CRISC practice questions 1,271–1,280

1. Question 1271 · 1449 in bank

   A risk practitioner notices a risk scenario associated with data loss at the organization's cloud provider is assigned to the provider. Who should the risk scenario be reassigned to?

   • AChief risk officer
   • BVendor manager
   • CData owner
   • DSenior management

   Show answer

   Answer: C

   Explanation

   C. Data owner The risk scenario should be reassigned to the data owner, as they are responsible for ensuring the proper handling, protection, and overall management of the data. While the cloud provider plays a role in securing and maintaining the data, the ultimate responsibility for managing the risk associated with data loss lies with the data owner.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 1272 · 1449 in bank

   Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?

   • AInformation security director
   • BInternal audit director
   • CChief information officer
   • DChief financial officer

   Show answer

   Answer: C

   Explanation

   Although 'coordination' is inaccurate, IT governance falls to the C-level (CIO), who is in charge of ensuring that IT supports the objectives of the organization. This responsibility is not the CISO's (chief information security officer).

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 1273 · 1449 in bank

   Which of the following is MOST important for an organization that wants to reduce IT operational risk?

   • ADecentralizing IT infrastructure.
   • BIncreasing the frequency of data backups.
   • CIncreasing senior management's understanding of IT operations.
   • DMinimizing complexity of IT infrastructure.

   Show answer

   Answer: D

   Next question

4. Question 1274 · 1449 in bank

   The MAIN goal of the risk analysis process is to determine the:

   • Apotential severity of impact.
   • Bcontrol deficiencies.
   • Cfrequency and magnitude of loss.
   • Dthreats and vulnerabilities.

   Show answer

   Answer: C

   Explanation

   Risk analysis according to ISACA, includes assessment of consequences, assessment of incident likelihoods, determination of level of risk; risk identification includes the identification of assets, threats, vulnerabilities, existing controls and consequences (page 53, CRISC review manual, 7th edition)

   Source: Adapted from community discussion — jseeker

   Next question

5. Question 1275 · 1449 in bank

   An IT organization is replacing the customer relationship management (CRM) system. Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?

   • AChief risk officer (CRO)
   • BIT controls manager
   • CChief information security officer (CISO)
   • DBusiness process owner

   Show answer

   Answer: D

   Next question

6. Question 1276 · 1449 in bank

   An organization has identified that terminated employee accounts are not disabled or deleted within the time required by corporate policy. Unsure of the reason, the organization has decided to monitor the situation for three months to obtain more information. As a result of this decision, the risk has been:

   • Aaccepted.
   • Btransferred.
   • Cavoided.
   • Dmitigated.

   Show answer

   Answer: A

   Next question

7. Question 1277 · 1449 in bank

   Which of the following is the BEST key performance indicator (KPI) for determining how well an IT policy is aligned to business requirements?

   • ATotal cost of policy breaches.
   • BTotal cost to support the policy.
   • CNumber of exceptions to the policy.
   • DNumber of inquiries regarding the policy.

   Show answer

   Answer: C

   Next question

8. Question 1278 · 1449 in bank

   The PRIMARY purpose of a maturity model is to compare the:

   • Acurrent state of key processes to their desired state.
   • Borganization to peers.
   • Corganization to industry best practices.
   • Dactual KPIs with target KPIs.

   Show answer

   Answer: A

   Next question

9. Question 1279 · 1449 in bank

   Which of the following is the MAIN reason for analyzing risk scenarios?

   • AEstablishing a risk appetite
   • BIdentifying additional risk scenarios
   • CUpdating the heat map
   • DAssessing loss expectancy

   Show answer

   Answer: D

   Explanation

   so the MAIN reason for analyzing risk scenarios is to identify more risk scenarios, this sounds like infinite loop to me.

   Source: Adapted from community discussion — hussmohsin

   References

   • isaca.org documentation

   Next question

10. Question 1280 · 1449 in bank

    Which of the following would be the BEST justification to invest in the development of a governance, risk, and compliance (GRC) solution?

    • AFacilitating risk-aware decision making by stakeholders.
    • BDemonstrating management commitment to mitigate risk.
    • CClosing audit findings on a timely basis.
    • DEnsuring compliance to industry standards.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1271. 1449 questions available.