Question 471 · 1449 in bank
Which of the following is the BEST criteria to determine whether a control environment is effective?
Show answer
Answer: C
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST criteria to determine whether a control environment is effective?
Answer: C
Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?
Answer: C
An IT risk threat analysis is BEST used to establish:
Answer: A
What are the various outputs of risk response?
Answer: CDE
The outputs of the risk response planning process are: ✑ Risk Register Updates: The risk register is written in detail so that it can be related to the priority ranking and the planned response. ✑ Risk Related Contract Decisions: Risk related contract decisions are the decisions to transmit risk, such as services, agreements for insurance, and other items as required. It provides a means for sharing risks. ✑ Project Management Plan Updates: Some of the elements of the project management plan updates are: - Schedule management plan - Cost management plan - Quality management plan - Procurement management plan - Human resource management plan - Work breakdown structure - Schedule baseline - Cost performance baseline ✑ Project Document Updates: Some of the project documents that can be updated includes: - Assumption log updates - Technical documentation updates Incorrect Answers: A: Risk priority number is not an output for risk response but instead it is done before applying response. Hence it acts as one of the inputs of risk response and is not the output of it. B: Residual risk is not an output of risk response. Residual risk is the risk that remains after applying controls. It is not feasible to eliminate all risks from an organization. Instead, measures can be taken to reduce risk to an acceptable level. The risk that is left is residual risk. As, Risk = Threat Vulnerability - and Total risk = Threat Vulnerability Asset Value Residual risk can be calculated with the following formula: Residual Risk = Total Risk - Controls Senior management is responsible for any losses due to residual risk. They decide whether a risk should be avoided, transferred, mitigated or accepted. They also decide what controls to implement. Any loss due to their decisions falls on their sides. Residual risk assessments are conducted after mitigation to determine the impact of the risk on the enterprise. For risk assessment, the effect and frequency is reassessed and the impact is recalculated.
A risk practitioner has been asked to mark an identified control deficiency as remediated, despite concerns that the risk level is still too high. Which of the following is the BEST way to address this concern?
Answer: C
An organization wants to transfer risk by purchasing cyber insurance. Which of the following would be MOST important for the risk practitioner to communicate to senior management for contract negotiation purposes?
Answer: C
Which of the following criteria is MOST important to include in an agreement with a penetration testing vendor?
Answer: A
Which of the following is the GREATEST risk associated with a blockchain implementation?
Answer: C
Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?
Answer: C
Which of the following is MOST helpful to facilitate the decision of recovery priorities in a disaster situation?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 471. 1449 questions available.
Version 1.0.0. How we source questions