Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
The BEST way to obtain senior management support for investment in a control implementation would be to articulate the reduction in:
Answer: D
Inherent risk exists regardless of the application of controls, and is always present. Only the residual risk can be reduced.
Source: Adapted from community discussion — john_boogieman
Which of the following is the BEST way to manage the risk associated with malicious activities performed by database administrators (DBAs)?
Answer: A
Which of the following should be implemented to BEST mitigate the risk associated with infrastructure updates?
Answer: B
Answer should be B. Change control process Every chance/update including infrastructure update should / must follow the established change management process.
Source: Adapted from community discussion — Ramye
Which of the following methods is an example of risk mitigation?
Answer: C
Which of the following is the MOST important objective of establishing an enterprise risk management (ERM) function within an organization?
Answer: C
Organizations can benefit by shifting the corporate culture from one that focuses on meeting IT compliance obligations to one that targets overall risk reduction. Visibility into the overall security of the organization plays an important role in establishing this new dialogue. Reducing enterprise risk and developing a common risk management language requires an organization to: therefore the answer should be C
Source: Adapted from community discussion — Tomm8125
Several newly identified risk scenarios are being integrated into an organization's risk register. The MOST appropriate risk owner would be the individual who:
Answer: A
An organization practices the principle of least privilege. To ensure access remains appropriate, application owners should be required to review user access rights on a regular basis by obtaining:
Answer: C
It is more efficient to have a matrix that defines the access permissions and their associated actions and their approval by the user manager. In any case, this process is not called 'attestation' as mentioned here. https://www.isaca.org/resources/glossary#Attestation
Source: Adapted from community discussion — john_boogieman
Which of the following is the PRIMARY reason for monitoring activities performed in a production database environment?
Answer: B
I would like to correct here my previous comment. Monitoring cannot enforce as such. either it can detect or deterring control. So B is right
Source: Adapted from community discussion — Raj1510
Which of the following is MOST important to the integrity of a security log?
Answer: C
Which of the following provides the MOST useful information to determine risk exposure following control implementations?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1301. 1449 questions available.
Version 1.0.0. How we source questions