Question 1291 · 1449 in bank
An organization planning to transfer and store its customer data with an offshore cloud service provider should be PRIMARILY concerned with:
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
An organization planning to transfer and store its customer data with an offshore cloud service provider should be PRIMARILY concerned with:
Answer: B
Which of the following BEST measures the impact of business interruptions caused by an IT service outage?
Answer: C
C in my opinion: While the duration of service outage (option A), cost of remediation efforts (option B), and average time to recovery (option D) are important metrics for measuring the impact of IT service outages, they do not capture the full extent of the business impact of such outages. Sustained financial loss is a more comprehensive measure as it takes into account the direct and indirect costs incurred as a result of the outage, including lost revenue, missed business opportunities, and reputational damage. This metric helps organizations to understand the true cost of an IT service outage and to prioritize efforts to minimize the risk of future outages.
Source: Adapted from community discussion — Koulyo
An organization automatically approves exceptions to security policies on a recurring basis. This practice is MOST likely the result of:
Answer: B
Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?
Answer: C
C. Qualitative measures are better able to incorporate expert judgment. Qualitative measures allow for the incorporation of expert judgment, which is particularly important when dealing with emerging threats that may not have quantifiable data available. Experts can provide insight and context that help assess the potential impact and likelihood of such threats, making qualitative measures more suitable in these cases.
Source: Adapted from community discussion — Broesweelies
When reporting on the performance of an organization's control environment, including which of the following would BEST inform stakeholders' risk decision- making?
Answer: A
When reporting on the performance of an organization's control environment, it is important to provide stakeholders with a clear picture of the effectiveness of the controls in managing risks. A report of deficiencies noted during controls testing is an important component of this reporting as it identifies areas where the controls are weak or ineffective.
Source: Adapted from community discussion — john_boogieman
Which of the following should be the MOST important consideration for senior management when developing a risk response strategy?
Answer: A
Should the answer be B - Cost of Controls The similar type question has answer Cost of Controls Question #662Topic 1 Which of the following should be the HIGHEST priority when developing a risk response? • A. The risk response is accounted for in the budget. • B. The risk response aligns with the organization's risk appetite. • C. The risk response is based on a cost-benefit analysis. • D. The risk response addresses the risk with a holistic view. Correct Answer: C
Source: Adapted from community discussion — Ramye
Which of the following is the GREATEST benefit when enterprise risk management (ERM) provides oversight of IT risk management?
Answer: D
I agree, the key purpose of ERM is consistency throughout the org to align with future goals, so marrying short and long term goals would be the best answer here.
Source: Adapted from community discussion — boyladdudeman
Which of the following is the MOST effective control to maintain the integrity of system configuration files?
Answer: D
The most effective control to maintain the integrity of system configuration files is to implement file integrity monitoring (FIM). FIM is a security control that monitors the integrity of files and alerts administrators when any changes are made to critical system files.
Source: Adapted from community discussion — john_boogieman
An IT risk practitioner has been asked to regularly report on the overall status and effectiveness of the IT risk management program. Which of the following is MOST useful for this purpose?
Answer: B
From the self-assessment questions (7th CRISC manual, chapter 3), 'a scorecard allows management to measure strategy implementation and assist management in translating it into action'.
Source: Adapted from community discussion — john_boogieman
Which of the following is the STRONGEST indication an organization has ethics management issues?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1291. 1449 questions available.
Version 1.0.0. How we source questions