Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?
Answer: C
The risk practitioner does not deploy controls. The correct answer is C, determine if the impact is outside risk appetite
Source: Adapted from community discussion — hussmohsin
Which of the following is the GREATEST advantage of implementing a risk management program?
Answer: C
Which of the following should be of MOST concern to a risk practitioner reviewing findings from a recent audit of an organization's data center?
Answer: A
Which of the following should be PRIMARILY considered while designing information systems controls?
Answer: C
Review of the enterprise's strategic plan is the first step in designing effective IS controls that would fit the enterprise's long-term plans. Incorrect Answers: A: The IT strategic plan exists to support the enterprise's strategic plan but is not solely considered while designing information system control. B: Review of the existing IT environment is also useful and necessary but is not the first step that needs to be undertaken. D: The present IT budget is just one of the components of the strategic plan.
A systems interruption has been traced to a personal USB device plugged into the corporate network by an IT employee who bypassed internal control procedures. Of the following, who should be accountable?
Answer: D
When developing risk scenarios, it is MOST important to ensure they are:
Answer: C
An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?
Answer: A
Which of the following is the BEST way to confirm whether appropriate automated controls are in place within a recently implemented system?
Answer: B
An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. Which risk treatment was adopted by the organization?
Answer: A
If the contracting of the process was carried out knowing that the supplier was not compliant, then the risk was accepted.
Source: Adapted from community discussion — john_boogieman
Which of the following is the BEST method to maintain a common view of IT risk within an organization?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 901. 1449 questions available.
Version 1.0.0. How we source questions