CRISC practice questions 671–680

1. Question 671 · 1449 in bank

   Which of the following should be of MOST concern to a risk practitioner reviewing the system development life cycle (SDLC)?

   • ASegregation of duties controls are overridden during user testing phases
   • BTesting is completed by IT support users without input from end users
   • CData anonymization is used during all cycles of end user testing
   • DTesting is completed in phases with user testing scheduled as the final phase

   Show answer

   Answer: A

   Explanation

   A. Segregation of duties controls are overridden during user testing phases Segregation of duties controls are critical for preventing fraud and errors by ensuring that no single individual has the ability to execute a critical process from beginning to end without oversight. Overriding these controls during user testing phases could potentially lead to unauthorized or inappropriate actions being taken, increasing the risk of fraud, errors, or data breaches. Therefore, a risk practitioner would be particularly concerned if segregation of duties controls were compromised during any phase of the SDLC, as it could introduce significant risks to the development process and the resulting system

   Source: Adapted from community discussion — Baddest

   Next question

2. Question 672 · 1449 in bank

   Which of the following would MOST likely cause senior management to lower the risk tolerance level?

   • AOrganizational restructuring
   • BIncrease in penalties for unauthorized data disclosure
   • COutsourcing of in-house software development
   • DDecrease in budget allocated for risk mitigation activities

   Show answer

   Answer: B

   Explanation

   risk tolerance = The level of risk taking acceptable to achieve a specific objective or manage a category of risk - therefore, if there are greater penalties for data disclosure, then this is most likely to cause senior management to lower the tolerance level.

   Source: Adapted from community discussion — Callumhindmarsh

   Next question

3. Question 673 · 1449 in bank

   You are the project manager of HGT project. You are in the first phase of the risk response process and are doing following tasks : Communicating risk analysis results Reporting risk management activities and the state of compliance Interpreting independent risk assessment findings Identifying business opportunities Which of the following process are you performing?

   • AArticulating risk
   • BMitigating risk
   • CTracking risk
   • DReporting risk

   Show answer

   Answer: A

   Explanation

   Articulating risk is the first phase in the risk response process to ensure that information on the true state of exposures and opportunities are made available in a timely manner and to the right people for appropriate response. Following are the tasks that are involved in articulating risk: ✑ Communicate risk analysis results. ✑ Report risk management activities and the state of compliance. ✑ Interpret independent risk assessment findings. ✑ Identify business opportunities. Incorrect Answers: B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level. Risk mitigation can utilize various forms of control carefully integrated together. This comes under risk response process and is latter stage after articulating risk. C: Tracking risk is the process of tracking the ongoing status of risk mitigation processes. This tracking ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule. D: This is not related to risk response process. It is a type of risk. Reporting risks are the risks that are caused due to wrong reporting which leads to bad decision.

   Source: Adapted from community discussion — Kennethlim79

   Next question

4. Question 674 · 1449 in bank

   A Software as a Service (SaaS) company wants to use aggregated data from its clients to improve its services via a machine learning model. However, its contracts do not clearly allow this use of aggregated data. What should the organization do NEXT?

   • AUpdate the organization’s data processing agreement template
   • BRequest internal risk acceptance from senior management.
   • CRequest formal consent from clients to use their data.
   • DUpdate the organization’s privacy policy to reflect the use of aggregated data.

   Show answer

   Answer: D

   Next question

5. Question 675 · 1449 in bank

   Which of the following will be MOST effective in helping to ensure control failures are appropriately managed?

   • APeer review
   • BCompensating controls
   • CControl ownership
   • DControl procedures

   Show answer

   Answer: C

   Next question

6. Question 676 · 1449 in bank

   A risk practitioner has implemented a key risk indicator (KRI) that triggers a warning when the number of untreated IT control deficiencies exceeds a given threshold. Which of the following should be the GREATEST concern regarding the design of this KRI?

   • ASetting unrealistic targets for compliance
   • BIgnoring the significance of the control deficiencies
   • CGenerating a large number of false-positive warnings
   • DFailing to attract sufficient management support

   Show answer

   Answer: A

   Next question

7. Question 677 · 1449 in bank

   Which of the following would be MOST effective in promoting a risk-aware culture within an organization?

   • AAllocating budget for IT initiatives based on IT risk assessment results
   • BAppointing a risk committee to prioritize identified and assessed risk
   • CIssuing penalties to those who do not attend the risk awareness program
   • DUsing risk scenarios to inform organizational strategy

   Show answer

   Answer: D

   Next question

8. Question 678 · 1449 in bank

   An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following should be the risk practitioner's NEXT course of action?

   • ARemove the associated risk from the register.
   • BValidate control effectiveness and update the risk register.
   • CReview the contract and service level agreements (SLAs).
   • DObtain an assurance report from the third-party provider.

   Show answer

   Answer: C

   Next question

9. Question 679 · 1449 in bank

   Which of the following is the PRIMARY purpose of developing a risk register?

   • ATo provide a means to identify risk scenarios requiring mitigation
   • BTo provide a means to respond to risk as it arises
   • CTo provide a means to identify relevant threat actors
   • DTo provide a means to track risk as it is identified

   Show answer

   Answer: D

   Next question

10. Question 680 · 1449 in bank

    Which of the following would be the BEST input when evaluating the risk associated with a proposed adoption of robotic process automation (RPA) of a business service?

    • AControl objectives
    • BCost-benefit analysis results
    • CCode review results
    • DBusiness continuity plan (BCP)

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 671. 1449 questions available.