CRISC practice questions 871–880

1. Question 871 · 1449 in bank

   Which of the following is the BEST way to identify changes in the risk profile of an organization?

   • AMonitor key risk indicators (KRIs)
   • BMonitor key performance indicators (KPIs)
   • CConduct a gap analysis
   • DInterview the risk owner

   Show answer

   Answer: A

   Explanation

   A. Monitor key risk indicators (KRIs) Key Risk Indicators (KRIs) are designed specifically to monitor changes in the risk profile of an organization. They are a set of quantifiable measures used by organizations to monitor how risks change over time. They serve as an early warning system for problematic conditions that could harm the organization, allowing management to take action before damages occur. Other options, while important in a risk management program, are not as directly linked to identifying changes in the organization's risk profile.

   Source: Adapted from community discussion — 01010100

   Next question

2. Question 872 · 1449 in bank

   The PRIMARY benefit of conducting continuous monitoring of access controls is the ability to identify.

   • Apossible noncompliant activities that lead to data disclosure
   • Bleading or lagging key risk indicators (KRIs)
   • Cinconsistencies between security policies and procedures
   • Dunknown threats to undermine existing access controls

   Show answer

   Answer: D

   Next question

3. Question 873 · 1449 in bank

   Which of the following is MOST important for successful incident response?

   • AThe quantity of data logged by the attack control tools
   • BThe ability to trace the source of the attack
   • CThe timeliness of attack recognition
   • DBlocking the attack route immediately

   Show answer

   Answer: C

   Next question

4. Question 874 · 1449 in bank

   Effective risk communication BEST benefits an organization by:

   • Aimproving the effectiveness of IT controls
   • Bhelping personnel make better-informed decisions
   • Cincreasing participation in the risk assessment process
   • Dassisting the development of a risk register

   Show answer

   Answer: B

   Explanation

   Should be B - The benefits of open communication on risk include: • More informed risk decisions by executive management due to an improved understanding of actual exposure and potential business impact • Greater awareness among all stakeholders of the importance and value of integrating risk management into their daily duties • Transparency to external stakeholders regarding both the actual levels of risk facing the organization and the risk management processes in use

   Source: Adapted from community discussion — Tsuresh

   Next question

5. Question 875 · 1449 in bank

   The PRIMARY reason, a risk practitioner would be interested in an internal audit report is to:

   • Amaintain a risk register based on noncompliances
   • Bplan awareness programs for business managers
   • Cassist in the development of a risk profile
   • Devaluate maturity of the risk management process

   Show answer

   Answer: D

   Explanation

   The answer is : "A" :maintain a risk register based on noncompliance: Pls check CRISC REVIEW MANUAL PAGE 160Csection 4.5.2 : Updates to the risk register, risk action plans and enhancement of controls

   Source: Adapted from community discussion — Odenkyem

   Next question

6. Question 876 · 1449 in bank

   Which of the following is the PRIMARY consideration when establishing an organization's risk management methodology?

   • ARisk tolerance level
   • BBenchmarking information
   • CResource requirements
   • DBusiness context

   Show answer

   Answer: D

   Next question

7. Question 877 · 1449 in bank

   Which of the following is the BEST metric to demonstrate the effectiveness of an organization's change management process?

   • AAverage time to complete changes
   • BIncrease in the number of emergency changes
   • CPercent of unauthorized changes
   • DIncrease in the frequency of changes

   Show answer

   Answer: C

   Explanation

   I would pick C as percentage of unauthorised changes undermining the effectiveness of change mgmt process. A is more like efficiency of the change mgmt process

   Source: Adapted from community discussion — travdaman

   Next question

8. Question 878 · 1449 in bank

   Which of the following is MOST helpful in developing key risk indicator thresholds?

   • ALoss expectancy information
   • BIT service level agreements
   • CControl performance results
   • DRemediation activity progress

   Show answer

   Answer: A

   Explanation

   'A' KRI measures risk based on a risk threshold and your expectation of loss (upon reaching an unacceptable level). An SLA is a type of KPI.

   Source: Adapted from community discussion — john_boogieman

   Next question

9. Question 879 · 1449 in bank

   What is the PRIMARY reason to categorize risk scenarios by business process?

   • ATo determine aggregated risk levels by risk owner
   • BTo identify situations that result in over-control
   • CTo enable management to implement cost-effective risk mitigation
   • DTo show business activity deficiencies that need to be improved

   Show answer

   Answer: C

   Explanation

   C. To enable management to implement cost-effective risk mitigation Categorizing risk scenarios by business process is primarily done to enable management to implement cost-effective risk mitigation strategies. By understanding how different risks apply to specific business processes, management can prioritize which risks to mitigate based on the criticality of the process, the impact of the risk, and the cost of implementing controls. This helps ensure resources are efficiently utilized and the most significant risks are addressed first. While the other options may also be beneficial, they are not the primary reason for categorizing risks by business process. They are more related to the side benefits or secondary objectives of the risk management process.

   Source: Adapted from community discussion — 01010100

   Next question

10. Question 880 · 1449 in bank

    Which of the following BEST indicates the effectiveness of an organization's data loss prevention (DLP) program?

    • AReduction in financial impact associated with data loss incidents
    • BReduction in the number of false positives and false negatives
    • CReduction in the number of approved exceptions to the DLP policy
    • DReduction in the severity of detected data loss events

    Show answer

    Answer: B

    Explanation

    A DLP control runs on the rules defined to detect potential data loss incidents. Some of these may be false positive and false negative. False negative is a true risk, as it allows some breaches to be undetected. So B (Reduction in the number of false positives and false negatives) is the best answer. A - There are many factors that drives financial impact. A lower financial impact doesn't necessarily mean it was due to better DLP control. Could be sheer luck !! C - Increase/ Decrease exception to the DLP rules is not related to DLP effectiveness directly - rather a reflection of BU accepting some risks. D- Incident severity is not reflective of DLP control effectiveness.

    Source: Adapted from community discussion — huze

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 871. 1449 questions available.