CRISC practice questions 1,441–1,449

1. Question 1441 · 1449 in bank

   An organization wants to improve its logical access controls to address the results of the annual risk assessment. Which of the following should be done FIRST to facilitate this initiative?

   • AReview business and operational requirements.
   • BReview roles and entitlements.
   • CReview user access logs.
   • DReview prior access management approval.

   Show answer

   Answer: A

   Next question

2. Question 1442 · 1449 in bank

   Which of the following is the MOST important outcome of monitoring key risk indicators (KRIs)?

   • AIncreased risk control efficiency
   • BImprovement of risk awareness
   • CIdentification of risk event root causes
   • DDevelopment of risk transfer strategies

   Show answer

   Answer: B

   Next question

3. Question 1443 · 1449 in bank

   Which of the following is the PRIMARY advantage of having a single integrated business continuity plan (BCP) rather than each business unit developing its own BCP?

   • AIt enables effective BCP maintenance and updates to reflect organizational changes.
   • BIt provides assurance of timely business process response and effectiveness.
   • CIt supports effective use of resources and provides reasonable confidence of recoverability.
   • DIt decreases the risk of downtime and operational losses in the event of a disruption.

   Show answer

   Answer: C

   Next question

4. Question 1444 · 1449 in bank

   Which of the following should a risk practitioner do FIRST to support the implementation of governance around organizational assets within an enterprise risk management (ERM) program?

   • AConduct risk assessments across the business.
   • BHire experienced and knowledgeable resources.
   • CDevelop a detailed risk profile.
   • DSchedule internal audits across the business.

   Show answer

   Answer: A

   Next question

5. Question 1445 · 1449 in bank

   Which of the following should be the PRIMARY driver for the prioritization of risk responses?

   • AResidual risk
   • BInherent risk
   • CMitigation cost
   • DRisk appetite

   Show answer

   Answer: D

   Next question

6. Question 1446 · 1449 in bank

   An organization's board of directors is concerned about recent data breaches in the news and wants to assess its exposure to similar scenarios. Which of the following is the BEST course of action?

   • AReassess the risk appetite and tolerance levels of the business.
   • BReview the organization's data retention policy and regulatory requirements.
   • CEvaluate the organization's existing data protection controls.
   • DEvaluate the sensitivity of data that the business needs to handle.

   Show answer

   Answer: C

   Next question

7. Question 1447 · 1449 in bank

   A risk practitioner is developing risk scenarios for a manufacturing organization that uses highly specialized systems to control its production process. Which of the following will BEST support management decision making that adequately addresses impacts to these systems?

   • ABottom-up approach
   • BEvent tree analysis
   • CTop-down approach
   • DControl gap analysis

   Show answer

   Answer: A

   Next question

8. Question 1448 · 1449 in bank

   Warning banners on login screens for laptops provided by an organization to its employees are an example of which type of control?

   • ACorrective
   • BDetective
   • CDeterrent
   • DPreventive

   Show answer

   Answer: C

   Next question

9. Question 1449 · 1449 in bank

   Which of the following describes the relationship between risk appetite and risk tolerance?

   • ARisk tolerance is used to determine risk appetite.
   • BRisk tolerance may exceed risk appetite.
   • CRisk appetite is completely independent of risk tolerance.
   • DRisk appetite and risk tolerance are synonymous.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 1441. 1449 questions available.