CRISC practice questions 841–850

1. Question 841 · 1449 in bank

   IT stakeholders have asked a risk practitioner for IT risk profile reports associated with specific departments to allocate resources for risk mitigation. The BEST way to address this request would be to use:

   • Ahistorical risk assessments
   • Bkey risk indicators (KRIs)
   • Cthe cost associated with each control
   • Dinformation from the risk register

   Show answer

   Answer: D

   Explanation

   I am not sure of option "D". KRI's (option B) provides more insight on critical risks for each department. The question is tricky . if it is straight forward then option "D" . Otherwise option "B"

   Source: Adapted from community discussion — mraiyan

   Next question

2. Question 842 · 1449 in bank

   To help ensure the success of a major IT project, it is MOST important to:

   • Aobtain approval from business process owners
   • Bobtain the appropriate stakeholders' commitment
   • Cupdate the risk register on a regular basis
   • Dalign the project with the IT risk framework

   Show answer

   Answer: B

   Next question

3. Question 843 · 1449 in bank

   A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management. The BEST way to support risk-based decisions by senior management would be to:

   • Aquantify key risk indicators (KRIs)
   • Brecommend risk tolerance thresholds
   • Cprovide a quantified detailed analysis
   • Dmap findings to objectives

   Show answer

   Answer: D

   Next question

4. Question 844 · 1449 in bank

   Which of the following is an administrative control?

   • AWater detection
   • BReasonableness check
   • CData loss prevention program
   • DSession timeout

   Show answer

   Answer: C

   Explanation

   DLP is a technical solution.. What is the reasonable test in auditing? Reasonableness test is an audit procedure that the auditors would use to examine the reasonableness of accounting events or transactions that a company has recorded in its financial statements.

   Source: Adapted from community discussion — eblue

   Next question

5. Question 845 · 1449 in bank

   When determining which control deficiencies are most significant, which of the following would provide the MOST useful information?

   • AException handling policy
   • BBenchmarking assessments
   • CVulnerability assessment results
   • DRisk analysis results

   Show answer

   Answer: D

   Explanation

   Definitely C, vulnerability assessment helps to identify and classify weakness in the design, implementation, operation or internal control of a process. It supports the risk analysis but for control deficiencies woul be the best information based on the vul assessment result.

   Source: Adapted from community discussion — babaace

   Next question

6. Question 846 · 1449 in bank

   A program manager has completed an unsuccessful disaster recovery test. Which of the following should the risk practitioner recommend as the NEXT course of action?

   • AIdentify what additional controls are needed
   • BUpdate the business impact analysis (BIA)
   • CPrioritize issues noted during the testing window
   • DCommunicate test results to management

   Show answer

   Answer: D

   Explanation

   The next course of action after an unsuccessful disaster recovery test should be to communicate test results to management. This will allow management to be aware of the issues that were identified during the test and to make decisions about how to proceed.

   Source: Adapted from community discussion — Kennethlim79

   Next question

7. Question 847 · 1449 in bank

   Which of the following should be the MOST important consideration when determining controls necessary for a highly critical information system?

   • AThe number of vulnerabilities to the system
   • BThe level of acceptable risk to the organization
   • CThe organization's available budget
   • DThe number of threats to the system

   Show answer

   Answer: B

   Explanation

   B. The level of acceptable risk to the organization The MOST important consideration when determining controls necessary for a highly critical information system should be "B. The level of acceptable risk to the organization." The controls implemented for a highly critical information system should align with the organization's risk appetite and tolerance. It's crucial to assess and define what level of risk the organization is willing to accept for this critical system and its associated data and functionalities. While the other options (A. The number of vulnerabilities to the system, C. The organization's available budget, D. The number of threats to the system) are relevant factors in control selection, they should be considered in conjunction with the organization's risk tolerance. The level of acceptable risk sets the context for determining the appropriate controls to manage vulnerabilities, threats, and costs effectively.

   Source: Adapted from community discussion — Staanlee

   Next question

8. Question 848 · 1449 in bank

   When defining thresholds for control key performance indicators (KPIs), it is MOST helpful to align:

   • Akey risk indicators (KRIs) with risk appetite of the business
   • Bthe control key performance indicators (KPIs) with audit findings
   • Ccontrol performance with risk tolerance of business owners
   • Dinformation risk assessments with enterprise risk assessments

   Show answer

   Answer: C

   Explanation

   Why C? the question is talking about KPI not KRI. Audit is the gap analysis between current state and desired state. Therefore, aligning your KPI with the audit findings makes more sense. Right?

   Source: Adapted from community discussion — Ics2Pass

   Next question

9. Question 849 · 1449 in bank

   Which of the following is MOST important to understand when determining an appropriate risk assessment approach?

   • AThreats and vulnerabilities
   • BValue of information assets
   • CComplexity of the IT infrastructure
   • DManagement culture

   Show answer

   Answer: A

   Explanation

   Threats and vulnerabilities are the most important factors to consider when determining an appropriate risk assessment approach. Understanding the specific threats and vulnerabilities that an organization faces is critical to identifying and assessing the risks that could impact the organization's information assets. The value of the information assets is also important to consider, but it should be assessed in the context of the potential impact of the identified risks.

   Source: Adapted from community discussion — john_boogieman

   Next question

10. Question 850 · 1449 in bank

    A PRIMARY advantage of involving business management in evaluating and managing risk is that management:

    • Acan make better informed business decisions
    • Bbetter understands the system architecture
    • Ccan balance technical and business risk
    • Dis more objective than risk management

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 841. 1449 questions available.