CRISC practice questions 651–660

1. Question 651 · 1449 in bank

   A risk practitioner is performing a risk assessment of recent external advancements in quantum computing. Which of the following would pose the GREATEST concern for the risk practitioner?

   • AThe organization has not reviewed its encryption standards.
   • BThe organization has not adopted Infrastructure as a Service (IaaS) for its operations.
   • CThe organization has implemented heuristics on its network firewall.
   • DThe organization has incorporated blockchain technology in its operations.

   Show answer

   Answer: A

   Explanation

   he greatest concern for the risk practitioner regarding recent external advancements in quantum computing would likely be option A: "The organization has not reviewed its encryption standards." Quantum computing has the potential to render many current encryption standards obsolete due to its capability to break commonly used encryption algorithms like RSA and ECC (Elliptic Curve Cryptography). If the organization has not reviewed its encryption standards in light of advancements in quantum computing, it could leave sensitive data vulnerable to attacks once quantum computers become more powerful and practical.

   Source: Adapted from community discussion — Joloms

   Next question

2. Question 652 · 1449 in bank

   Which of the following is MOST important for developing effective key risk indicators (KRIs)?

   • AIncluding input from risk and business unit management
   • BEngaging sponsorship by senior management
   • CUtilizing data and resources internal to the organization
   • DDeveloping in collaboration with internal audit

   Show answer

   Answer: A

   Next question

3. Question 653 · 1449 in bank

   Which of the following practices MOST effectively safeguards the processing of personal data?

   • APersonal data attributed to a specific data subject is tokenized.
   • BData protection impact assessments are performed on a regular basis.
   • CPersonal data certifications are performed to prevent excessive data collection.
   • DData retention guidelines are documented, established, and enforced.

   Show answer

   Answer: B

   Next question

4. Question 654 · 1449 in bank

   Ben is the project manager of the CMH Project for his organization. He has identified a risk that has a low probability of happening, but the impact of the risk event could save the project and the organization with a significant amount of capital. Ben assigns Laura to the risk event and instructs her to research the time, cost, and method to improve the probability of the positive risk event. Ben then communicates the risk event and response to management. What risk response has been used here?

   • ATransference
   • BEnhance
   • CExploit
   • DSharing

   Show answer

   Answer: B

   Explanation

   Enhance is a risk response to improve the conditions to ensure the risk event occurs. Risk enhancement raises the probability of an opportunity to take place by focusing on the trigger conditions of the opportunity and optimizing the chances. Identifying and maximizing input drivers of these positive-impact risks may raise the probability of their occurrence. Incorrect Answers: A: Transference is a strategy to mitigate negative risks or threats. In this strategy, consequences and the ownership of a risk is transferred to a third party. This strategy does not eliminate the risk but transfers responsibility of managing the risk to another party. Insurance is an example of transference. C: Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response. D: Sharing happens through partnerships, joint ventures, and teaming agreements. Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.

   Source: Adapted from community discussion — maheshexam

   Next question

5. Question 655 · 1449 in bank

   Which of the following should be the PRIMARY consideration when assessing tools for automated control monitoring?

   • ACost-benefit analysis
   • BContinuity plan
   • CEnterprise architecture (EA)
   • DRisk register

   Show answer

   Answer: A

   Next question

6. Question 656 · 1449 in bank

   When reporting to senior management on changes in trends related to IT risk, which of the following is MOST important?

   • AMaturity
   • BMateriality
   • CConfidentiality
   • DTransparency

   Show answer

   Answer: B

   Next question

7. Question 657 · 1449 in bank

   Which of the following BEST demonstrates that an implemented control is effective in mitigating the intended risk?

   • ASuccessful outcome of an external audit
   • BAccurate reporting of control test results to management
   • CSuccessful completion of risk action plans related to the control
   • DAppropriate assignment of control ownership to mitigate risk

   Show answer

   Answer: C

   Next question

8. Question 658 · 1449 in bank

   An organization uses a web application hosted by a cloud service that is populated by data sent to the vendor via email on a monthly basis. Which of the following should be the FIRST consideration when analyzing the risk associated with the application?

   • AWhether the service provider contract allows right of onsite audit
   • BWhether the service provider's data center is located in the same country
   • CWhether the data has been appropriately classified
   • DWhether the data sent by email has been encrypted

   Show answer

   Answer: D

   Next question

9. Question 659 · 1449 in bank

   Which of the following is MOST important for management to consider when deciding whether to invest in an IT initiative that exceeds management's risk appetite?

   • ARisk management budget
   • BRisk tolerance
   • CRisk capacity
   • DRisk management industry trends

   Show answer

   Answer: B

   Next question

10. Question 660 · 1449 in bank

    Which of the following actions assures management that the organization's objectives are protected from the occurrence of risk events?

    • AInternal control
    • BRisk management
    • CHedging
    • DRisk assessment

    Show answer

    Answer: A

    Explanation

    A. Internal control Internal control is a set of processes, policies, and procedures implemented by an organization to safeguard its assets, ensure accuracy in financial reporting, and achieve operational effectiveness and efficiency. It helps assure management that the organization's objectives are protected from the occurrence of risk events by mitigating, detecting, and preventing risks. Internal controls are designed to manage and reduce risks within the organization, making them a key component of risk management. While risk management (option B) is a broader concept that encompasses various activities, including risk assessment and mitigation, internal controls specifically focus on the protection of the organization's objectives from risk events. Hedging (option C) is a financial strategy used to offset risks associated with financial instruments, while risk assessment (option D) is a part of the risk management process that involves identifying and analyzing risks.

    Source: Adapted from community discussion — SuperMax

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 651. 1449 questions available.