CRISC practice questions 441–450

1. Question 441 · 1449 in bank

   Which of the following is a risk practitioner’s BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?

   • AUpdate risk responses.
   • BPerform a threat assessment.
   • CRedesign key risk indicators (KRIs).
   • DConduct a SWOT analysis.

   Show answer

   Answer: B

   Next question

2. Question 442 · 1449 in bank

   Which of the following provides the BEST assurance of control effectiveness for security risk scenarios in a service provider’s environment?

   • AIndependent assessment report
   • BPenetration testing
   • CService-level monitoring
   • DService provider’s control self-assessment (CSA)

   Show answer

   Answer: A

   Next question

3. Question 443 · 1449 in bank

   Which of the following BEST enables risk mitigation associated with software licensing noncompliance?

   • APerform automated vulnerability scans.
   • BConduct annual reviews of license expiration dates.
   • CImplement automated IT asset management controls
   • DDocument IT inventory management procedures.

   Show answer

   Answer: C

   Explanation

   I believe the answer is C, Automated monitoring can provide timely information rather than conducting a review on an annual basis.

   Source: Adapted from community discussion — Rahmeh

   Next question

4. Question 444 · 1449 in bank

   As part of software development projects, risk assessments are MOST effective when performed:

   • Athroughout the system development life cycle (SDLC).
   • Bbefore the decision is made to develop or acquire the software.
   • Cduring system deployment and maintenance.
   • Dbefore developing the project charter for the software.

   Show answer

   Answer: A

   Next question

5. Question 445 · 1449 in bank

   Which of the following MOST effectively ensures controls are built into applications during development?

   • AIndependent post-implementation reviews of system development projects by internal audit
   • BStatic code scanning throughout the systems development life cycle (SDLC)
   • CDynamic security testing before applications move to production
   • DEngagement of security team early in the systems development life cycle (SDLC)

   Show answer

   Answer: D

   Next question

6. Question 446 · 1449 in bank

   Which of the following analyses is MOST useful for prioritizing risk scenarios associated with loss of IT assets?

   • ACost-benefit analysis
   • BBusiness impact analysis (BIA)
   • CSWOT analysis
   • DRoot cause analysis

   Show answer

   Answer: B

   Next question

7. Question 447 · 1449 in bank

   The PRIMARY reason to implement a formalized risk taxonomy is to:

   • Areduce subjectivity in risk management
   • Bcomply with regulatory requirements
   • Cdemonstrate best industry practice
   • Dimprove visibility of overall risk exposure

   Show answer

   Answer: A

   Next question

8. Question 448 · 1449 in bank

   Which of the following is the FIRST consideration to reduce risk associated with the storage of personal data?

   • ANormalize the personal data.
   • BImplement privacy training.
   • CMinimize the collection of data.
   • DEncrypt the personal data.

   Show answer

   Answer: C

   Next question

9. Question 449 · 1449 in bank

   After the announcement of a new IT regulatory requirement, it is MOST important for a risk practitioner to:

   • Aprepare an IT risk mitigation strategy
   • Breview the impact to the IT environment
   • Cescalate to senior management
   • Dperform a cost-benefit analysis

   Show answer

   Answer: B

   Next question

10. Question 450 · 1449 in bank

    Which of the following has the GREATEST impact on ensuring the alignment of the risk profile with business objectives?

    • AIncorporation of industry best practice benchmarks and standards
    • BAn effective enterprise-wide risk awareness program
    • CSenior management approval of risk appetite and tolerance
    • DStage gate reviews throughout the risk management process

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 441. 1449 questions available.