Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the PRIMARY purpose of analyzing log data collected from systems?
Answer: A
Logs are aggregated for analysis, a detective activity. Going with A, which seems the most "detective" in nature. Incident investigation is a secondary, although equally important use of aggregated logs.
Source: Adapted from community discussion — CbtL
Which of the following BEST indicates the condition of a risk management program?
Answer: B
Why not C? There are residual risks always and sometimes you just accept the risk without taking any actions but they get logged in Risk Reguster.
Source: Adapted from community discussion — Rooks
A risk practitioner has become aware of production data being used in a test environment. Which of the following should be the practitioner's PRIMARY concern?
Answer: C
An internal audit report reveals that not all IT application databases have encryption in place. Which of the following information would be MOST important for assessing the risk impact?
Answer: B
So if you ask IT why is the database is not encrypted and they say because we don't have enough license for the encryption software .. how can you determine the impact using this piece of information? To assess the impact you should know the sensitive data that is not encrypted, so the answer is B
Source: Adapted from community discussion — hussmohsin
The PRIMARY purpose of IT control status reporting is to:
Answer: C
Which of the following is MOST important to ensure when continuously monitoring the performance of a client-facing application?
Answer: C
C. Objectives are confirmed with the business owner is the most important to ensure when continuously monitoring the performance of a client-facing application. Continuous monitoring of a client-facing application is critical to ensure that it is performing as expected and meeting business objectives. However, to ensure that the monitoring is effective, it is important to first confirm the objectives of the application with the business owner. This will help to ensure that the monitoring activities are aligned with the needs of the business and that the data being collected is relevant and useful.
Source: Adapted from community discussion — Koulyo
An organization has four different projects competing for funding to reduce overall IT risk. Which project should management defer?
Answer: C
Its correct, initial risk is high. Residual risk is high. Means even implement the control the risk is still high. Control is not useful. Also project cost is high. The project (risk) should be avoid. Defer the project.
Source: Adapted from community discussion — tsangckl
Controls should be defined during the design phase of system development because:
Answer: C
Which of the following will BEST support management reporting on risk?
Answer: A
KPI is more on determining the process meeting its intented goals n objective via performance monitoring. Thus I'm inclined towards Risk Register, coz this drives the risk awareness in an org.
Source: Adapted from community discussion — travdaman
Which of the following provides the BEST evidence that a selected risk treatment plan is effective?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1241. 1449 questions available.
Version 1.0.0. How we source questions