Question 271 · 1449 in bank
When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?
Answer: B
Which of the following key performance indicators (KPIs) would BEST measure the risk of a service outage when using a Software as a Service (SaaS) vendor?
Answer: C
An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization’s customer service operations overseas. Which of the following would MOST significantly impact management’s decision?
Answer: D
Which of the following should be the GREATEST concern to a risk practitioner when process documentation is incomplete?
Answer: A
The inability to identify the risk owner should be the GREATEST concern to a risk practitioner when process documentation is incomplete.
Source: Adapted from community discussion — john_boogieman
After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:
Answer: B
When classifying and prioritizing risk responses, the areas to address FIRST are those with:
Answer: C
The areas to address FIRST when classifying and prioritizing risk responses are those with high risk levels and low cost effectiveness ratios. Risk responses can be classified and prioritized based on the potential impact of the risk and the cost-effectiveness of the proposed response. High-risk levels imply a greater likelihood of the risk occurring and a higher potential impact if it does occur. Low cost-effectiveness ratios indicate that the proposed response would be less efficient or less effective in mitigating the risk compared to other potential responses. Addressing high-risk areas first is important because these risks have the potential to cause significant damage to the organization. In addition, addressing low-cost effectiveness areas first can help to ensure that resources are allocated efficiently and that the most effective responses are implemented. Therefore, when classifying and prioritizing risk responses, the areas to address FIRST are those with high risk levels and low cost effectiveness ratios.
Source: Adapted from community discussion — john_boogieman
Which of the following controls will BEST mitigate risk associated with excessive access privileges?
Answer: C
Which of the following provides the MOST comprehensive information when developing a risk profile for a system?
Answer: A
An organization retains footage from its data center security camera for 30 days when the policy requires 90-day retention. The business owner challenges whether the situation is worth remediating. Which of the following is the risk manager’s BEST response?
Answer: A
Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization’s data disposal policy?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 271. 1449 questions available.
Version 1.0.0. How we source questions