CRISC practice questions 1,221–1,230

1. Question 1221 · 1449 in bank

   The risk associated with a high-risk vulnerability in an application is owned by the:

   • Asecurity department.
   • Bvendor.
   • Cbusiness unit.
   • DIT department.

   Show answer

   Answer: C

   Explanation

   Sorry 'C', reason: The IT department is responsible for managing and securing the technology infrastructure of an organization, but ultimately, it is the business unit that owns and operates the applications that run on that infrastructure. Therefore, the business unit is responsible for managing the risks associated with the applications they use. When a high-risk vulnerability is identified in an application, it is the responsibility of the business unit to assess the potential impact of the vulnerability on their operations, customers, and overall business objectives. Based on this assessment, the business unit should prioritize and allocate resources to remediate the vulnerability. The IT department can support the business unit in identifying and remediating vulnerabilities, but they do not have the knowledge or expertise to determine the business impact of a vulnerability. Therefore, the business unit must take ownership of the risk associated with the vulnerability and determine the appropriate course of action.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 1222 · 1449 in bank

   Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?

   • ATrends in IT resource usage.
   • BIncreased resource availability.
   • CTrends in IT maintenance costs.
   • DIncreased number of incidents.

   Show answer

   Answer: A

   Next question

3. Question 1223 · 1449 in bank

   The PRIMARY goal of a risk management program is to:

   • Afacilitate resource availability.
   • Bsafeguard corporate assets.
   • Chelp ensure objectives are met.
   • Dhelp prevent operational losses.

   Show answer

   Answer: C

   Explanation

   C: Correct answer Risk management’s primary goal is to ensure an organization maintains the ability to achieve its objectives. Protecting IT assets is one possible goal as well as ensuring infrastructure and systems availability. However, these should be put in the perspective of achieving an organization’s objectives. Preventive controls are not always possible or necessary. Risk management will address issues with an appropriate mix of preventive and corrective controls.

   Source: Adapted from community discussion — Ceecil1959

   Next question

4. Question 1224 · 1449 in bank

   Select 3

   What are the requirements for creating risk scenarios? Each correct answer represents a part of the solution. (Choose three.)

   • ADetermination of cause and effect
   • BDetermination of the value of business process at risk
   • CPotential threats and vulnerabilities that could cause loss
   • DDetermination of the value of an asset

   Show answer

   Answer: ABC

   Explanation

   Creating a scenario requires determination of the value of an asset or a business process at risk and the potential threats and vulnerabilities that could cause loss. The risk scenario should be assessed for relevance and realism, and then entered into the risk register if found to be relevant. In practice following steps are involved in risk scenario development: ✑ First determine manageable set of scenarios, which include: - Frequently occurring scenarios in the industry or product area. - Scenarios representing threat sources that are increasing in count or severity level. - Scenarios involving legal and regulatory requirements applicable to the business. ✑ After determining manageable risk scenarios, perform a validation against the business objectives of the entity. ✑ Based on this validation, refine the selected scenarios and then detail them to a level in line with the criticality of the entity. ✑ Lower down the number of scenarios to a manageable set. Manageable does not signify a fixed number, but should be in line with the overall importance and criticality of the unit. ✑ Risk factors kept in a register so that they can be reevaluated in the next iteration and included for detailed analysis if they have become relevant at that time. ✑ Risk factors kept in a register so that they can be reevaluated in the next iteration and included for detailed analysis if they have become relevant at that time. ✑ Include an unspecified event in the scenarios, that is, address an incident not covered by other scenarios. Incorrect Answers: A: Cause-and-effect analysis is a predictive or diagnostic analytical tool used to explore the root causes or factors that contribute to positive or negative effects or outcomes. It is used during the process of exposing risk factors.

   Next question

5. Question 1225 · 1449 in bank

   An organization's chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner's BEST course of action is to:

   • Avalidate the CTO's decision wish the business process owner.
   • Brecommend that the CTO revisit the risk acceptance decision.
   • Cidentify key risk indicators (KRIs) for ongoing monitoring.
   • Dupdate the risk register with the selected risk response.

   Show answer

   Answer: A

   Next question

6. Question 1226 · 1449 in bank

   The BEST metric to monitor the risk associated with changes deployed to production is the percentage of:

   • Achanges not requiring user acceptance testing.
   • Bchanges that cause incidents.
   • Cchanges due to emergencies.
   • Dpersonnel that have rights to make changes in production.

   Show answer

   Answer: B

   Explanation

   Monitoring the percentage of changes that cause incidents (option B) is the best metric among the given choices to assess the risk associated with changes deployed to production. This is because it directly measures the impact of changes on system stability, performance, and user experience. When incidents are caused by changes, it could indicate that the change management process is not effective, and there may be a higher risk of production issues.

   Source: Adapted from community discussion — Broesweelies

   Next question

7. Question 1227 · 1449 in bank

   A global organization is planning to collect customer behavior data through social media advertising. Which of the following is the MOST important business risk to be considered?

   • ARegulatory requirements may differ in each country.
   • BBusiness advertising will need to be tailored by country.
   • CThe data analysis may be ineffective in achieving objectives.
   • DData sampling may be impacted by various industry restrictions.

   Show answer

   Answer: A

   Next question

8. Question 1228 · 1449 in bank

   Which of the following should be the PRIMARY objective of a risk awareness training program?

   • ATo promote awareness of the risk governance function.
   • BTo clarify fundamental risk management principles.
   • CTo enable risk-based decision making.
   • DTo ensure sufficient resources are available.

   Show answer

   Answer: A

   Explanation

   A is correct. Governance includes policy, procedures, standards. It also covers decision making (c), so I think A is a better answer than C.

   Source: Adapted from community discussion — Anon530

   Next question

9. Question 1229 · 1449 in bank

   Which of the following is MOST important for evaluating the operational effectiveness of a newly implemented control?

   • AContinuous auditing techniques are used to ensure ongoing control monitoring.
   • BControl owners are conducting timely monitoring and reporting of the control results.
   • CThe source data used for control performance is accurate and complete.
   • DSelf-assessment testing results are regularly verified by independent control testes.

   Show answer

   Answer: C

   Explanation

   C. The source data used for control performance is accurate and complete. The reason this is the most important aspect for evaluating the operational effectiveness of a newly implemented control is that the accuracy and completeness of the source data are the foundation for determining control performance. If the source data is inaccurate or incomplete, the results of control monitoring and testing will be unreliable, making it difficult to assess the true effectiveness of the control.

   Source: Adapted from community discussion — Broesweelies

   Next question

10. Question 1230 · 1449 in bank

    An organization must implement changes as the result of new regulations. Which of the following should the risk practitioner do FIRST to prepare for these changes?

    • AEngage the legal department.
    • BConduct a gap analysis.
    • CImplement compensating controls.
    • DReview the risk profile.

    Show answer

    Answer: B

    Explanation

    Because the first step is to assess the existing controls satisfy the requirements or additional action is required. To do that gap analysis is required

    Source: Adapted from community discussion — Tsuresh

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1221. 1449 questions available.