CRISC practice questions 181–190

1. Question 181 · 1449 in bank

   Which of the following is MOST important for a risk practitioner to include in a report for senior management on the risk related to the adoption of cloud computing?

   • ACompliance with existing security controls
   • BResults of a cost-benefit analysis
   • CComparison with competitive risk benchmarks
   • DAlignment with organizational risk appetite

   Show answer

   Answer: D

   Next question

2. Question 182 · 1449 in bank

   Which of the following BEST measures the operational effectiveness of risk management capabilities?

   • ACapability maturity models (CMMs)
   • BMetric thresholds
   • CKey risk indicators (KRIs)
   • DKey performance indicators (KPIs)

   Show answer

   Answer: D

   Next question

3. Question 183 · 1449 in bank

   Which of the following is the PRIMARY risk management responsibility of the third line of defense?

   • AProviding assurance of the effectiveness of risk management activities
   • BProviding advisory services on enterprise risk management
   • CProviding benchmarking on other organizations' risk management programs
   • DProviding guidance on the design of effective controls

   Show answer

   Answer: A

   Next question

4. Question 184 · 1449 in bank

   Which of the following should be the PRIMARY concern when changes to firewall rules do not follow change management requirements?

   • AInaccurate documentation
   • BPotential business impact
   • CPotential audit findings
   • DInsufficient risk governance

   Show answer

   Answer: B

   Next question

5. Question 185 · 1449 in bank

   Which of the following will provide the BEST measure of compliance with IT policies?

   • AEvaluate past policy review reports.
   • BTest staff on their compliance responsibilities.
   • CPerform penetration testing.
   • DConduct regular independent reviews.

   Show answer

   Answer: D

   Next question

6. Question 186 · 1449 in bank

   A risk assessment has identified concerns about vulnerabilities associated with an Internet-facing application. Which of the following is the risk practitioner's BEST recommendation?

   • AReview the configurations.
   • BVerify the access controls.
   • CPerform a penetration test.
   • DDetermine compensating controls.

   Show answer

   Answer: C

   Explanation

   If a risk assessment has identified concerns about vulnerabilities associated with an Internet-facing application, the BEST recommendation for a risk practitioner would be to perform a penetration test.

   Source: Adapted from community discussion — john_boogieman

   Next question

7. Question 187 · 1449 in bank

   Which of the following is the PRIMARY objective of engaging key stakeholders in the IT risk assessment process?

   • AIncreasing the quality of analysis
   • BEnsuring proper budget allocation for risk remediation
   • CBuilding a risk aware culture
   • DReducing the time required for risk analysis

   Show answer

   Answer: C

   Next question

8. Question 188 · 1449 in bank

   Select 3

   Which of the following guidelines should be followed for effective risk management? Each correct answer represents a complete solution. (Choose three.)

   • APromote and support consistent performance in risk management
   • BPromote fair and open communication
   • CFocus on enterprise's objective
   • DBalance the costs and benefits of managing risk

   Show answer

   Answer: BCD

   Next question

9. Question 189 · 1449 in bank

   Which of the following would be of GREATEST concern to a risk practitioner following an annual review of the risk monitoring process?

   • AThere is a lack of reporting when a key risk indicator (KRI) exceeds its thresholds.
   • BThe list of stakeholders for alert notifications is outdated.
   • CThere is a significant number of manual risk monitoring processes.
   • DThe frequency of reporting to management is misaligned with corporate standards.

   Show answer

   Answer: A

   Explanation

   A lack of reporting when a key risk indicator (KRI) exceeds its thresholds would be of greater concern to a risk practitioner following an annual review of the risk monitoring process. KRIs are used to track and monitor the performance of risk management activities and to provide early warning of potential risk events. If KRIs exceed their thresholds, it is important that they are reported to management so that they can take appropriate action to mitigate the risk. Failure to report such incidents in a timely manner can result in increased risk exposure and the potential for negative impacts to the organization. The frequency of reporting to management may be important, but it would not be as significant a concern as a lack of reporting of key risk events.

   Source: Adapted from community discussion — john_boogieman

   Next question

10. Question 190 · 1449 in bank

    Select 3

    According to the Section-302 of the Sarbanes-Oxley Act of 2002, what does certification of reports implies? Each correct answer represents a complete solution. (Choose three.)

    • AThe signing officer has evaluated the effectiveness of the issuer's internal controls as of a date at the time to report.
    • BThe financial statement does not contain any materially untrue or misleading information.
    • CThe signing officer has reviewed the report.
    • DThe signing officer has presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.

    Show answer

    Answer: BCD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 181. 1449 questions available.