not be enough to fully secure online financial transactions. This is because it assumes that all users who have been authorized to access a given part of the system are trustworthy and have legitimate reasons for doing so. In reality, even authorized users can sometimes engage in fraudulent or malicious activities, whether intentionally or unintentionally. Multi-factor authentication provides an additional layer of security by verifying the identity of users before they are granted access, helping to ensure that only legitimate users are able to carry out transactions.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 1202 · 1449 in bank

   Which of the following is the BEST indication that an organization is following a mature risk management process?

   • AExecutive management receives periodic risk awareness training.
   • BAttributes of each risk scenario have been documented within the risk register.
   • CThe risk register is frequently utilized for decision-making.
   • DA dashboard has been developed for senior management to provide real-time risk values.

   Show answer

   Answer: C

   Explanation

   C. The risk register is frequently utilized for decision-making. The best indication that an organization is following a mature risk management process is that the risk register is frequently utilized for decision-making. This shows that the organization has integrated risk management into its decision-making processes and is taking a proactive approach to managing risk. Option A is an important aspect of a mature risk management process, but it alone is not a sufficient indicator. Option B is important for maintaining an accurate and up-to-date risk register, but it alone is not a sufficient indicator. Option D can be a useful tool for visualizing risk information, but it is not necessarily a sign of a mature risk management process.

   Source: Adapted from community discussion — Boubou480

   Next question

3. Question 1203 · 1449 in bank

   Which of the following BEST indicates that an organization has implemented IT performance requirements?

   • AVendor references
   • BAccountability matrix
   • CBenchmarking data
   • DService level agreements

   Show answer

   Answer: D

   Explanation

   D. Service level agreements (SLAs) are the best indicator that an organization has implemented IT performance requirements, as they clearly define the level of service that the IT department is expected to provide to the business. SLAs typically specify performance metrics, such as response times, availability, and uptime, and may also include penalties or compensation in the event that the IT department does not meet the agreed-upon performance requirements. Option A provides information about the vendor's capabilities, but it does not necessarily indicate that the organization has implemented its own performance requirements. Option B defines roles and responsibilities, but it does not necessarily indicate that specific performance requirements have been established. Option C provides information about the performance of other organizations, but it does not necessarily indicate that performance requirements have been established within the organization.

   Source: Adapted from community discussion — Boubou480

   Next question

4. Question 1204 · 1449 in bank

   Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

   • AObtain an objective view of process gaps and systemic errors.
   • BEnsure the risk profile is defined and communicated.
   • CValidate the threat management process.
   • DObtain objective assessment of the control environment.

   Show answer

   Answer: A

   Next question

5. Question 1205 · 1449 in bank

   Which of the following activities should be performed FIRST when establishing IT risk management processes?

   • AConduct a high-level risk assessment based on the nature of business.
   • BCollect data of past incidents and lessons learned.
   • CIdentify the risk appetite of the organization.
   • DAssess the goals and culture of the organization.

   Show answer

   Answer: D

   Next question

6. Question 1206 · 1449 in bank

   Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management's action plan?

   • ASurvey device owners.
   • BReview awareness training assessment results.
   • CRe-scan the user environment.
   • DRequire annual end user policy acceptance.

   Show answer

   Answer: C

   Next question

7. Question 1207 · 1449 in bank

   An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?

   • AAnalyze data protection methods.
   • BUnderstand data flows.
   • CInclude a right-to-audit clause.
   • DImplement strong access controls.

   Show answer

   Answer: B

   Next question

8. Question 1208 · 1449 in bank

   The FIRST task when developing a business continuity plan should be to:

   • Aidentify critical business functions and resources.
   • Bdetermine data backup and recovery availability at an alternate site.
   • Cdefine roles and responsibilities for implementation.
   • Didentify recovery time objectives (RTOs) for critical business applications.

   Show answer

   Answer: A

   Next question

9. Question 1209 · 1449 in bank

   Which of the following is the BEST indicator of the effectiveness of IT risk management processes?

   • ATime between when IT risk scenarios are identified and the enterprise's response.
   • BPercentage of business users completing risk training.
   • CPercentage of high-risk scenarios for which risk action plans have been developed.
   • DNumber of key risk indicators (KRIs) defined.

   Show answer

   Answer: A

   Explanation

   I stand with C. effectiveness of IT risk management processes, even the time of risk identify and response is fast. But the risk is for currently identified and make a priority. The risk response can not be decrease the risk. I pick C. As high risk is address, the total risk can be effectively address and reduce the resident risk to acceptable level.

   Source: Adapted from community discussion — tsangckl

   Next question

10. Question 1210 · 1449 in bank

    Which of the following should be a risk practitioner's NEXT step upon learning the organization is not in compliance with a specific legal regulation?

    • AAssess the likelihood and magnitude of the associated risk.
    • BIdentify mitigation activities and compensating controls.
    • CNotify senior compliance executives of the associated risk.
    • DDetermine the penalties for lack of compliance.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1201. 1449 questions available.