Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following are external risk factors? Each correct answer represents a complete solution. (Choose three.)
Answer: AC
Only 2 answers are marked as correct, eventhough the question asks for 3 answers. The answers are ACD. The description is correct
Source: Adapted from community discussion — Kozy
An organization is planning to outsource its payroll function to an external service provider. Which of the following should be the MOST important consideration when selecting the provider?
Answer: B
Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?
Answer: C
Encrypting the data before it leaves the organization is the BEST way to protect sensitive data from administrators within a public cloud. When data is encrypted before leaving the organization, the data remains encrypted while it is stored in the cloud, and only authorized parties with the encryption keys can access the decrypted data. This means that even if cloud administrators gain access to the data, they would only be able to see the encrypted version and not the sensitive data in clear text.
Source: Adapted from community discussion — john_boogieman
Which of the following should be the FIRST consideration when establishing a new risk governance program?
Answer: D
A risk practitioner is reviewing accountability assignments for data risk in the risk register. Which of the following would pose the GREATEST concern?
Answer: D
To ensure accountability, the risk owner must be an individual, not a department or organization. On the other hand, the owner of the risk need not necessarily be the owner of the control and that it is not is not a concern.
Source: Adapted from community discussion — john_boogieman
Which of the following is a risk practitioner’s BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?
Answer: C
noncompliance with industry regulations is categorized under "Risk Events" as described on page 82 of the text book . The risk Events are to be escalated to the managers as they are not "Threat Events" which may or may not happen and requires further assessments . We must inform key decision-makers about the potential consequences of non-compliance and the urgency of addressing the risks.
Source: Adapted from community discussion — FredDurst
Which of the following should be the PRIMARY input to determine risk tolerance?
Answer: D
Which of the following should be considered FIRST when creating a comprehensive IT risk register?
Answer: B
Which of the following is the PRIMARY reason to engage business unit managers in risk management processes?
Answer: C
Which of the following would be the BEST way for a risk practitioner to validate the effectiveness of a patching program?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 371. 1449 questions available.
Version 1.0.0. How we source questions