CRISC practice questions 821–830

1. Question 821 · 1449 in bank

   When reviewing management's IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?

   • APropose mitigating controls
   • BAssess management's risk tolerance
   • CRecommend management accept the low risk scenarios
   • DRe-evaluate the risk scenarios associated with the control

   Show answer

   Answer: D

   Explanation

   Answer should be D. The control is ineffective and linked to multiple low risks so there is potential of ineffective control to increase the risk when aggregated. So reevaluation of risk seems like a best fit here.

   Source: Adapted from community discussion — khushiag

   Next question

2. Question 822 · 1449 in bank

   The BEST way to determine the likelihood of a system availability risk scenario is by assessing the:

   • Aavailability of fault tolerant software
   • Bstrategic plan for business growth
   • Cvulnerability scan results of critical systems
   • Dredundancy of technical infrastructure

   Show answer

   Answer: C

   Explanation

   C. From an ISACA mindset, the best way to determine the likelihood of a system availability risk scenario would be to assess option C, which is the vulnerability scan results of critical systems.

   Source: Adapted from community discussion — Petza

   Next question

3. Question 823 · 1449 in bank

   When an organization's disaster recovery plan has a reciprocal agreement, which of the following risk treatment options is being applied?

   • ATransfer
   • BAvoidance
   • CAcceptance
   • DMitigation

   Show answer

   Answer: A

   Explanation

   NO. When an organization's disaster recovery plan has a reciprocal agreement, the risk treatment option being applied is Transfer. A reciprocal agreement in a disaster recovery plan is a type of risk transfer in which two organizations agree to provide reciprocal support in the event of a disaster. If one organization experiences a disaster that affects its ability to operate, the other organization agrees to provide support and resources to help the affected organization recover. In exchange, the first organization agrees to provide support and resources to the second organization if it experiences a disaster.

   Source: Adapted from community discussion — john_boogieman

   Next question

4. Question 824 · 1449 in bank

   The BEST reason to classify IT assets during a risk assessment is to determine the:

   • Aappropriate level of protection
   • Benterprise risk profile
   • Cpriority in the risk register
   • Dbusiness process owner

   Show answer

   Answer: A

   Next question

5. Question 825 · 1449 in bank

   Which of the following would BEST help to ensure that suspicious network activity is identified?

   • AAnalyzing server logs
   • BCoordinating events with appropriate agencies
   • CAnalyzing intrusion detection system (IDS) logs
   • DUsing a third-party monitoring provider

   Show answer

   Answer: C

   Next question

6. Question 826 · 1449 in bank

   Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?

   • AImplement segregation of duties
   • BEnforce an internal data access policy
   • CEnforce the use of digital signatures
   • DApply single sign-on for access control

   Show answer

   Answer: B

   Explanation

   Answer should be B. Even if internal users use SSO, they should not have access to those data By default if it is restricted for them.

   Source: Adapted from community discussion — Rooks

   Next question

7. Question 827 · 1449 in bank

   A risk practitioner is developing a set of bottom-up IT risk scenarios. The MOST important time to involve business stakeholders is when:

   • Aidentifying risk mitigation controls
   • Bdocumenting the risk scenarios
   • Cvalidating the risk scenarios
   • Dupdating the risk register

   Show answer

   Answer: C

   Next question

8. Question 828 · 1449 in bank

   Which of the following is MOST important to the effectiveness of key performance indicators (KPIs)?

   • AManagement approval
   • BAutomation
   • CAnnual review
   • DRelevance

   Show answer

   Answer: D

   Explanation

   KRI effectiveness takes into consideration the following criteria: • Impact—Indicators of risk with high business impact are more likely to be KRIs. • Effort—For different indicators that are equivalent in sensitivity, the one that is easier to measure and maintain is preferred. • Reliability—The indicator must possess a high correlation with the risk and be a good predictor or outcome measure. • Sensitivity—The indicator must be representative of risk and capable of accurately indicating risk variances. • Repeatable—A KRI must be repeatable and able to be measured on a regular basis to show trends and patterns in activity and results. KRI optimization: Sensitivity Management has implemented an automated tool to analyze and report on access control logs based on severity, and the tool generates an excessive number of results. Management performs a risk assessment and decides to configure the monitoring tool to report only on alerts marked “critical.”

   Source: Adapted from community discussion — Ceecil1959

   Next question

9. Question 829 · 1449 in bank

   What should be PRIMARILY responsible for establishing an organization's IT risk culture?

   • ARisk management
   • BIT management
   • CBusiness process owner
   • DExecutive management

   Show answer

   Answer: D

   Explanation

   Reference: https://www.casact.org/education/infocus/2014/handouts/Paper_3464_handout_2190_0.pdf

   

   Next question

10. Question 830 · 1449 in bank

    Which of the following is the GREATEST benefit to an organization when updates to the risk register are made promptly after the completion of a risk assessment?

    • AImproved senior management communication
    • BEnhanced awareness of risk management
    • COptimized risk treatment decisions
    • DImproved collaboration among risk professionals

    Show answer

    Answer: C

    Explanation

    answer is B. Because a risk regs is a centrailized documentation that allows key stake holders to see risks within a organization.

    Source: Adapted from community discussion — GRamos

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 821. 1449 questions available.