Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
The number of tickets to rework application code has significantly exceeded the established threshold. Which of the following would be the risk practitioner's BEST recommendation?
Answer: C
Should be C - Root cause analysis is a process of diagnosis to establish the origins of events, which can be used for learning from consequences, typically from errors and problems.
Source: Adapted from community discussion — Tsuresh
Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?
Answer: A
Sorry, best 'D': The ability to aggregate data is the most important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time. KRIs are used to track and monitor the performance of key risk drivers that have a significant impact on an organization's ability to achieve its objectives. To be effective, KRIs should be capable of being measured consistently over time and across different business units, and the data should be easily aggregated and analyzed to identify trends and patterns that may signal emerging risks. By selecting KRIs that can be easily aggregated and monitored, organizations can quickly identify and respond to changing risk conditions, and take corrective action to prevent or mitigate negative impacts.
Source: Adapted from community discussion — john_boogieman
An organization has raised the risk appetite for technology risk. The MOST likely result would be:
Answer: D
D. increased inherent risk When an organization raises the risk appetite for technology risk, the MOST likely result would be "D. increased inherent risk." Inherent risk refers to the level of risk that exists in the absence of any controls or risk mitigation efforts. By raising the risk appetite, the organization is essentially indicating its willingness to accept a higher level of risk. This means that more risks may be considered acceptable and left unmitigated, leading to an increase in the inherent risk level. While the other options (A. lower risk management cost, B. decreased residual risk, C. higher risk management cost) may have some relevance in certain scenarios, raising the risk appetite primarily influences the organization's willingness to tolerate higher levels of risk, impacting the inherent risk level accordingly.
Source: Adapted from community discussion — Staanlee
Which of the following provides an organization with the MOST insight with regard to operational readiness associated with risk?
Answer: A
From the 7th CRISC manual, 'with the help of a maturity model, companies can set realistic long-term goals for risk management by having a clear understanding of their current maturity and areas for improvement'.
Source: Adapted from community discussion — john_boogieman
To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:
Answer: A
The BEST control to mitigate the risk associated with project scope creep is to:
Answer: B
Some give answers without having searched and contrasted the information. It's 'B', and it's not an opinion. https://www.isaca.org/resources/glossary#Scope%20creep Scope creep can occur when the scope of a project is not properly defined, documented and controlled. Typically, the scope increase consists of either new products or new features of already approved products. Hence, the project team drifts away from its original purpose. Because of one's tendency to focus on only one dimension of a project, scope creep can also result in a project team overrunning its original budget and schedule. For example, scope creep can be a result of poor change control, lack of proper identification of what products and features are required to bring about the achievement of project objectives in the first place, or a weak project manager or executive sponsor.
Source: Adapted from community discussion — john_boogieman
As part of an overall IT risk management plan, an IT risk register BEST helps management:
Answer: C
Obviously to answer this you have to know what a Risk register is: A list of risk that have been identified, analyzed and prioritized.
Source: Adapted from community discussion — john_boogieman
Which of the following would be the BEST way to help ensure the effectiveness of a data loss prevention (DLP) control that has been implemented to prevent the loss of credit card data?
Answer: C
C. Testing the transmission of credit card numbers The best way to ensure the effectiveness of a DLP control, especially one that's intended to prevent the loss of sensitive data like credit card numbers, would be to test the system by attempting to transmit credit card numbers. If the system works as intended, it should detect and block such attempts, thereby proving its effectiveness. A. While reviewing logs for unauthorized data transfers is an important activity for overall security, it does not proactively test the DLP control's ability to prevent loss of credit card data. B. Configuring the DLP control to block credit card numbers is a necessary setup step, but it doesn't ensure the effectiveness of the control. The effectiveness can only be ensured by testing. D. Testing the DLP rule change control process could be important to ensure changes to rules are properly managed, but it does not directly validate the effectiveness of the DLP control in preventing the loss of credit card data.
Source: Adapted from community discussion — 01010100
An IT department has organized training sessions to improve user awareness of organizational information security policies. Which of the following is the BEST key performance indicator (KPI) to reflect effectiveness of the training?
Answer: B
B. Percentage of staff members who complete the training with a passing score This KPI directly reflects the ability of the staff to understand and retain the information that was presented during the training sessions. It's not just about attending the training or providing positive feedback, but actually comprehending and being able to apply the information from the training to their roles, which is typically evaluated through some form of assessment or test. This is the most direct measurement of the training's effectiveness in increasing the staff's awareness and understanding of the organization's information security policies.
Source: Adapted from community discussion — 01010100
Which of the following is a PRIMARY benefit of engaging the risk owner during the risk assessment process?
Answer: A
A. Accurate measurement of loss impact The PRIMARY benefit of engaging the risk owner during the risk assessment process is "A. Accurate measurement of loss impact." The risk owner, who typically has a deep understanding of the risk, its potential consequences, and its impact on the organization, can provide valuable insights and information that contribute to accurately assessing the potential loss associated with a specific risk. Their input helps in quantifying the impact more precisely, aiding the organization in making informed risk management decisions.
Source: Adapted from community discussion — Staanlee
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 851. 1449 questions available.
Version 1.0.0. How we source questions