CRISC practice questions 831–840

1. Question 831 · 1449 in bank

   After a high-profile systems breach at an organization's key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:

   

   Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor's control environment?

   • AExternal audit
   • BInternal audit
   • CVendor performance scorecard
   • DRegulatory examination

   Show answer

   Answer: A

   Explanation

   The internal audit in this case was done by a vendor not IT, and it was about IT risk management so B is the correct answer

   Source: Adapted from community discussion — hussmohsin

   Next question

2. Question 832 · 1449 in bank

   A change management process has recently been updated with new testing procedures. The NEXT course of action is to:

   • Acommunicate to those who test and promote changes
   • Bassess the maturity of the change management process
   • Cconduct a cost-benefit analysis to justify the cost of the control
   • Dmonitor processes to ensure recent updates are being followed

   Show answer

   Answer: A

   Next question

3. Question 833 · 1449 in bank

   Mary is a project manager in her organization. On her current project she is working with her project team and other key stakeholders to identify the risks within the project. She is currently aiming to create a comprehensive list of project risks so she is using a facilitator to help generate ideas about project risks. What risk identification method is Mary likely using?

   • ADelphi Techniques
   • BExpert judgment
   • CBrainstorming
   • DChecklist analysis

   Show answer

   Answer: C

   Explanation

   Mary is using brainstorming in this example. Brainstorming attempts to create a comprehensive list of risks and often is led by a moderator or facilitator to move the process along. Brainstorming is a technique to gather general data. It can be used to identify risks, ideas, or solutions to issues by using a group of team members or subject- matter expert. Brainstorming is a group creativity technique that also provides other benefits, such as boosting morale, enhancing work enjoyment, and improving team work. Incorrect Answers: A: The Delphi technique uses rounds of anonymous surveys to generate a consensus on the identified risks. B: Expert judgment is not the best answer for this; projects experts generally do the risk identification, in addition to the project team. D: Checklist analysis uses historical information and information from similar projects within the organization's experience.

   Next question

4. Question 834 · 1449 in bank

   For a large software development project, risk assessments are MOST effective when performed:

   • Aduring the development of the business case
   • Bat each stage of the system development life cycle (SDLC)
   • Cat system development
   • Dbefore system development begins

   Show answer

   Answer: B

   Next question

5. Question 835 · 1449 in bank

   All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness., the BEST course of action would be to:

   • Aoutsource disaster recovery to an external provider
   • Bselect a provider to standardize the disaster recovery plans
   • Cevaluate opportunities to combine disaster recovery plans
   • Dcentralize the risk response function at the enterprise level

   Show answer

   Answer: C

   Explanation

   We are looking for the cost effective option which is "C". "D" is a good option but needs some investment to create a function to centralize the risk response.

   Source: Adapted from community discussion — mraiyan

   Next question

6. Question 836 · 1449 in bank

   Which of the following approaches would BEST help to identify relevant risk scenarios?

   • AEngage line management in risk assessment workshops
   • BEscalate the situation to risk leadership
   • CEngage internal audit for risk assessment workshops
   • DReview system and process documentation

   Show answer

   Answer: A

   Explanation

   'should', 'my opinion', is ok, but a reading and understanding of the CRISC content and a well-founded and verifiable reasoning would be desirable. Reviewing audit reports, interviewing end users/IT staff, or observing business processes or operations in action can also provide a useful basis for scenario development. Of the options listed, 'A' provides a broader view to identify 'relevant risk scenarios'. In addition, in the section on 'risk scenario techniques' of the 7th CRISC manual it is indicated: ensure the requirements of adequate people and skills to develop relevant risk scenarios. Senior management has the best insight into the business impact that will benefit from holding workshops.

   Source: Adapted from community discussion — john_boogieman

   Next question

7. Question 837 · 1449 in bank

   When developing IT risk scenarios, it is CRITICAL to involve:

   • Aprocess owners
   • BIT managers
   • Cinternal auditors
   • Dsenior management

   Show answer

   Answer: A

   Explanation

   Involving process owners is critical when developing IT risk scenarios. They possess the detailed understanding of their specific processes, systems, and associated risks. They are intimately familiar with the daily operations and potential vulnerabilities, making them a crucial resource in identifying and assessing potential risk scenarios.

   Source: Adapted from community discussion — 01010100

   Next question

8. Question 838 · 1449 in bank

   Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?

   • AAn access control list
   • BAn acceptable usage policy
   • CAn intrusion detection system (IDS)
   • DA data extraction tool

   Show answer

   Answer: B

   Next question

9. Question 839 · 1449 in bank

   Which of the following would be an IT business owner's BEST course of action following an unexpected increase in emergency changes?

   • AConducting a root-cause analysis
   • BValidating the adequacy of current processes
   • CEvaluating the impact to control objectives
   • DReconfiguring the IT infrastructure

   Show answer

   Answer: A

   Next question

10. Question 840 · 1449 in bank

    Which of the following would require updates to an organization's IT risk register?

    • ADiscovery of an ineffectively designed key IT control
    • BManagement review of key risk indicators (KRIs)
    • CChanges to the team responsible for maintaining the register
    • DCompletion of the latest internal audit

    Show answer

    Answer: A

    Explanation

    Agree with "A". However, the question must be reworded to be "Which of the following would MOST require updates to an organization's IT risk register?" as most of the options (except option C) would impact the content of the risk register

    Source: Adapted from community discussion — mraiyan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 831. 1449 questions available.