Question 151 · 1449 in bank
A vendor manager reports that a previously compliant service provider had issues with its most recent security audit. Which of the following is the MOST important course of action?
Show answer
Answer: D
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
A vendor manager reports that a previously compliant service provider had issues with its most recent security audit. Which of the following is the MOST important course of action?
Answer: D
Which of the following is a corrective control?
Answer: B
Which of the following elements of a risk register is MOST useful to share with key stakeholders to influence informed decision-making?
Answer: D
I must correct my previous answer. The mitigation plan is the element of a risk register that is most useful to share with key stakeholders to influence informed decision-making. The mitigation plan outlines the specific steps that will be taken to address each identified risk and reduce its likelihood or impact.
Source: Adapted from community discussion — john_boogieman
Which of the following elements is MOST essential when creating risk scenarios?
Answer: B
The least bad option is B. Vulnerabilities and historical risk factors are important, but those known to have an impact on the business are even more so.
Source: Adapted from community discussion — john_boogieman
When presenting risk, the BEST method to ensure that the risk is measurable against the organization's risk appetite is through the use of a:
Answer: C
What would be MOST helpful to ensuring the effective implementation of a new cybersecurity program?
Answer: C
Which of the following is MOST likely to be identified from an information systems audit report?
Answer: C
Which of the following would MOST effectively mitigate the risk of data loss when production data is being used in a testing environment?
Answer: A
If the organization needs to use realistic data for testing purposes but wants to avoid exposing sensitive information, data obfuscation may be the best option. However, if the organization needs to protect sensitive data in the testing environment from unauthorized access, theft, or tampering, database encryption may be the better option.
Source: Adapted from community discussion — john_boogieman
Which of the following MOST effectively enables senior management to communicate risk appetite?
Answer: C
Policies and procedures are an effective way to enable senior management to communicate risk appetite to the organization. Policies and procedures are formal documents that outline the expectations and requirements of an organization in terms of risk management. They provide guidance to employees on the types of risks that are acceptable and those that should be avoided. They also describe the controls and processes that are in place to manage risks and ensure compliance with regulatory requirements.
Source: Adapted from community discussion — john_boogieman
Which activity would BEST enable a risk manager to verify the scope of responsibilities for stakeholders in IT risk scenarios?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 151. 1449 questions available.
Version 1.0.0. How we source questions