Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
It was discovered that a service provider's administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (IaaS) model. Which of the following would BEST protect against a future recurrence?
Answer: C
One of the risk events you've identified is classified as force majeure. What risk response is likely to be used?
Answer: B
Risk Transfer or sharing is the correct choice, in case the impact is high and the probability of occurrence is low, as companies goes for something like insurance to cover such risks.
Source: Adapted from community discussion — AbHassan
Which of the following metrics would be MOST helpful to management in understanding the effectiveness of the organization’s security awareness controls?
Answer: B
The metric that would be most helpful to management in understanding the effectiveness of the organization’s security awareness controls is: B. Number of employees who have not completed training. This metric directly reflects engagement and compliance with the security awareness program. A lower number of employees who have not completed training indicates higher participation and potentially greater awareness of security practices among staff. This metric helps management assess the reach and uptake of the security awareness program, which is crucial for its effectiveness. Effective security awareness training is a key factor in reducing security incidents, as it equips employees with the knowledge and skills to recognize and respond appropriately to security threats.
Source: Adapted from community discussion — Abbey2
Which of the following sources is MOST relevant to reference when updating security awareness training materials?
Answer: C
A. Global security standards Global security standards provide a widely recognized and accepted framework for implementing security measures. Referencing these standards ensures that your training materials align with established best practices and guidelines, helping to enhance the effectiveness and credibility of your security awareness program. Additionally, adherence to global security standards can help ensure regulatory compliance and mitigate risks effectively.
Source: Adapted from community discussion — Joloms
Which of the following should be the PRIMARY consideration when identifying and assigning ownership of IT-related risk?
Answer: B
B. Accountability for losses due to impact This choice ensures that the individual or entity responsible for managing the risk is also accountable for any negative consequences or losses that may arise from the risk materializing. While other factors such as control operation and the ability to design controls are important, ultimately, it is the accountability for the impact that drives effective risk management practices.
Source: Adapted from community discussion — Joloms
An organization's risk profile indicates that residual risk levels have fallen significantly below management's risk appetite. Which of the following is the BEST course of action?
Answer: C
A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization's data-handling policy and local privacy regulations. Which of the following would be the BEST recommendation?
Answer: A
Requesting a policy exception from senior management is the best approach because it allows the organization to address the specific conflict between its data-handling policy and local privacy regulations while ensuring that senior leadership is aware of and approves the deviation from standard policies. This approach allows the organization to maintain compliance with local regulations without undermining its internal policies.
Source: Adapted from community discussion — King24
In addition to the risk exposure, which of the following is MOST important for senior management to understand prior to approving the use of artificial intelligence (AI) solutions?
Answer: B
Which of the following BEST enables an organization to mitigate ethical risk?
Answer: C
You are the project manager of GHT project. You have applied certain control to prevent the unauthorized changes in your project. Which of the following control you would have applied for this purpose?
Answer: C
Configuration management control is a family of controls that addresses both configuration management and change management. Change control practices prevent unauthorized changes. They include goals such as configuring systems for least functionality as a primary method of hardening systems. Incorrect Answers: A: The Personal security control is family of controls that includes aspects of personnel security. It includes personnel screening, termination, and transfer. B: Access control is the family of controls that helps an organization implement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties. D: Physical and environment protection control are the family that provides an extensive number of controls related to physical security.
Source: Adapted from community discussion — Kennethlim79
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 641. 1449 questions available.
Version 1.0.0. How we source questions