CRISC practice questions 1,421–1,430

1. Question 1421 · 1449 in bank

   Which of the following is the MOST appropriate action when a tolerance threshold is exceeded?

   • AVerify the response plan is adequate.
   • BCommunicate potential impact to decision makers.
   • CIncrease human resources to respond in the interim.
   • DResearch the root cause of similar incidents.

   Show answer

   Answer: B

   Next question

2. Question 1422 · 1449 in bank

   A risk practitioner has been asked to recommend a key performance indicator (KPI) to assess the effectiveness of a manual process to terminate user access. Which of the following is the BEST KPI to recommend?

   • APercent increase in number of access termination requests
   • BTimeframe of notification from business management to IT
   • CTimeframe from user termination to access revocation
   • DRatio of successful log-in attempts to unsuccessful log-in attempts

   Show answer

   Answer: C

   Next question

3. Question 1423 · 1449 in bank

   Which of the following would BEST help to address the risk associated with malicious outsiders modifying application data?

   • ARole-based access controls
   • BMulti-factor authentication
   • CActivation of control audits
   • DAcceptable use policies

   Show answer

   Answer: B

   Next question

4. Question 1424 · 1449 in bank

   Which of the following issues found during the review of a newly created disaster recovery plan (DRP) should be of MOST concern?

   • AThe chief information security officer (CISO) has not approved the plan.
   • BSeveral recovery activities will be outsourced.
   • CSome critical business applications are not included in the plan.
   • DThe plan is not based on an internationally recognized framework.

   Show answer

   Answer: C

   Next question

5. Question 1425 · 1449 in bank

   A key risk indicator (KRI) flags an exception for exceeding a threshold but remains within risk appetite. Which of the following should be done NEXT?

   • AAdjust the risk threshold level to match risk appetite.
   • BReview the risk appetite level to ensure it is appropriate.
   • CReview the trend to determine whether action is needed.
   • DDocument that the KRI is within risk appetite.

   Show answer

   Answer: C

   Next question

6. Question 1426 · 1449 in bank

   An organization's capability to implement a risk management framework is PRIMARILY influenced by the:

   • Aguidance of the risk practitioner
   • Bapproval of senior management
   • Ccompetence of the staff involved
   • Dmaturity of its risk culture

   Show answer

   Answer: D

   Next question

7. Question 1427 · 1449 in bank

   An organization is concerned that its employees may be unintentionally disclosing data through the use of social media sites. Which of the following will MOST effectively mitigate this risk?

   • AConducting user awareness training
   • BRequiring employee agreement of the acceptable use policy
   • CEstablishing a data classification policy
   • DRequiring the use of virtual private networks (VPNs)

   Show answer

   Answer: A

   Next question

8. Question 1428 · 1449 in bank

   Which of the following contributes MOST to the effective implementation of risk responses?

   • AClear understanding of the risk.
   • BDetailed standards and procedures.
   • CComparable industry risk trends.
   • DAppropriate resources.

   Show answer

   Answer: A

   Explanation

   A: Clear understanding of risks. An organisation's policies and procedures are not attributed only to risk. So that cannot be the correct answer

   Source: Adapted from community discussion — Ceecil1959

   Next question

9. Question 1429 · 1449 in bank

   Which of the following BEST indicates the risk appetite and tolerance level for the risk associated with business interruption caused by IT system failures?

   • AIT system criticality classification
   • BMean time to recover (MTTR)
   • CIncident management service level agreement (SLA)
   • DRecovery time objective (RTO)

   Show answer

   Answer: D

   Next question

10. Question 1430 · 1449 in bank

    Which of the following activities should only be performed by the third line of defense?

    • AOperating controls for risk mitigation
    • BTesting the effectiveness and efficiency of internal controls
    • CProviding assurance on risk management processes
    • DRecommending risk treatment options

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1421. 1449 questions available.