CRISC practice questions 261–270

1. Question 261 · 1449 in bank

   Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?

   • AReduction in audits involving external risk consultants
   • BPercentage of projects with key risk accepted by the project steering committee
   • CPercentage of projects with developed controls on scope creep
   • DReduction in risk policy noncompliance findings

   Show answer

   Answer: B

   Explanation

   B. Percentage of projects with key risk accepted by the project steering committee Measuring the percentage of projects with key risks accepted by the project steering committee is the best key performance indicator (KPI) to determine how effectively risk management practices are embedded in the project management office (PMO). This KPI demonstrates that the PMO has identified and assessed risks, and the steering committee is actively involved in the decision-making process, providing a clear indication that risk management practices are integrated into the project lifecycle.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 262 · 1449 in bank

   To define the risk management strategy, which of the following MUST be set by the board of directors?

   • ARisk governance
   • BAnnualized loss expectancy (ALE)
   • CRisk appetite
   • DOperational strategies

   Show answer

   Answer: C

   Explanation

   The risk appetite is the level of risk that an organization is willing to accept in pursuit of its objectives. It reflects the board's view of how much risk the organization is willing to take on in order to achieve its strategic objectives. The risk appetite statement sets the tone for the entire risk management program, guiding the development of risk management policies, procedures, and processes.

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 263 · 1449 in bank

   Which of the following is MOST important to ensure when reviewing an organization's risk register?

   • AVulnerabilities have separate entries.
   • BControl ownership is recorded.
   • CRisk ownership is recorded.
   • DResidual risk is less than inherent risk.

   Show answer

   Answer: C

   Next question

4. Question 264 · 1449 in bank

   Which of the following key control indicators (KCIs) BEST indicates whether security requirements are identified and managed throughout a project life cycle?

   • ANumber of employees completing project-specific security training
   • BNumber of projects going live without a security review
   • CNumber of security projects started in core departments
   • DNumber of security-related status reports submitted by project managers

   Show answer

   Answer: D

   Explanation

   D. Number of security-related status reports submitted by project managers The number of security-related status reports submitted by project managers is the best key control indicator (KCI) to determine whether security requirements are identified and managed throughout a project life cycle. These status reports reflect ongoing communication about security issues and measures between project managers and stakeholders, demonstrating that security is actively considered, monitored, and managed throughout the project.

   Source: Adapted from community discussion — Broesweelies

   Next question

5. Question 265 · 1449 in bank

   You are working as the project manager of the ABS project. The project is for establishing a computer network in a school premises. During the project execution, the school management asks to make the campus Wi-Fi enabled. You know that this may impact the project adversely. You have discussed the change request with other stakeholders. What will be your NEXT step?

   • AUpdate project management plan.
   • BIssue a change request.
   • CAnalyze the impact.
   • DUpdate risk management plan.

   Show answer

   Answer: C

   Explanation

   The first step after receiving any change request in a project must be first analyzed for its impact. Changes may be requested by any stakeholder involved with the project. Although, they may be initiated verbally, they should always be recorded in written form and entered into the change management and/or configuration management. Incorrect Answers: A, B, D: All these are the required steps depending on the change request. Any change request must be followed by the impact analysis of the change.

   Source: Adapted from community discussion — Josh93

   Next question

6. Question 266 · 1449 in bank

   Which of the following will BEST ensure that controls adequately support business goals and objectives?

   • AUsing the risk management process
   • BEnforcing strict disciplinary procedures in case of noncompliance
   • CAdopting internationally accepted controls
   • DReviewing results of the annual company external audit

   Show answer

   Answer: A

   Next question

7. Question 267 · 1449 in bank

   Which of the following is MOST helpful in providing a high-level overview of current IT risk severity?

   • ARisk mitigation plans
   • BRisk appetite statement
   • CHeat map
   • DKey risk indicators (KRIs)

   Show answer

   Answer: C

   Next question

8. Question 268 · 1449 in bank

   A legacy application used for a critical business function relies on software that has reached the end of extended support. Which of the following is the MOST effective control to manage this application?

   • AIncrease the frequency of regular system and data backups.
   • BSegment the application within the existing network.
   • CApply patches for a newer version of the application.
   • DSubscribe to threat intelligence to monitor external attacks.

   Show answer

   Answer: B

   Explanation

   Segmenting the application within the existing network is the MOST effective control to manage the legacy application that relies on software that has reached the end of extended support. When software reaches the end of its support period, it means that the vendor will no longer provide security patches and updates to address any newly discovered vulnerabilities. This makes the application more susceptible to attacks, and the organization needs to take steps to manage the risk.

   Source: Adapted from community discussion — john_boogieman

   Next question

9. Question 269 · 1449 in bank

   A segregation of duties control was found to be ineffective because it did not account for all applicable functions when evaluating access. Who is responsible for ensuring the control is designed to effectively address risk?

   • AControl tester
   • BRisk manager
   • CRisk owner
   • DControl owner

   Show answer

   Answer: D

   Explanation

   Is control owner. ISACA definition: A person in whom the enterprise has invested the authority and accountability for making control-related decisions and is responsible for ensuring that the control is implemented and is operating effectively and efficiently.

   Source: Adapted from community discussion — john_boogieman

   Next question

10. Question 270 · 1449 in bank

    The cost of maintaining a control has grown to exceed the potential loss. Which of the following BEST describes this situation?

    • AEffective risk management
    • BOptimized control management
    • COver-controlled environment
    • DInsufficient risk tolerance

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 261. 1449 questions available.