Question 1311 · 1449 in bank
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cycle?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cycle?
Answer: B
Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?
Answer: A
Half-life: The time interval for reducing the occurrence of a vulnerability by half. Prevalence: Measure in the turnover rate of vulnerabilities in the Qualys “Top 10 Vulnerabilities” list during a year. The Qualys Top 10 list includes the top 10 external (Internet-facing) and top 10 internal vulnerabilities. Persistence: Total lifespan of vulnerabilities – basically how long until a vulnerability is entirely removed from a company’s systems or 100 percent remediated. Exploitation: Time interval between an exploit announcement and the first attack
Source: Adapted from community discussion — Tomm8125
Which of the following is the BEST approach when a risk practitioner has been asked by a business unit manager for special consideration during a risk assessment of a system?
Answer: C
Upon learning that the number of failed back-up attempts continually exceeds the current risk threshold, the risk practitioner should:
Answer: C
A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls. Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?
Answer: C
'A' doesn't make any sense. 'B' would be the most reasonable but it is the most rigid and does not answer the requirement for the newly created company. The policy review of the acquired company (which implies its adequacy) by the DPO is the 'least bad'.
Source: Adapted from community discussion — john_boogieman
An organization has outsourced its billing function to an external service provider. Who should own the risk of customer data leakage caused by the service provider?
Answer: B
Which of the following is the MOST important component in a risk treatment plan?
Answer: B
I go with B. Easy to understand. Risk Treatment plan is an Action plan, how to TREAT the risk. Accept? Transfer? Avoid? So who is doing it, own it, is the most important. B. Date is important. But it is the most important. If you have Date but no owner. Who is doing it? But if you have Owner with no date. Then you can go to ask the Owner. So not A. Also Not C. Justification is the same. In the plan, justification, is not help for you to do the action. If you want to know the justification, go to find the owner.
Source: Adapted from community discussion — tsangckl
Which of the following is the BEST course of action to help reduce the probability of an incident recurring?
Answer: A
A: Root cause is the process of identification of the underlying reason for an event or problem. Objective of root cause is to prevent the recurring of events by addressing the root cause. It is important to conduct a root cause to determine the factors leading to the event rather than just addressing the symptoms of the problem.
Source: Adapted from community discussion — boyladdudeman
An organization is preparing to transfer a large number of customer service representatives to the sales department. Of the following, who is responsible for mitigating the risk associated with residual system access?
Answer: C
Why not the Customer service manager, it's his department, he should be responsible for assigning access on a need to know.
Source: Adapted from community discussion — MusMus
Which of the following would BEST assist in reconstructing the sequence of events following a security incident across multiple IT systems in the organization's network?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1311. 1449 questions available.
Version 1.0.0. How we source questions