Question 1321 · 1449 in bank
Which of the following should be done FIRST when information is no longer required to support business objectives?
Show answer
Answer: A
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following should be done FIRST when information is no longer required to support business objectives?
Answer: A
A deficient control has been identified which could result in great harm to an organization should a low frequency threat event occur. When communicating the associated risk to senior management, the risk practitioner should explain:
Answer: C
Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators (KRIs)?
Answer: C
Many why-type questions are asked, but an opinion is not given about the answer that is considered valid. A key control indicator is intended to measure the performance of a control and whether it is operating within tolerance thresholds while maintaining risk at an acceptable level (they measure its effectiveness). The KCIs are correlated not only with the specific controls but also with the risk they are intended to mitigate. When the tolerance is broken, the KCI reveals an increasing risk exposure that will be represented in the KRIs associated with the monitored control. (7th CRISC manual 'Key Control Indicators' section).
Source: Adapted from community discussion — john_boogieman
Which of the following BEST facilitates the mitigation of identified gaps between current and desired risk environment states?
Answer: A
The MOST important objective of information security controls is to:
Answer: C
Which of the following controls BEST enables an organization to ensure a complete and accurate IT asset inventory?
Answer: C
The BEST control to ensure a complete and accurate IT asset inventory is the implementation of an automated asset discovery tool.
Source: Adapted from community discussion — john_boogieman
You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?
Answer: D
The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project. Incorrect Answers: A: The Resource Management Plan does not define risk communications. B: The Risk Management Plan defines risk identification, analysis, response, and monitoring. C: The stakeholder management strategy does not address risk communications.
Source: Adapted from community discussion — ArizonaClassics
Which of the following scenarios represents a threat?
Answer: C
C. A virus transmitted on a USB thumb drive A threat refers to a potential event or circumstance that may exploit a vulnerability and cause harm to an organization's assets or operations. In this case, a virus transmitted on a USB thumb drive represents a threat, as it has the potential to compromise the security and integrity of an organization's systems and data if it is introduced into the environment.
Source: Adapted from community discussion — Broesweelies
Which of the following is the GREATEST risk associated with an environment that lacks documentation of the architecture?
Answer: C
Which of the following will be MOST effective in uniquely identifying the originator of electronic transactions?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1321. 1449 questions available.
Version 1.0.0. How we source questions