Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
A financial organization is considering a project to implement the use of blockchain technology. To help ensure the organization's management team can make informed decisions on the project, which of the following should the risk practitioner reassess?
Answer: D
Which of the following should be a risk practitioner's NEXT step after learning of an incident that has affected a competitor?
Answer: A
Which of the following is the PRIMARY responsibility of a risk owner?
Answer: C
Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board?
Answer: D
A risk assessment has determined that an organization is highly susceptible to a vulnerability in its IT infrastructure. Which of the following is MOST important to communicate to the board?
Answer: B
External auditors have found that management has not effectively monitored key security technologies that support regulatory objectives. Which type of indicator would BEST enable the organization to identify and correct this situation?
Answer: B
In this case, the organization is concerned with monitoring the effectiveness of key security technologies that support regulatory objectives, so the BEST type of indicator to use would be a Key Control Indicator (KCI).
Source: Adapted from community discussion — john_boogieman
An organization has outsourced its customer management database to an external service provider. Of the following, who should be accountable for ensuring customer data privacy?
Answer: A
Due to budget constraints, an organization cannot implement encryption to all databases. Which of the following is the MOST useful information to identify high- risk databases where encryption should be applied?
Answer: D
To identify high-risk databases where encryption should be applied, the most useful information would be provided by a data classification scheme. A data classification scheme helps to categorize data based on its sensitivity and the potential impact to the organization if that data were to be compromised. By applying a classification scheme to the databases, the organization can determine which databases contain the most sensitive or critical data, and therefore, have the highest risk associated with them.
Source: Adapted from community discussion — john_boogieman
Which of the following is MOST important to include in a report for senior management after resolving a significant IT incident?
Answer: B
Which of the following is the MOST likely reason for a significant year-over-year increase in inherent risk?
Answer: A
A. Targeted cyberattacks against the organization's infrastructure A significant year-over-year increase in inherent risk is most likely due to targeted cyberattacks against the organization's infrastructure. Inherent risk refers to the risk present in a process or activity without considering the existence of controls. Targeted cyberattacks can introduce new threats and vulnerabilities to an organization, increasing the inherent risk. The other options (B, C, and D) primarily relate to control effectiveness or risk management processes, which are separate from inherent risk.
Source: Adapted from community discussion — Broesweelies
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 231. 1449 questions available.
Version 1.0.0. How we source questions