CRISC practice questions 341–350

1. Question 341 · 1449 in bank

   Which of the following provides the MOST useful information to assess the magnitude of identified deficiencies in the IT control environment?

   • AThreat analysis results
   • BPeer benchmarks
   • CBusiness impact analysis (BIA) results
   • DInternal audit reports

   Show answer

   Answer: C

   Explanation

   Therefore, while internal audit reports can be useful for identifying deficiencies in the IT control environment, BIA results provide the most useful information to assess the magnitude of these deficiencies and prioritize remediation efforts.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 342 · 1449 in bank

   Which of the following is the PRIMARY purpose of creating and documenting control procedures?

   • ATo help manage risk to acceptable tolerance levels
   • BTo facilitate ongoing audit and control testing
   • CTo establish and maintain a control inventory
   • DTo increase the likelihood of effective control operation

   Show answer

   Answer: D

   Explanation

   The purpose of creating and documenting control procedures is to increase the likelihood that controls will be implemented and operated effectively. By having clear, documented procedures, employees can understand what is expected of them and can follow a consistent approach to control operations. This can help to reduce the risk of errors or omissions and increase the likelihood that controls will operate effectively. While the creation and documentation of control procedures can help manage risk, the primary purpose is to increase the likelihood of effective control operation. By increasing the effectiveness of control operations, an organization can reduce the risk of negative outcomes and better achieve its objectives.

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 343 · 1449 in bank

   Of the following, who should be PRIMARILY responsible for performing user entitlement reviews?

   • AData custodian
   • BIT personnel
   • CData owner
   • DIT security manager

   Show answer

   Answer: C

   Next question

4. Question 344 · 1449 in bank

   The MAJOR reason to classify information assets is to:

   • Acategorize data into groups.
   • Bmaintain a current inventory and catalog of information assets.
   • Cdetermine their sensitivity and criticality.
   • Destablish recovery time objectives (RTOs).

   Show answer

   Answer: C

   Next question

5. Question 345 · 1449 in bank

   Which of the following is MOST important to consider before determining a response to a vulnerability?

   • AMonetary value of the asset
   • BLack of data to measure threat events
   • CThe cost to implement the risk response
   • DThe likelihood and impact of threat events

   Show answer

   Answer: D

   Next question

6. Question 346 · 1449 in bank

   Which of the following is the GREATEST benefit of centralizing IT systems?

   • ARisk reporting
   • BRisk identification
   • CRisk monitoring
   • DRisk classification

   Show answer

   Answer: C

   Explanation

   Centralised systems will improve all three- identification, monitoring and reporting. If i have to chose one this would be identification as monitoring and reporting comes afterwards.. CBTL mate.. please elaborate just saying agree or agree with xxx will not help anyone :) thanks for your consideration.

   Source: Adapted from community discussion — mynk29

   Next question

7. Question 347 · 1449 in bank

   Senior management is deciding whether to share confidential data with the organization’s business partners. The BEST course of action for a risk practitioner would be to submit a report to senior management containing the:

   • Aproject plan for classification of the data.
   • Bsummary of data protection and privacy legislation.
   • Cdesign of controls to encrypt the data to be shared.
   • Dpossible risk and suggested mitigation plans.

   Show answer

   Answer: D

   Next question

8. Question 348 · 1449 in bank

   Which of the following would be of GREATEST concern regarding an organization’s asset management?

   • ALack of a dedicated asset management team
   • BDecentralized asset lists
   • CIncomplete asset inventory
   • DLack of a mature records management program

   Show answer

   Answer: C

   Next question

9. Question 349 · 1449 in bank

   Which of the following is the PRIMARY objective of risk management?

   • AMinimize business disruptions.
   • BAchieve business objectives.
   • CIdentify and analyze risk.
   • DIdentify threats and vulnerabilities.

   Show answer

   Answer: B

   Next question

10. Question 350 · 1449 in bank

    When developing a response plan to address security incidents regarding sensitive data loss; it is MOST important to:

    • Arevalidate existing risk scenarios.
    • Brevalidate current key risk indicators (KRIs).
    • Creview the data classification policy.
    • Drevise risk management procedures.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 341. 1449 questions available.