CRISC practice questions 861–870

1. Question 861 · 1449 in bank

   An organization has been notified that a disgruntled, terminated IT administrator has tried to break into the corporate network. Which of the following discoveries should be of GREATEST concern to the organization?

   • AA brute force attack has been detected
   • BAn external vulnerability scan has been detected
   • CAn increase in support requests has been observed
   • DAuthentication logs have been disabled

   Show answer

   Answer: D

   Explanation

   D. Authentication logs have been disabled The deactivation or disabling of authentication logs is a major concern because these logs record user activity and are critical for detecting and investigating potential security incidents. Without these logs, it becomes extremely difficult to trace unauthorized activity or attacks.

   Source: Adapted from community discussion — 01010100

   Next question

2. Question 862 · 1449 in bank

   When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes:

   • Arecommendations by an independent risk assessor
   • Ba summary of incidents that have impacted the organization
   • Ca detailed view of individual risk exposures
   • Drisk exposure in business terms

   Show answer

   Answer: D

   Explanation

   Raj1510 is not usually wrong :-). Senior management is an executive profile, everything that has to do with 'detailed', 'technical', etc. it is incompatible with the type of information of interest that they seek to obtain. For those who don't know, there is a 'trick' in many ISACA answers, pay special attention to those that mention 'business', 'business objectives', etc.

   Source: Adapted from community discussion — john_boogieman

   Next question

3. Question 863 · 1449 in bank

   An organization has granted a vendor access to its data in order to analyze customer behavior. Which of the following would be the MOST effective control to mitigate the risk of customer data leakage?

   • ARestrict access to customer data on a ג€need to knowג€ basis
   • BEnforce criminal background checks
   • CMask customer data fields
   • DRequire vendor to sign a confidentiality agreement

   Show answer

   Answer: A

   Explanation

   I think D would be the answer to ensure whatever access is the vendor has (including need to know basis) is not leaked. Then again ISACA may think otherwise in terms of answering this question and to pass.

   Source: Adapted from community discussion — Rooks

   Next question

4. Question 864 · 1449 in bank

   Where are all risks and risk responses documented as the project progresses?

   • ARisk management plan
   • BProject management plan
   • CRisk response plan
   • DRisk register

   Show answer

   Answer: D

   Explanation

   All risks, their responses, and other characteristics are documented in the risk register. As the project progresses and the conditions of the risk events change, the risk register should be updated to reflect the risk conditions. Incorrect Answers: A: The risk management plan addresses the project management's approach to risk management, risk identification, analysis, response, and control. B: The project management plan is the overarching plan for the project, not the specifics of the risk responses and risk identification. C: The risk response plan only addresses the planned risk responses for the identified risk events in the risk register.

   Next question

5. Question 865 · 1449 in bank

   An organization has recently hired a large number of part-time employees. During the annual audit, it was discovered that many user IDs and passwords were documented in procedure manuals for use by the part-time employees. Which of the following BEST describes this situation?

   • ARisk
   • BPolicy violation
   • CThreat
   • DVulnerability

   Show answer

   Answer: D

   Next question

6. Question 866 · 1449 in bank

   The PRIMARY advantage of implementing an IT risk management framework is the:

   • Aalignment of business goals with IT objectives
   • Bimprovement of controls within the organization and minimized losses
   • Ccompliance with relevant legal and regulatory requirements
   • Destablishment of a reliable basis for risk-aware decision making

   Show answer

   Answer: D

   Explanation

   Answer is D per the QAE 5th Edition book R1-25 The MAIN objective of IT risk management is to: A. prevent loss of IT assets. B. provide timely management reports. C. ensure regulatory compliance. D. enable risk-aware business decisions. D is the correct answer. Justification: A. Protecting IT assets in support of business objectives is a subordinate goal of IT risk management. B. IT risk management can add value to reports; for example, it helps to document measurable return on IT investment. However, reporting and timeliness are subordinate goals of IT risk management. C. Meeting regulatory compliance requirements is a one of the objectives in an IT risk management framework. D. IT risk management should be conducted as part of enterprisewide risk management, whose ultimate objective is to support risk-aware business decisions.

   Source: Adapted from community discussion — Boubou480

   Next question

7. Question 867 · 1449 in bank

   It is MOST important for a risk practitioner to have an awareness of an organization's processes in order to:

   • Aperform a business impact analysis (BIA)
   • Bestablish risk guidelines
   • Cunderstand control design
   • Didentify potential sources of risk

   Show answer

   Answer: D

   Next question

8. Question 868 · 1449 in bank

   The MAIN purpose of conducting a control self-assessment (CSA) is to:

   • Areduce the dependency on external audits
   • Bgain a better understanding of the risk in the organization
   • Cgain a better understanding of the control effectiveness in the organization
   • Dadjust the controls prior to an external audit

   Show answer

   Answer: C

   Next question

9. Question 869 · 1449 in bank

   Which of the following would present the GREATEST challenge when assigning accountability for control ownership?

   • AUnclear reporting relationships
   • BWeak governance structures
   • CSenior management scrutiny
   • DComplex regulatory environment

   Show answer

   Answer: A

   Next question

10. Question 870 · 1449 in bank

    If preventive controls cannot be implemented due to technology limitations, which of the following should be done FIRST to reduce risk?

    • ARedefine the business process to reduce the risk
    • BEvaluate alternative controls
    • CDevelop a plan to upgrade technology
    • DDefine a process for monitoring risk

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 861. 1449 questions available.