CRISC practice questions 1,261–1,270

1. Question 1261 · 1449 in bank

   Which of the following is the GREATEST benefit of updating the risk register to include outcomes from a risk assessment?

   • AIt facilitates timely risk-based decisions.
   • BIt helps to mitigate internal and external risk factors.
   • CIt validates the organization's risk appetite.
   • DIt maintains evidence of compliance with risk policy.

   Show answer

   Answer: A

   Next question

2. Question 1262 · 1449 in bank

   A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

   • AThe alternative site does not reside on the same fault no matter how far the distance apart.
   • BThe contingency plan provides for backup media to be taken to the alternative site.
   • CThe contingency plan for high priority applications does not involve a shared cold site.
   • DThe alternative site is a hot site with equipment ready to resume processing immediately.

   Show answer

   Answer: A

   Explanation

   Strangely, even if they are valid, I don't see many answers supported by an explanation. In any case, it is evident that in this scenario the most important consideration is to establish the alternative site away from the risk to which the main site is exposed.

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 1263 · 1449 in bank

   Which of the following provides the MOST important information to facilitate a risk response decision?

   • ARisk appetite.
   • BIndustry best practices.
   • CKey risk indicators.
   • DAudit findings.

   Show answer

   Answer: A

   Explanation

   KRI comes in Risk and Control Monitoring and reporting phase. While Risk response decisions are done on Risk response and mitigation phase which comes before monitoring. The correct answer is A.Risk appetite because KRI are not defined yet when taking risk response decisions.

   Source: Adapted from community discussion — hussmohsin

   Next question

4. Question 1264 · 1449 in bank

   Which of the following BEST contributes to the implementation of an effective risk response action plan?

   • AA business impact analysis.
   • BAn IT tactical plan.
   • CDisaster recovery and continuity testing.
   • DAssigned roles and responsibilities.

   Show answer

   Answer: D

   Explanation

   Support D , assigning roles and responsibility . BIA is take place while taking decision on risk response, it not have role in implementation.

   Source: Adapted from community discussion — Raj1510

   Next question

5. Question 1265 · 1449 in bank

   Implementing which of the following controls would BEST reduce the impact of a vulnerability that has been exploited?

   • APreventive control
   • BDeterrent control
   • CCorrective control
   • DDetective control

   Show answer

   Answer: C

   Explanation

   It is C, given is correct. has been exploited. It is exploited already, so it is corrective. Not Detective. As it has already happen, not detect.

   Source: Adapted from community discussion — tsangckl

   Next question

6. Question 1266 · 1449 in bank

   You are a project manager for your organization and you're working with four of your key stakeholders. One of the stakeholders is confused as to why you're not discussing the current problem in the project during the risk identification meeting. Which one of the following statements best addresses when a project risk actually happens?

   • AProject risks are uncertain as to when they will happen.
   • BRisks can happen at any time in the project.
   • CProject risks are always in the future.
   • DRisk triggers are warning signs of when the risks will happen.

   Show answer

   Answer: C

   Explanation

   According to the PMBOK, a project risk is always in the future. If the risk event has already happened, then it is an issue, not a risk. Incorrect Answers: A: You can identify risks before they occur and not after their occurrence. B: Risks can only happen in the future. D: Triggers are warning signs and conditions of risk events, but this answer isn't the best choice for this question.

   Source: Adapted from community discussion — Joloms

   Next question

7. Question 1267 · 1449 in bank

   Which of the following is the MOST important reason to test new controls?

   • ATo verify controls work as intended.
   • BTo justify the cost of control investment.
   • CTo identify exceptions that elevate risk.
   • DTo ensure an accurate and up-to-date controls register.

   Show answer

   Answer: A

   Next question

8. Question 1268 · 1449 in bank

   A new international data privacy regulation requires personal data to be disposed after the specified retention period, which is different from the local regulatory requirement. Which of the following is the risk practitioner's BEST recommendation to resolve the disparity?

   • AAdopt the international standard.
   • BAdopt the standard determined by legal counsel.
   • CAdopt the local standard.
   • DAdopt the least stringent standard determined by the risk committee.

   Show answer

   Answer: B

   Next question

9. Question 1269 · 1449 in bank

   Which of the following should be the MAIN consideration when validating an organization's risk appetite?

   • ACost of risk mitigation options.
   • BMaturity of the risk culture.
   • CCapacity to withstand loss.
   • DComparison against regulations.

   Show answer

   Answer: C

   Next question

10. Question 1270 · 1449 in bank

    Which of the following would MOST likely result in updates to an IT risk profile?

    • AChanges in senior management.
    • BEstablishment of a risk committee.
    • CExternal audit findings.
    • DFeedback from focus groups.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1261. 1449 questions available.