Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?
Answer: B
Which of the following is the BEST method for assessing the current effectiveness of an organization’s risk management program against its desired level of capability?
Answer: A
An organization has decided to migrate its critical system database containing customer information to branches located in other countries. Which of the following should be of MOST concern regarding the migration?
Answer: A
Where should a risk practitioner document the current state and desired future state of organizational risk?
Answer: B
Which of the following is an output of risk assessment process?
Answer: B
The output of the risk assessment process is identification of appropriate controls for reducing or eliminating risk during the risk mitigation process. To determine the likelihood of a future adverse event, threats to an IT system must be analyzed in conjunction with the potential vulnerabilities and the controls in place for the IT system. Once risk factors have been identified, existing or new controls are designed and measured for their strength and likelihood of effectiveness. Controls are preventive, detective or corrective; manual or programmed; and formal or ad hoc. Incorrect Answers: A: Risk identification acts as input of the risk assessment process. C: This is an output of risk mitigation process, that is, after applying several risk responses. D: Residual risk is the latter output after appropriate control.
Which of the following would BEST prevent an unscheduled application of a patch?
Answer: C
Which of the following is MOST likely to trigger the need for a risk reassessment?
Answer: C
The BEST way to mitigate the high cost of retrieving electronic evidence associated with potential litigation is to implement policies and procedures for:
Answer: C
C. Data retention and destruction. Implementing clear and effective data retention and destruction policies helps in managing the volume of data that needs to be stored, reviewed, and potentially retrieved during litigation. By properly retaining only necessary data for legally required or business-critical periods and systematically destroying outdated or irrelevant data, an organization can significantly reduce the volume of data to sift through during litigation, thereby lowering associated costs. This approach also ensures that the data retained is more likely to be relevant and organized, facilitating quicker and more cost-effective retrieval.
Source: Adapted from community discussion — Kennethlim79
Which of the following would be the result of a significant increase in the motivation of a malicious threat actor?
Answer: A
Which of the following is the MOST effective way to validate organizational awareness of cybersecurity risk?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 481. 1449 questions available.
Version 1.0.0. How we source questions