CRISC practice questions 401–410

1. Question 401 · 1449 in bank

   Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

   • AKRIs assist in the preparation of the organization’s risk profile.
   • BKRIs signal that a change in the control environment has occurred.
   • CKRIs provide an early warning that a risk threshold is about to be reached.
   • DKRIs provide a basis to set the risk appetite for an organization.

   Show answer

   Answer: C

   Next question

2. Question 402 · 1449 in bank

   An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:

   • Arisk mitigation.
   • Brisk appetite.
   • Crisk evaluation.
   • Drisk tolerance.

   Show answer

   Answer: D

   Next question

3. Question 403 · 1449 in bank

   Which of the following would MOST likely cause management to unknowingly accept excessive risk?

   • ALack of preventive controls
   • BRisk tolerance being set too low
   • CInaccurate risk ratings
   • DSatisfactory audit results

   Show answer

   Answer: C

   Next question

4. Question 404 · 1449 in bank

   Which of the following is the MOST useful information for a risk practitioner when planning response activities after risk identification?

   • ARisk priorities
   • BRisk register
   • CRisk heat maps
   • DRisk appetite

   Show answer

   Answer: A

   Next question

5. Question 405 · 1449 in bank

   What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical legacy system?

   • AEnsure regular backups take place.
   • BInstall antivirus software on the system.
   • CVirtualize the system in the cloud.
   • DSegment the system on its own network.

   Show answer

   Answer: D

   Next question

6. Question 406 · 1449 in bank

   Which of the following would provide the MOST reliable evidence of the effectiveness of security controls implemented for a web application?

   • APenetration testing
   • BFault tree analysis
   • CVulnerability assessment
   • DIT general controls audit

   Show answer

   Answer: A

   Next question

7. Question 407 · 1449 in bank

   A recent regulatory requirement has the potential to affect an organization’s use of a third party to supply outsourced business services. Which of the following is the BEST course of action?

   • AIdentify compensating controls.
   • BTerminate the outsourcing agreement.
   • CTransfer risk to the third party.
   • DConduct a gap analysis.

   Show answer

   Answer: D

   Explanation

   A recent regulatory requirement has the potential to affect an organization’s use of a third party to supply outsourced business services. Which of the following is the BEST course of action? A. Identify compensating controls. (Possible but you still first need to run a gap analysis so that you can determine what compensating controls would be needed) B. Terminate the outsourcing agreement. (it just has the potential to affect, so you wouldn't do this yet) C. Transfer risk to the third party. (still just the potential to affect, so you wouldn't do this yet) D. Conduct a gap analysis. (Find out what the gaps are between what is in place and what the new regulation is so that you can determine what to do)

   Source: Adapted from community discussion — MartyMar

   Next question

8. Question 408 · 1449 in bank

   A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which of the following is the risk practitioner’s BEST course of action?

   • ACollaborate with the risk owner to determine the risk response plan.
   • BInclude a right to audit clause in the service provider contract.
   • CAdvise the risk owner to accept the risk.
   • DDocument the gap in the risk register and report to senior management.

   Show answer

   Answer: A

   Next question

9. Question 409 · 1449 in bank

   Which of the following BEST enables a risk practitioner to understand management's approach to organizational risk?

   • AIndustry best practices for risk management
   • BRisk appetite and risk tolerance
   • CPrior year’s risk assessment results
   • DOrganizational structure and job descriptions

   Show answer

   Answer: B

   Next question

10. Question 410 · 1449 in bank

    An organization has been experiencing an increasing number of spear phishing attacks. Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?

    • AImplement a security awareness program.
    • BRequire strong password complexity.
    • CImplement two-factor authentication.
    • DUpdate firewall configuration.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 401. 1449 questions available.