CRISC practice questions 241–250

1. Question 241 · 1449 in bank

   Which of the following is the MOST effective way to manage risk scenarios identified in the risk register?

   • AEnsure risk scenarios are regularly reviewed and updated in the risk register.
   • BConduct risk assessment workshops across the organization.
   • CPresent and discuss all risk scenarios in the register at regular risk committee meetings.
   • DPrepare risk treatment plans in accordance with the organization's risk appetite.

   Show answer

   Answer: D

   Next question

2. Question 242 · 1449 in bank

   Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

   • ARisk ratings may be inconsistently applied.
   • BAccountability may not be clearly defined.
   • CDifferent risk taxonomies may be used.
   • DMitigation efforts may be duplicated.

   Show answer

   Answer: B

   Next question

3. Question 243 · 1449 in bank

   Management has implemented two new preventative controls to address a risk found in an audit. Following closure of the issue, which of the following is MOST important to update in the risk register?

   • AKey controls
   • BLikelihood
   • CInherent risk
   • DImpact

   Show answer

   Answer: B

   Next question

4. Question 244 · 1449 in bank

   A risk practitioner has collaborated with subject matter experts from the IT department to develop a large list of potential key risk indicators (KRIs) for all IT operations within the organization. Of the following, who should review the completed list and select the appropriate KRIs for implementation?

   • AIT security managers
   • BIT auditors
   • CIT risk owners
   • DIT control owners

   Show answer

   Answer: C

   Next question

5. Question 245 · 1449 in bank

   Which of the following BEST supports the effective adoption of risk management across the enterprise?

   • ABasing risk action plans on end user assessments of risk
   • BAssignment of risk-related responsibilities to end users
   • CParticipation by functions responsible for the risk
   • DComparison of risk assessment results with industry peers

   Show answer

   Answer: C

   Next question

6. Question 246 · 1449 in bank

   A risk practitioner is working with the incident management team to prioritize activities. Which of the following should be the FIRST priority of the incident response plan?

   • AVerify an incident actually occurred.
   • BVerify the recovery time objective (RTO).
   • CBrief the senior leadership team,
   • DIdentify the root cause of the incident.

   Show answer

   Answer: A

   Next question

7. Question 247 · 1449 in bank

   An organization is required to comply with updates to an existing data protection regulation. Which of the following should the risk practitioner recommend be done FIRST?

   • APerform effectiveness testing for the organization's data protection controls.
   • BDetermine whether risk responses associated with the previous regulation are still adequate.
   • CPerform a gap analysis to determine if additional controls are required.
   • DDevelop new internal control assessments for the updated regulation

   Show answer

   Answer: C

   Explanation

   I see B as just another gap analysis, and John_B's response below says the same thing. Going with given answer as it seems more ISACA-esque.

   Source: Adapted from community discussion — CbtL

   Next question

8. Question 248 · 1449 in bank

   Which of the following is MOST important when conducting a post-implementation review as part of the system development life cycle (SDLC)?

   • AVerifying that project objectives are met
   • BReviewing the project initiation risk matrix
   • CIdentifying project cost overruns
   • DLeveraging an independent review team

   Show answer

   Answer: A

   Next question

9. Question 249 · 1449 in bank

   A recent change in accounting policy has the potential to impact a known risk related to an organization's financial software. Which of the following should the risk practitioner do FIRST?

   • AAnalyze and update the risk register as needed.
   • BConduct software testing for required code updates.
   • CAnalyze and update associated control assessments.
   • DDetermine whether the risk response is still adequate.

   Show answer

   Answer: D

   Explanation

   The key word is - "to impact a known risk". Hence the answer is correct to first validate if existing control is adequate.

   Source: Adapted from community discussion — Jco

   Next question

10. Question 250 · 1449 in bank

    Which of the following is BEST determined by analysis of incident reports?

    • AChanges in the external risk environment
    • BEffectiveness of internal controls
    • CRanges for key performance indicators (KPIs)
    • DThresholds for key risk indicators (KRIs)

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 241. 1449 questions available.