Question 361 · 1449 in bank
Which of the following is the MOST effective way to help ensure accountability for managing risk?
Show answer
Answer: A
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the MOST effective way to help ensure accountability for managing risk?
Answer: A
What is senior management’s role in the RACI model when tasked with reviewing monthly status reports provided by risk owners?
Answer: D
I guess the question needs to be viewed slightly differently. What's the management role when they review monthly status reports? In that situation their role is just being informed. There is no denying the fact that ultimately they are responsible but in that situation they are being informed. I agree with D
Source: Adapted from community discussion — jseeker
An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?
Answer: A
Effectiveness of SSO control has been done (lets say with 10 apps). Now you adding one more application. Why would one want to retest the entire control again with 11 apps now? You would only test the effectiveness of control for this new app only.
Source: Adapted from community discussion — mynk29
Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?
Answer: D
A global organization has implemented an application that does not address all privacy requirements across multiple jurisdictions. Which of the following risk responses has the organization adopted with regard to privacy requirements?
Answer: D
An information security audit identified a risk resulting from the failure of an automated control. Who is responsible for ensuring the risk register is updated accordingly?
Answer: C
Per ISACA CRISC Book (Page 168):By keeping the risk register accurate and up to date, the risk practitioner ensures that it is consistently available as a resource for risk management activities across the enterprise.
Source: Adapted from community discussion — FredDurst
An internal audit report reveals that a legacy system is no longer supported. Which of the following is the risk practitioner’s MOST important action before recommending a risk response?
Answer: C
Which of the following proposed benefits is MOST likely to influence senior management approval to reallocate budget for a new security initiative?
Answer: C
I believe C is correct Residual Risk are the risks left after action is taken to reduce the Inherent risks. Therefore, to get Managment to pay for a new security program you would want to show what the reduction in residual risk would be after this program is implemented.
Source: Adapted from community discussion — MartyMar
Reviewing which of the following BEST helps an organization gain insight into its overall risk profile?
Answer: D
Reviewing the risk register helps an organization gain insight into its overall risk profile. The risk register is a key tool used in risk management to identify, evaluate, and manage risks. It provides a comprehensive list of risks facing the organization and includes information such as the likelihood and impact of the risks, the current status of risk mitigation measures, and the ownership and accountability for each risk. Reviewing the risk register helps an organization to gain insight into the scope and severity of its risks, and to prioritize actions to manage those risks effectively. The threat landscape, on the other hand, is a broader view of the types of threats and vulnerabilities that exist in the environment. While it is important to understand the threat landscape, the risk register provides a more detailed and focused view of the specific risks that the organization faces and the steps that are being taken to manage those risks.
Source: Adapted from community discussion — john_boogieman
Which of the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 361. 1449 questions available.
Version 1.0.0. How we source questions