CRISC practice questions 551–560

1. Question 551 · 1449 in bank

   Static code analysis has been consistently finding a significant number of critical security issues throughout an organization's internally developed applications. The risk practitioner’s BEST recommendation would be to:

   • Aprovide training on secure programming practices.
   • Bconduct penetration tests before code implementation.
   • Coutsource software development.
   • Dconduct security design reviews.

   Show answer

   Answer: A

   Next question

2. Question 552 · 1449 in bank

   Which of the following is the BEST way to maintain a current list of organizational risk scenarios?

   • AConduct periodic risk reviews with stakeholders.
   • BPerform regular reviews of key controls.
   • CConduct compliance reviews.
   • DAutomate workflow for risk status updates.

   Show answer

   Answer: A

   Next question

3. Question 553 · 1449 in bank

   Which of the following is the PRIMARY objective of the risk identification process?

   • ATo expand organizational awareness and knowledge of identified risk scenarios
   • BTo reduce risk faced by the organization to an acceptable level
   • CTo ensure control objectives align with business objectives
   • DTo determine possible risk events that could jeopardize business objectives

   Show answer

   Answer: D

   Next question

4. Question 554 · 1449 in bank

   When developing a risk awareness training program, which of the following is the BEST way to promote a risk-aware culture?

   • AChallenge the effectiveness of business processes.
   • BIllustrate methods to identify threats and vulnerabilities.
   • CEmphasize individual responsibility for managing risk.
   • DCommunicate incident escalation procedures.

   Show answer

   Answer: C

   Next question

5. Question 555 · 1449 in bank

   Which of the following is the PRIMARY reason to periodically assess risk management capabilities?

   • ATo determine changes in risk profile
   • BTo monitor risk factors
   • CTo measure return on control investments
   • DTo determine opportunities for improvement

   Show answer

   Answer: D

   Explanation

   D. To determine opportunities for improvement: Risk management is an evolving process, and there is always room for improvement. Regular assessments provide insights into the strengths and weaknesses of the risk management capabilities, enabling organizations to identify opportunities for enhancement and refinement.

   Source: Adapted from community discussion — K5000ism

   Next question

6. Question 556 · 1449 in bank

   During an after-hours compliance review, a risk practitioner discovers sensitive documents on an employee’s desk in violation of company policy. Which of the following should the risk practitioner’s do NEXT?

   • ASecurely dispose of the documents.
   • BRecommend provision of secure document storage.
   • CRequest an exception to the clear desk policy.
   • DProvide the employee with refresher training.

   Show answer

   Answer: B

   Explanation

   The most appropriate next step for the risk practitioner would be to recommend the provision of secure document storage. This addresses the violation of the clear desk policy by offering a solution that ensures sensitive documents are stored securely when not in use. Options A and C are not the best immediate responses. Securely disposing of the documents (Option A) might not be necessary if the documents are still needed for work purposes, and requesting an exception to the clear desk policy (Option C) may not be the best course of action without exploring more secure storage options. Option D, providing the employee with refresher training, could be part of the solution but may not be the most immediate and practical step to address the violation. Recommending secure document storage is a proactive measure to prevent future policy violations and promote a secure working environment.

   Source: Adapted from community discussion — SuperMax

   Next question

7. Question 557 · 1449 in bank

   Which of the following BEST reduces the likelihood of employees unintentionally disclosing sensitive information to outside parties?

   • ARegular employee security awareness training
   • BAnti-malware controls on endpoint devices
   • CSensitive information classification and handling policies
   • DAn egress intrusion detection system (IDS)

   Show answer

   Answer: A

   Next question

8. Question 558 · 1449 in bank

   Which of the following is the PRIMARY purpose of periodically updating an organization's risk profile?

   • AInform senior management of changes in the risk environment.
   • BProvide a risk-based audit program.
   • CIdentify gaps between policies and procedures.
   • DPrioritize management-initiated reviews.

   Show answer

   Answer: A

   Next question

9. Question 559 · 1449 in bank

   Continuous monitoring of key risk indicators (KRIs) will:

   • Aensure that risk tolerance and risk appetite are aligned.
   • Bprovide an early warning so that proactive action can be taken.
   • Censure that risk will not exceed the defined risk appetite of the organization.
   • Dprovide a snapshot of the risk profile.

   Show answer

   Answer: B

   Next question

10. Question 560 · 1449 in bank

    Which of the following is the BEST way to ensure key risk indicators (KRIs) continue to help management make informed decisions?

    • ADevelop repeatable and easily measurable KRIs.
    • BImplement a real-time dashboard for monitoring KRIs.
    • CAlign KRIs to risk events identified in the risk register.
    • DDefine a mix of leading and lagging KRIs.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 551. 1449 questions available.