CRISC practice questions 1,231–1,240

1. Question 1231 · 1449 in bank

   What should a risk practitioner do NEXT if an ineffective key control is identified on a critical system?

   • ARevalidate the risk assessment.
   • BEscalate to senior management.
   • CPropose acceptance of the risk.
   • DConduct a gap analysis.

   Show answer

   Answer: B

   Explanation

   R2-25 states gap analysis is the best help to identify system control deficiencies. This question ends with: 'if an ineffective key control is identified on a critical system?' implying the control deficiency has already been identified - what to do next. I would say that is B escalate to Snr Management, or possibly A revalidate risk assessment to confirm the thinking before then escalating to senior management...

   Source: Adapted from community discussion — Cranium

   Next question

2. Question 1232 · 1449 in bank

   Performing a background check on a new employee candidate before hiring is an example of what type of control?

   • ACompensating
   • BPreventive
   • CDetective
   • DCorrective

   Show answer

   Answer: B

   Next question

3. Question 1233 · 1449 in bank

   An organization has introduced risk ownership to establish clear accountability for each process. To ensure effective risk ownership, it is MOST important that:

   • Arisk owners have decision-making authority.
   • Bsenior management has oversight of the process.
   • Csegregation of duties exists between risk and process owners.
   • Dprocess ownership aligns with IT system ownership.

   Show answer

   Answer: A

   Explanation

   A is the correct answer - Page 117 CRISC Manual - Each risk must be linked to an individual who accepts ownership of the risk. The risk owner is tasked with making the decision of what the best response is to the identified risk and must be at a level in the organization where he or she is authorized to make decisions on behalf of the organization and can be held accountable for those decisions.

   Source: Adapted from community discussion — Rajaji

   Next question

4. Question 1234 · 1449 in bank

   Which of the following would MOST likely require a risk practitioner to update the risk register?

   • AAn alert being reported by the security operations center.
   • BDevelopment of a project schedule for implementing a risk response.
   • CEngagement of a third party to conduct a vulnerability scan.
   • DCompletion of a project for implementing a new control.

   Show answer

   Answer: D

   Explanation

   D. Completion of a project for implementing a new control. Updating the risk register is most likely required when there is a significant change in the risk landscape, such as the completion of a project for implementing a new control. The new control may alter the likelihood or impact of existing risks, introduce new risks, or reduce existing risks.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 1235 · 1449 in bank

   A peer review of a risk assessment finds that a relevant threat community was not included. Mitigation of the risk will require substantial changes to a software application. Which of the following is the BEST course of action?

   • AAsk the business to make a budget request to remediate the problem.
   • BResearch the types of attacks the threat can present.
   • CDetermine the impact of the missing threat.
   • DBuild a business case to remediate the fix.

   Show answer

   Answer: C

   Next question

6. Question 1236 · 1449 in bank

   Which of the following is MOST important when developing key risk indicators (KRIs)?

   • AAvailability of qualitative data.
   • BAlignment with regulatory requirements.
   • CProperty set thresholds.
   • DAlignment with industry benchmarks.

   Show answer

   Answer: C

   Explanation

   CRISC Manual 2015: Risk Indicators are used to measure levels in comparison to Defined RISK THRESHOLDS and alert the organization when a risk level approaches. Not all KRIs will be related to regulator requirements, but all of it should have thresholds. So correct answer is C.

   Source: Adapted from community discussion — hussmohsin

   Next question

7. Question 1237 · 1449 in bank

   Which of the following provides the MOST up-to-date information about the effectiveness of an organization's overall IT control environment?

   • APeriodic penetration testing.
   • BKey performance indicators (KPIs).
   • CInternal audit findings.
   • DRisk heat maps.

   Show answer

   Answer: B

   Explanation

   I think the answer is A. A pen test will tell you if your controls are effective. A heat map does not tell you if your controls are effective. Most heat map I have seen is related to the initial risk assessment - nothing to do with the control effectiveness.

   Source: Adapted from community discussion — Anon530

   Next question

8. Question 1238 · 1449 in bank

   Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact?

   • ACost-benefit analysis.
   • BIncident probability.
   • CRisk magnitude.
   • DRisk appetite.

   Show answer

   Answer: B

   Explanation

   Answer is B - Risk is a product of likelihood and Impact and the question already stated the risk has significant impact, so we must consider the likelihood

   Source: Adapted from community discussion — Stefan07

   Next question

9. Question 1239 · 1449 in bank

   Which of the following would be a risk practitioner's GREATEST concern related to the monitoring of key risk indicators (KRIs)?

   • ALogs are retained for a longer duration than the data retention policy requires.
   • BLogs are encrypted during transmission from the system to analysis tools.
   • CLogs are modified before analysis is conducted.
   • DLogs are collected from a small number of systems.

   Show answer

   Answer: C

   Explanation

   If the Logs are modified before analysis is conducted then the KRIs will be wrong, even if you get logs from ALL systems in the environment it will still be useless if the logs are changed before analysis, so the only good answer here is C

   Source: Adapted from community discussion — hussmohsin

   Next question

10. Question 1240 · 1449 in bank

    The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of:

    • Anew vulnerabilities identified.
    • Brecurring vulnerabilities.
    • Cvulnerabilities remediated.
    • Dvulnerability scans.

    Show answer

    Answer: C

    Explanation

    B make most sense for effective vulnerability remediation program. Recurring vulnerability normally refer to same vulnerability found in system on next scan after remediation done or reported done. This will indicate the solution / remediation is not working or not done properly which warrant the effectiveness of remediation process. so B make more sense to me.

    Source: Adapted from community discussion — Raj1510

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1231. 1449 questions available.