CRISC practice questions 1,281–1,290

1. Question 1281 · 1449 in bank

   Which of the following is the MOST important consideration when identifying stakeholders to review risk scenarios developed by a risk analyst? The reviewers are:

   • Aauthorized to select risk mitigation options.
   • Bindependent from the business operations.
   • Caccountable for the affected processes.
   • Dmembers of senior management.

   Show answer

   Answer: C

   Explanation

   Because the question is about stakeholder review, they should be independent from the business operations "Watching a process as an independent observer may highlight issues that are unable to be seen as clearly when in the middle of daily operations and help to identify situations in which documented processes are not being followed." Please let me know your comments with explanation.

   Source: Adapted from community discussion — maheshexam

   Next question

2. Question 1282 · 1449 in bank

   Which of the following is the MOST important technology control to reduce the likelihood of fraudulent payments committed internally?

   • ADaily transaction reconciliation
   • BRole-based user access model
   • CRule-based data analytics
   • DAutomated access revocation

   Show answer

   Answer: B

   Explanation

   The probability of making fraudulent payments can be reduced by establishing mechanisms for the segregation of duties, or within the options proposed, with RBAC.

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 1283 · 1449 in bank

   Which of the following tasks should be completed prior to creating a disaster recovery plan (DRP)?

   • AProcuring a recovery site
   • BConducting a business impact analysis (BIA)
   • CAssigning sensitivity levels to data
   • DIdentifying the recovery response team

   Show answer

   Answer: B

   Explanation

   B is correct, initial phase is to conduct the risk assessment and business impact analysis to understand the critical processes and assets of the organization.

   Source: Adapted from community discussion — boyladdudeman

   Next question

4. Question 1284 · 1449 in bank

   Which of the following should be the FIRST consideration when a business unit wants to use personal information for a purpose other than for which it was originally collected?

   • AInformed consent
   • BData breach protection
   • CCross border controls
   • DBusiness impact analysis (BIA)

   Show answer

   Answer: A

   Next question

5. Question 1285 · 1449 in bank

   Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?

   • ATo raise awareness of operational issues
   • BTo identify control vulnerabilities
   • CTo measure business exposure to risk
   • DTo monitor the achievement of set objectives

   Show answer

   Answer: D

   Next question

6. Question 1286 · 1449 in bank

   Which of the following BEST indicates whether security awareness training is effective?

   • ACourse evaluation
   • BUser behavior after training
   • CUser self-assessment
   • DQuality of training materials

   Show answer

   Answer: B

   Next question

7. Question 1287 · 1449 in bank

   A service provider is managing a client's servers. During an audit of the service, a noncompliant control is discovered that will not be resolved before the next audit because the client cannot afford the downtime required to correct the issue. The service provider's MOST appropriate action would be to:

   • Adevelop a risk remediation plan overriding the client's decision.
   • Bask the client to document the formal risk acceptance for the provider.
   • Cinsist that the remediation occur for the benefit of other customers.
   • Dmake a note for this item in the next audit explaining the situation.

   Show answer

   Answer: B

   Next question

8. Question 1288 · 1449 in bank

   Which of the following should be done FIRST when developing a data protection management plan?

   • AIdentify critical data.
   • BConduct a risk analysis.
   • CPerform a cost-benefit analysis.
   • DEstablish a data inventory.

   Show answer

   Answer: D

   Explanation

   From another question in CRISC exam study guide: Question. What is the first step in establishing the controls related to privacy laws and regulations? Answer: data inventory and classification First and most important aspect is to identify the privacy-related data within organization. This can be achieved by preparing data inventory and classification. Other options are secondary aspects.

   Source: Adapted from community discussion — boyladdudeman

   Next question

9. Question 1289 · 1449 in bank

   An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses. What should be done NEXT in response to this report?

   • AConduct a follow-up audit to verify the provider's control weaknesses.
   • BReview the contract to determine if penalties should be levied against the provider.
   • CAnalyze the impact of the provider's control weaknesses to the business.
   • DMigrate all data to another compliant service provider.

   Show answer

   Answer: C

   Next question

10. Question 1290 · 1449 in bank

    The MOST important reason for implementing change control procedures is to ensure:

    • Aan audit trail exists.
    • Btimely evaluation of change events.
    • Cthat emergency changes are logged.
    • Donly approved changes are implemented.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1281. 1449 questions available.