CRISC practice questions 191–200

1. Question 191 · 1449 in bank

   An organization wants to launch a campaign to advertise a new product. Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST concern to the risk practitioner?

   • APurpose limitation
   • BData minimization
   • CAccuracy
   • DAccountability

   Show answer

   Answer: B

   Explanation

   It seems clear that in the proposed scenario the purpose of the treatment is limited, so the main concern derived from data analytics is minimization.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 192 · 1449 in bank

   Thomas is a key stakeholder in your project. Thomas has requested several changes to the project scope for the project you are managing. Upon review of the proposed changes, you have discovered that these new requirements are laden with risks and you recommend to the change control board that the changes be excluded from the project scope. The change control board agrees with you. What component of the change control system communicates the approval or denial of a proposed change request?

   • AConfiguration management system
   • BIntegrated change control
   • CChange log
   • DScope change control system

   Show answer

   Answer: B

   Next question

3. Question 193 · 1449 in bank

   What is the BEST information to present to business risk owners when justifying costs related to controls?

   • ACompliance with security policy
   • BThe previous year's budget and actuals
   • CIndustry benchmarks
   • DLoss event frequency and magnitude

   Show answer

   Answer: D

   Next question

4. Question 194 · 1449 in bank

   An organization has outsourced a critical process involving highly regulated data to a third party with servers located in a foreign country. Who is accountable for the confidentiality of this data?

   • ARegional office executive
   • BData owner
   • CData custodian
   • DThird-party data custodian

   Show answer

   Answer: B

   Next question

5. Question 195 · 1449 in bank

   Which of the following is a risk practitioner's BEST course of action if a risk assessment identifies a risk that is extremely unlikely but would have a severe impact should it occur?

   • AAddress the risk by analyzing treatment options.
   • BRate the risk as high priority based on the severe impact.
   • CIgnore the risk due to the extremely low likelihood.
   • DObtain management's consent to accept the risk.

   Show answer

   Answer: A

   Next question

6. Question 196 · 1449 in bank

   Which of the following is MOST important for senior management to review during an acquisition?

   • AKey risk indicator (KRI) thresholds
   • BRisk framework and methodology
   • CRisk communication plan
   • DRisk appetite and tolerance

   Show answer

   Answer: D

   Explanation

   Understanding the risk appetite and tolerance of the organization being acquired is critical to ensure that the risks associated with the acquisition are aligned with the risk tolerance of the acquiring organization. This will help to ensure that the risks are effectively managed and that the acquisition does not result in undue risk exposure for the organization.

   Source: Adapted from community discussion — john_boogieman

   Next question

7. Question 197 · 1449 in bank

   Which of the following is MOST likely to be impacted when a global organization is required by law to implement a new data protection regulation across its operations?

   • ARisk ownership assignments
   • BThreat profile
   • CVulnerability assessment results
   • DRisk profile

   Show answer

   Answer: D

   Next question

8. Question 198 · 1449 in bank

   Which of the following is the PRIMARY reason to conduct risk assessments at periodic intervals?

   • ATo promote a risk-aware culture among staff
   • BTo ensure emerging risk is identified and monitored
   • CTo ensure risk trend data is collected and reported
   • DTo establish the maturity level of risk assessment processes

   Show answer

   Answer: B

   Next question

9. Question 199 · 1449 in bank

   A risk practitioner is utilizing a risk heat map during a risk assessment. Risk events that are coded with the same color will have a similar:

   • Arisk response.
   • Brisk impact.
   • Crisk likelihood.
   • Drisk score.

   Show answer

   Answer: D

   Next question

10. Question 200 · 1449 in bank

    Which of the following is the BEST way to ensure controls are maintained consistently across the environment?

    • APerforming a gap analysis on process deviations
    • BConducting annual control assessments
    • CMonitoring key risk indicators (KRIs)
    • DTraining operational staff on risk control procedures

    Show answer

    Answer: B

    Explanation

    Conducting annual control assessments is the BEST way to ensure controls are maintained consistently across the environment. Annual control assessments allow for a comprehensive review of all controls, ensuring that they are being applied consistently across the environment. This helps to identify any gaps or inconsistencies in the control environment, which can then be addressed through remediation efforts. Monitoring key risk indicators (KRIs) can be a valuable tool to help identify when controls may be failing, but it is not a substitute for a comprehensive control assessment.

    Source: Adapted from community discussion — john_boogieman

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 191. 1449 questions available.