CRISC practice questions 881–890

1. Question 881 · 1449 in bank

   An organization has outsourced its IT security management function to an external service provider. The BEST party to own the IT security controls under this arrangement is the:

   • Aorganization's risk function
   • Bservice provider's audit function
   • Corganization's IT management
   • Dservice provider's IT security function

   Show answer

   Answer: A

   Explanation

   Sorry, I rectify by 'A'. The risk function is responsible for identifying and managing risks that could impact the organization's business objectives. It has a broader view of the organization's risk landscape and is best positioned to oversee the IT security controls that are in place to mitigate those risks. Additionally, the risk function typically has the authority to make decisions that affect the organization's risk posture and can ensure that the IT security controls implemented by the external service provider are aligned with the organization's overall risk management strategy.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 882 · 1449 in bank

   Which of the following is the FIRST step in managing the security risk associated with wearable technology in the workplace?

   • ADevelop risk awareness training
   • BMonitor employee usage
   • CIdentify the potential risk
   • DAssess the potential risk

   Show answer

   Answer: C

   Explanation

   I think the answer should be D as the risk needs to be assessed first and then plan on offering and then comes the training...

   Source: Adapted from community discussion — Rooks

   Next question

3. Question 883 · 1449 in bank

   A risk practitioner has populated the risk register with industry-based generic risk scenarios to be further assessed by risk owners. Which of the following is the GREATEST concern with this approach?

   • ARisk scenarios in the generic list may not help in building risk awareness
   • BRisk scenarios that are not relevant to the organization may be assessed
   • CDeveloping complex risk scenarios using the generic list will be difficult
   • DRelevant risk scenarios that do not appear in the generic list may not be assessed

   Show answer

   Answer: D

   Explanation

   I think it’s D because not knowing/ assessing/ mitigating a true risk (which is relevant to the company and not generic) is worse than spending time and resources on an irrelevant risk (waste).

   Source: Adapted from community discussion — PGopinath

   Next question

4. Question 884 · 1449 in bank

   An identified high-probability risk scenario involving a critical, proprietary business function has an annualized cost of control higher than the annual loss expectancy (ALE). Which of the following is the BEST risk response?

   • AAvoid
   • BTransfer
   • CAccept
   • DMitigate

   Show answer

   Answer: B

   Explanation

   I am not sure if there is a tricky in this question. The default risk response when the cost of control exceed the cost of the risk is to accept. However, this is normally for low probability/low impact risks. The scenario in the question talks about high probability risk and does not mention the impact !. I believe if the organization could avoid the risk, this will be the best answer.

   Source: Adapted from community discussion — mraiyan

   Next question

5. Question 885 · 1449 in bank

   Which of the following should be the PRIMARY focus of an IT risk awareness program?

   • ACultivate long-term behavioral change
   • BDemonstrate regulatory compliance
   • CEnsure compliance with the organization's internal policies
   • DCommunicate IT risk policy to the participants

   Show answer

   Answer: A

   Next question

6. Question 886 · 1449 in bank

   Which of the following is the BEST indicator of an effective IT security awareness program?

   • ADecreased success rate of internal phishing tests
   • BNumber of employees that complete security training
   • CNumber of disciplinary actions issued for security violations
   • DDecreased number of reported security incidents

   Show answer

   Answer: A

   Explanation

   I think the correct answer should be A. Decreased success rate of internal phishing tests. D is wrong because an effective security awareness program rather leads to an increase in reported security incidents since the users now know better.

   Source: Adapted from community discussion — Wedeyhere2

   Next question

7. Question 887 · 1449 in bank

   Which of the following is the MOST important benefit of key risk indicators (KRIs)?

   • AAssisting in continually optimizing risk governance
   • BProviding an early warning to take proactive actions
   • CEnabling the documentation and analysis of trends
   • DEnsuring compliance with regulatory requirements

   Show answer

   Answer: B

   Explanation

   I mean I am getting scared in fact. I hope my answers have not been wrong all along at this point. So many wrong answers

   Source: Adapted from community discussion — FluffyMalware

   Next question

8. Question 888 · 1449 in bank

   Which of the following is the GREATEST concern associated with redundant data in an organization's inventory system?

   • AData inconsistency
   • BUnnecessary data storage usage
   • CPoor access control
   • DUnnecessary costs of program changes

   Show answer

   Answer: A

   Explanation

   The greatest concern associated with redundant data in an organization's inventory system is data inconsistency. Redundant data can cause inconsistencies in the organization's inventory system, which can lead to errors in decision-making, such as over- or under-ordering products.

   Source: Adapted from community discussion — john_boogieman

   Next question

9. Question 889 · 1449 in bank

   Employees are repeatedly seen holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges. This behavior BEST represents:

   • Aa vulnerability
   • Ba control
   • Can impact
   • Da threat

   Show answer

   Answer: A

   Next question

10. Question 890 · 1449 in bank

    Which of the following would BEST help minimize the risk associated with social engineering threats?

    • AReviewing the organization's risk appetite
    • BEnforcing employee sanctions
    • CEnforcing segregation of duties
    • DConducting phishing exercises

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 881. 1449 questions available.