Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
When reviewing a business continuity plan (BCP), which of the following would be the MOST significant deficiency?
Answer: D
There is nothing worse than Recovery time objectives (RTOs) that do not meet business requirements. This simply means the BRP is irrelevant and all recovery processes including DRP will be wrong as well. The correct answer is D.
Source: Adapted from community discussion — hussmohsin
An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program. The PRIMARY goal of this program should be to:
Answer: D
Which of the following events refer to loss of integrity? Each correct answer represents a complete solution. (Choose three.)
Answer: BCD
Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an organization?
Answer: A
An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to address this situation?
Answer: A
there was a question almost exactly like this a few questions back and I chose Add more controls, the answer was root cause - now I chose root cause and the answer is add more controls...don't understand the difference.
Source: Adapted from community discussion — mclaiborne
Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?
Answer: D
The compensating control that MOST effectively addresses the risk associated with piggybacking into a restricted area without a dead-man door is:
Answer: D
D. security awareness training Piggybacking, or tailgating, involves an unauthorized person following an authorized person into a restricted area. This risk often arises from employees' lack of awareness about the security implications of holding a door open for others. Security awareness training can teach employees about the risks associated with piggybacking and instruct them not to allow others to enter restricted areas without proper authentication. While options A, B, and C might enhance security to a certain extent, they may not effectively address piggybacking because even with advanced technology, a person can still follow an authenticated person through the door. Therefore, security awareness training is the most effective compensating control in this case.
Source: Adapted from community discussion — 01010100
During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards. The overall control environment may still be effective if:
Answer: C
Since the question contains "credit cards" and "industry standards" then your reference is PCI-DSS. In this scenario your QSA wants to see compensating controls. Which supports C as the correct answer. Besides, how can the overall control environment still be "effective" if only a "plan" is in place?
Source: Adapted from community discussion — thedood
An IT control gap has been identified in a key process. Who would be the MOST appropriate owner of the risk associated with this gap?
Answer: A
Owner of the risk, NOT the control. Risk owner The person in whom the organization has invested the authority and accountability for making risk-based decisions and who owns the loss associated with a realized risk scenario. Scope Notes: The risk owner may not be responsible for the implementation of risk treatment.
Source: Adapted from community discussion — john_boogieman
Which of the following IT controls is MOST useful in mitigating the risk associated with inaccurate data?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 891. 1449 questions available.
Version 1.0.0. How we source questions