CRISC practice questions 421–430

1. Question 421 · 1449 in bank

   Which of the following is MOST important to determine when assessing the potential risk exposure of a loss event involving personal data?

   • AThe cost associated with incident response activities
   • BThe maximum levels of applicable regulatory fines
   • CThe composition and number of records in the information asset
   • DThe length of time between identification and containment of the incident

   Show answer

   Answer: B

   Explanation

   First thing you do when there is an exposure is to assess how many user records are in scope of breach. C seems more logical answer to me. Regulatory fines does not capture the reputational damage.

   Source: Adapted from community discussion — mynk29

   Next question

2. Question 422 · 1449 in bank

   Which of the following is the BEST evidence of the effectiveness of a security awareness program?

   • AAn increase in the number of user-reported security issues
   • BA decrease in the number of security threats
   • CAn increase in the number of key performance indicators (KPIs)
   • DA decrease in the number of failed login attempts

   Show answer

   Answer: A

   Next question

3. Question 423 · 1449 in bank

   Which of the following findings of a security awareness program assessment would cause the GREATEST concern to a risk practitioner?

   • AThe program has not decreased threat counts.
   • BThe program uses non-customized training modules.
   • CThe program has not considered business impact.
   • DThe program has been significantly revised.

   Show answer

   Answer: B

   Next question

4. Question 424 · 1449 in bank

   Which of the following is the MOST effective way to reduce potential losses due to ongoing expense fraud?

   • AImplement user access controls.
   • BDevelop and communicate fraud prevention policies.
   • CPerform regular internal audits.
   • DConduct fraud prevention awareness training.

   Show answer

   Answer: C

   Next question

5. Question 425 · 1449 in bank

   Which of the following potential scenarios associated with the implementation of a new database technology presents the GREATEST risk to an organization?

   • AApplication and data migration cost for backups may exceed budget.
   • BThe organization may not have a sufficient number of skilled resources.
   • CData may not be recoverable due to system failures.
   • DThe database system may not be scalable in the future.

   Show answer

   Answer: C

   Next question

6. Question 426 · 1449 in bank

   Which of the following is MOST useful for measuring the existing risk management process against a desired date?

   • ACapability maturity model
   • BRisk scenario analysis
   • CRisk management framework
   • DBalanced scorecard

   Show answer

   Answer: A

   Explanation

   I believe the answer is A, since the Capability Module is used to measure the process matyrity against it's target start

   Source: Adapted from community discussion — Rahmeh

   Next question

7. Question 427 · 1449 in bank

   Which of the following BEST enables senior management to compare the ratings of risk scenarios?

   • AControl self-assessment (CSA)
   • BKey risk indicators (KRIs)
   • CRisk heat map
   • DKey performance indicators (KPIs)

   Show answer

   Answer: C

   Next question

8. Question 428 · 1449 in bank

   Which of the following BEST reduces the probability of laptop theft?

   • AAcceptable use policy
   • BAsset tag with GPS
   • CCable lock
   • DData encryption

   Show answer

   Answer: C

   Next question

9. Question 429 · 1449 in bank

   Which of the following is the GREATEST benefit of having a mature enterprise architecture (EA) in place?

   • AStandards-based policies
   • BEfficient operations
   • CRegulatory compliance
   • DAudit readiness

   Show answer

   Answer: B

   Next question

10. Question 430 · 1449 in bank

    What is the MAIN benefit of using a top-down approach to develop risk scenarios?

    • AIt describes risk events specific to technology used by the enterprise.
    • BIt establishes the relationship between risk events and organizational objectives.
    • CIt helps management and the risk practitioner to refine risk scenarios.
    • DIt uses hypothetical and generic risk events specific to the enterprise.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 421. 1449 questions available.