Question 701 · 1449 in bank
Who should be accountable for authorizing information system access to internal users?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Who should be accountable for authorizing information system access to internal users?
Answer: B
A user has contacted the risk practitioner regarding malware spreading laterally across the organization's corporate network. Which of the following is the risk practitioner's BEST course of action?
Answer: B
A risk practitioner has reviewed new international regulations and realizes the new regulations will affect the organization. Which of the following should be the risk practitioner's NEXT course of action?
Answer: C
In this case the changes to regulation may influence and affect the risk landscape introducing certain changes hence prompting risk practioner to review the risk register and updating it with the new or revised risk scenarios as a result of the changes
Source: Adapted from community discussion — kaykaymuon
What should a risk practitioner do FIRST when an assessment reveals a control is not operating as intended?
Answer: C
I think the answer here should be C, the risk owner needs to be first aware of the control problem as he/she is the accountable individual.
Source: Adapted from community discussion — kaykaymuon
Which of the following will have the GREATEST influence on the residual risk level in an organization?
Answer: C
What are the three PRIMARY steps to be taken to initialize the project? Each correct answer represents a complete solution. (Choose three.)
Answer: ABD
This response doesn't make sense to me. What if it wasn't a software acquisition? Nothing in the question tells what the project is about.
Source: Adapted from community discussion — mclaiborne
Which of the following should be done FIRST when developing an initial set of risk scenarios for an organization?
Answer: A
You are the risk official in Techmart Inc. You are asked to perform risk assessment on the impact of losing a network connectivity for 1 day. Which of the following factors would you include?
Answer: D
The impact of network unavailability is the cost it incurs to the enterprise. As the network is unavailable for 1 day, it can be considered as the failure of some business units that rely on this network. Hence financial losses incurred by this affected business unit should be considered. Incorrect Answers: A, B, C: These factors in combination contribute to the overall financial impact, i.e., financial losses incurred by affected business units.
Which of the following events is MOST likely to trigger the need to conduct a risk assessment?
Answer: B
Beth is a project team member on the JHG Project. Beth has added extra features to the project and this has introduced new risks to the project work. The project manager of the JHG project elects to remove the features Beth has added. The process of removing the extra features to remove the risks is called what?
Answer: C
This is an example of a preventive control as the problem is not yet occurred, only it is detected and are accounted for. By removing the scope items from the project work, the project manager is aiming to remove the added risk events, hence it is a preventive control. Preventive control is a type of internal control that is used to avoid undesirable events, errors and other occurrences, which an organization has determined could have a negative material effect on a process or end product. Incorrect Answers: A: Detective controls simply detect and report on the occurrence of problems. They identify specific symptoms to potential problems. C: Corrective actions are steps to bring the future performance of the project work in line with the project management plan. These controls make effort to reduce the impact of a threat from problems discovered by detective controls. They first identify the cause of the problems, then take corrective measures and modify the systems to minimize the future occurrences of the problem. Hence an incident should take place before corrective controls come in action. D: Scope creep refers to small undocumented changes to the project scope.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 701. 1449 questions available.
Version 1.0.0. How we source questions