Question 501 · 1449 in bank
Which of the following is the BEST indication of a potential threat?
Show answer
Answer: A
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST indication of a potential threat?
Answer: A
Which of the following is the MOST effective in mitigating the risk of rogue Internet of Things (IoT) devices in an organization’s network?
Answer: B
An organization is outsourcing data processing to a third-party data center facility to reduce costs. Who is responsible for the performance of data retention controls?
Answer: A
A. The organization’s control owner. Even when an organization outsources certain functions or processes, it retains ultimate responsibility for ensuring that all controls, including data retention controls, are effectively managed. The control owner within the organization is responsible for overseeing these controls and ensuring they meet the organization's standards and requirements, regardless of whether the function is performed in-house or by a third-party provider. While the third-party provider (and their control owner) is responsible for executing the controls as per the agreed terms, the organization's control owner must ensure that these controls are adequate and effective. The internal audit team typically plays a role in verifying and assessing the effectiveness of these controls, but the primary responsibility remains with the organization's control owner.
Source: Adapted from community discussion — Kennethlim79
An organization has recently corrected its machine-learning model that had been producing automated decisions that had adverse impact on its customers. Which of the following is the BEST course of action?
Answer: D
Which of the following statements are true for risk communication? Each correct answer represents a complete solution. (Choose three.)
Answer: ACD
Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner. Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders. Risk communication can be explained more clearly with the help of the following definitions: ✑ It defines the issue of what a group does, not just what it says. ✑ It must take into account the valuable element in user's perceptions of risk. ✑ It will be more valuable if it is thought of as conversation, not instruction. Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders. Incorrect Answers: B: It helps in allocating the information concerning risk not only among the decision-makers but also stakeholders.
Source: Adapted from community discussion — aselunar
Which of the following is the MOST effective way to help ensure senior management is informed about the organization's risk environment?
Answer: C
Which of the following presents the GREATEST risk to an organization with a large number of Internet of Things (IoT) devices within its network?
Answer: C
An organization's IT department wants to complete a proof of concept (POC) for a security tool. The project lead has asked for approval to use the production data for testing purposes as it will yield the best results. Which of the following is the risk practitioner's BEST recommendation?
Answer: D
An organization has purchased insurance coverage against potential unauthorized disclosure of personal data. What should be expected as a result of this risk response?
Answer: A
A. Reduced impact of a data breach. Insurance coverage is a form of risk transfer, where the financial impact of a data breach is mitigated by transferring some of the potential costs to the insurance provider. This means that in the event of a data breach, the insurance can cover certain expenses, thus reducing the financial burden on the organization. However, it's important to note that insurance does not reduce the likelihood of a data breach occurring, nor does it remove the scenario from further analysis. While it may affect the organization's tolerance of the risk by mitigating financial impacts, the underlying risk of a data breach still exists and requires ongoing management.
Source: Adapted from community discussion — Kennethlim79
Who is ULTIMATELY accountable for the confidentiality of data in the event of a data breach within a Software as a Service (SaaS) environment?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 501. 1449 questions available.
Version 1.0.0. How we source questions