Question 1341 · 1449 in bank
Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?
Show answer
Answer: C
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?
Answer: C
Which of the following is a KEY consideration for a risk practitioner to communicate to senior management evaluating the introduction of artificial intelligence (AI) solutions into the organization?
Answer: D
An organization has decided to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable. As a result of this decision, the risk associated with these new entries has been:
Answer: A
TBH this is the first time I heard 'deffer' as risk response strategy. If they postponed the risk response due to certain reasons they accepted the risk as it will be untreated until stakeholders are not available.
Source: Adapted from community discussion — Kozy
To communicate the risk associated with IT in business terms, which of the following MUST be defined?
Answer: C
An organization learns of a new ransomware attack affecting organizations worldwide. Which of the following should be done FIRST to reduce the likelihood of infection from the attack?
Answer: B
Which of the following is MOST important to the successful development of IT risk scenarios?
Answer: B
B is correct: Who selects these answers for people to fail the exam?. The risk scenario should be based on an identified risk. A risk scenario is developed on the basis of potential threats to the business assets. A risk practitioner can identify potential threats from the risk register.
Source: Adapted from community discussion — Ceecil1959
While reviewing an organization's monthly change management metrics, a risk practitioner notes that the number of emergency changes has increased substantially. Which of the following would be the BEST approach for the risk practitioner to take?
Answer: C
Which of the following MUST be updated to maintain an IT risk register?
Answer: C
I am guessing that D. Enterprise-wide IT risk assessment is not the correct answer because it's too specific. You don't need to do an enterprise-wide assessment to up date the risk registry. In addition, a risk registry can contain other things than "IT." That is why C is the better answer. (Note: I initially picked D as well.)
Source: Adapted from community discussion — Anon530
Which of the following is the BEST method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system?
Answer: B
Which of the following is the MOST effective control to ensure user access is maintained on a least-privilege basis?
Answer: B
Question states: ensure user access is MAINTAINED on a least-privilege basis? - surely recertification of access is the most appropriate answer here? (B).
Source: Adapted from community discussion — Cranium
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 1341. 1449 questions available.
Version 1.0.0. How we source questions