CRISC practice questions 511–520

1. Question 511 · 1449 in bank

   Which of the following is the GREATEST benefit of a risk-aware culture?

   • ACost of controls is reduced over time.
   • BThe organization is more resilient to threats.
   • CThe number of audit findings is reduced over time.
   • DRelevant risk is reported in a timely manner.

   Show answer

   Answer: D

   Next question

2. Question 512 · 1449 in bank

   An organization has outsourced its backup and recovery procedures to a cloud service provider. The provider's controls are inadequate for the organization's level of risk tolerance. As a result, the organization has internally implemented additional backup and recovery controls. Which risk response has been adopted?

   • AAcceptance
   • BTransfer
   • CAvoidance
   • DMitigation

   Show answer

   Answer: D

   Next question

3. Question 513 · 1449 in bank

   Which of the following presents the GREATEST risk associated with the use of emerging technologies?

   • AObsolete security policies and procedures
   • BIrrelevant skill sets and job descriptions
   • CDisposal and replacement of IT equipment
   • DIntroduction of known and unknown security vulnerabilities

   Show answer

   Answer: D

   Next question

4. Question 514 · 1449 in bank

   Which of the following would be MOST helpful to review when prioritizing the implementation of multiple IT-related initiatives?

   • ARisk policy
   • BRisk profile
   • CRisk assessment results
   • DRisk awareness program objectives

   Show answer

   Answer: C

   Next question

5. Question 515 · 1449 in bank

   Which of the following attributes of data provided to an automated log analysis tool is MOST important for effective risk monitoring?

   • ARetention
   • BConfidentiality
   • CRelevancy
   • DScalability

   Show answer

   Answer: C

   Next question

6. Question 516 · 1449 in bank

   A control owner has decided to implement a compensating control instead of the control selected in the risk action plan. Which of the following is the risk practitioner's MOST important action after reassessing the risk?

   • ANotify senior management of the control owner's decision.
   • BSeek approval of the change from the risk owner.
   • CUpdate control ownership in the risk register.
   • DUpdate policies relevant to the risk.

   Show answer

   Answer: B

   Next question

7. Question 517 · 1449 in bank

   Which of the following is a PRIMARY benefit to an organization adopting a three lines of defense model?

   • AIt establishes clear communication among stakeholders.
   • BIt outlines a control layering approach.
   • CIt provides a risk governance structure.
   • DIt enforces a strong risk culture.

   Show answer

   Answer: C

   Next question

8. Question 518 · 1449 in bank

   Which of the following would be the MOST effective mitigating control when a legacy application does not have the capability to appropriately enforce separation of duties?

   • AEstablish delegated authorities.
   • BPeriodically validate user entitlements.
   • CMonitor transaction logs.
   • DDevelop user access policies.

   Show answer

   Answer: C

   Explanation

   C is correct as monitoring transation logs can happen in near real time and violation can be captured. Periodic validation is reactive and could be manual.

   Source: Adapted from community discussion — Vudusa

   Next question

9. Question 519 · 1449 in bank

   Risk mitigation is MOST effective when which of the following is optimized?

   • AInherent risk
   • BResidual risk
   • COperational risk
   • DRegulatory risk

   Show answer

   Answer: B

   Next question

10. Question 520 · 1449 in bank

    Which of the following is the BEST way to assess the effectiveness of an access management process?

    • AReviewing for compliance with acceptable use policy
    • BReviewing access logs for user activity
    • CComparing the actual process with the documented process
    • DReconciling a list of accounts belonging to terminated employees

    Show answer

    Answer: C

    Explanation

    C. Comparing the actual process with the documented process. This method involves a thorough review of how the access management process is actually being carried out in comparison to how it is documented and supposed to work. This comparison can reveal discrepancies between the intended procedures and the real-world implementation, identifying areas where the process may not be followed correctly or effectively. It's a comprehensive approach that not only checks for compliance but also evaluates the practical application and efficiency of the access management policies and procedures in the organization.

    Source: Adapted from community discussion — Kennethlim79

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 511. 1449 questions available.