Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth?
Answer: D
Going with D. Peak is your high point utilization. That climbing upwards stands to reach maximum bandwidth before others of the presented options.
Source: Adapted from community discussion — CbtL
When developing a risk awareness training program, which of the following training topics would BEST facilitate a thorough understanding of risk scenarios?
Answer: A
Which of the following would provide the MOST objective assessment of the effectiveness of an organization's security controls?
Answer: A
Which of the following is the MOST important information to be communicated during security awareness training?
Answer: A
Its C: Management's expectations provide employees with clear guidance on what is expected of them in terms of information security, and helps to set the tone for a culture of security within the organization. Communicating the corporate risk profile and recent security incidents can help employees understand the potential risks to the organization and the importance of security, but without clear expectations from management, employees may not understand how to properly manage those risks. Similarly, communicating the current risk management capability is important, but it does not provide employees with clear guidance on how to act in a way that supports the organization's security objectives.
Source: Adapted from community discussion — Koulyo
Which of the following is the GREATEST critical success factor (CSF) of an IT risk management program?
Answer: C
Which of the following should be the risk practitioner's FIRST course of action when an organization has decided to expand into new product areas?
Answer: D
The first course of action for the risk practitioner should be to conduct a risk assessment, but it does not exist as an option and reviewing existing scenarios does nothing.
Source: Adapted from community discussion — john_boogieman
Which of the following BEST supports the management of identified risk scenarios?
Answer: B
A risk practitioner observed that a high number of policy exceptions were approved by senior management. Which of the following is the risk practitioner's BEST course of action to determine root cause?
Answer: D
D. Interview the control owner. The risk practitioner's best course of action to determine the root cause of the high number of policy exceptions approved by senior management is to interview the control owner. The control owner is responsible for ensuring that the control is effective and adhered to, and they should have insight into why these exceptions are occurring. By interviewing the control owner, the risk practitioner can gain valuable information about potential gaps in the control environment, understand the rationale behind the policy exceptions, and identify opportunities to improve the policy or the control process.
Source: Adapted from community discussion — Broesweelies
You are the project manager of the NHH Project. You are working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team. What document do you and your team is creating in this scenario?
Answer: D
Which one of the following is the only output for the qualitative risk analysis process?
Answer: B
Risk register update is the only output of the choices presented for the qualitative risk analysis process. The four inputs for the qualitative risk analysis process are the risk register, risk management plan, project scope statement, and organizational process assets. The output of perform qualitative risk analysis process is Risk Register Updates. Risk register is updated with the information from perform qualitative risk analysis and the updated risk register is included in the project documents. Updates include the following important elements: ✑ Relative ranking or priority list of project risks ✑ Risks grouped by categories ✑ Causes of risk or project areas requiring particular attention ✑ List of risks requiring response in the near-term ✑ List of risks for additional analysis and response ✑ Watchlist of low priority risks ✑ Trends in qualitative risk analysis results Incorrect Answers: A, C, D: These are not the valid outputs for the qualitative risk analysis process.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 41. 1449 questions available.
Version 1.0.0. How we source questions