Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Information that is no longer required to support business objectives should be:
Answer: A
Securely deleted according to the disposal policy: When information is no longer required to support business objectives, it should be securely deleted to protect sensitive data and comply with data protection regulations. This action prevents unauthorized access and potential data breaches.
Source: Adapted from community discussion — Sara98
Which of the following would be MOST helpful in assessing the risk associated with data loss due to human vulnerabilities?
Answer: B
While surveys can provide valuable data on employees' knowledge and attitudes towards security, they may not accurately reflect real-world behavior under pressure or in the face of social engineering tactics.
Source: Adapted from community discussion — Sara98
A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk to acceptable levels. Which of the following should the risk practitioner do FIRST?
Answer: C
D. Review organizational ethics policies. The first action the risk practitioner should take is to review the organization's ethics policies to fully understand the policies regarding gifts, conflicts of interest, and how to handle such situations
Source: Adapted from community discussion — cyberbugnx
Which of the following is MOST critical to the successful adoption of an enterprise architecture (EA) program?
Answer: D
Management has implemented additional administrative and technical controls to reduce the likelihood of a high-impact risk in a key information system. What is the BEST way to validate the effectiveness of the control implementation?
Answer: C
C. Perform a penetration test. Penetration testing, also known as pen testing, involves simulating real-world attacks on systems, networks, and applications to identify vulnerabilities that could be exploited by malicious actors. By conducting penetration tests, organizations can assess the effectiveness of their control measures in mitigating potential risks and identify any residual vulnerabilities that may exist despite the implementation of controls.
Source: Adapted from community discussion — Baddest
The MAIN reason to use the risk register to monitor aggregated risk is to provide:
Answer: C
The main reason to use the risk register to monitor aggregated risk is to provide a comprehensive view of risk impact. The risk register is a central repository that documents and tracks all identified risks within an organization. It includes information such as the likelihood of occurrence, potential impact, risk owners, and mitigation strategies. By maintaining a risk register, organizations can effectively monitor and assess the overall impact of aggregated risks. This allows them to prioritize and allocate resources for risk management activities based on the severity and potential consequences of each risk. The risk register provides a holistic view of the organization's risk landscape, enabling management to make informed decisions regarding risk mitigation strategies, control implementation, and resource allocation. It helps identify control gaps by highlighting areas where existing controls may be insufficient or ineffective in addressing the identified risks.
Source: Adapted from community discussion — Radko96
When outsourcing a business process to a cloud service provider, it is MOST important to understand that:
Answer: D
Which of the following situations would cause the GREATEST concern around the integrity of application logs?
Answer: D
Which of the following is the MOST significant risk factor associated with the use of blockchain in legacy systems?
Answer: C
Which of the following should be the starting point when performing a risk analysis for an asset?
Answer: C
C. Evaluate threats. Evaluating threats involves identifying potential sources of harm or danger to the asset. By understanding the threats that could impact the asset, organizations can better assess the associated risks and implement appropriate controls to mitigate them effectively. Threat evaluation provides essential context for analyzing the likelihood and potential impact of various risk scenarios associated with the asset.
Source: Adapted from community discussion — Baddest
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 691. 1449 questions available.
Version 1.0.0. How we source questions