Question 911 · 1449 in bank
The FIRST step for a startup company when developing a disaster recovery plan should be to identify:
Show answer
Answer: D
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
The FIRST step for a startup company when developing a disaster recovery plan should be to identify:
Answer: D
An organization has outsourced an application to a Software as a Service (SaaS) provider. The risk associated with the use of this service should be owned by the:
Answer: C
Which of the following should be done FIRST when a new risk scenario has been identified?
Answer: C
Which of the following is MOST important to update when an organization's risk appetite changes?
Answer: A
The correct answer is A, Key risk indicators (KRIs). Key risk indicators (KRIs) are metrics that are used to measure the likelihood and impact of identified risks. When an organization's risk appetite changes, it is important to update the KRIs to reflect the new risk appetite. This is becauseKRIs are used to monitor and manage risks and inform risk-related decisions. By updating theKRIs to reflect the new risk appetite, the organization can ensure that its risk management practices are aligned with its risk appetite and are effective in managing risks.
Source: Adapted from community discussion — Staanlee
You are the risk official in Bluewell Inc. You are supposed to prioritize several risks. A risk has a rating for occurrence, severity, and detection as 4, 5, and 6, respectively. What Risk Priority Number (RPN) you would give to it?
Answer: A
Steps involving in calculating risk priority number are as follows: ✑ Identify potential failure effects ✑ Identify potential causes ✑ Establish links between each identified potential cause ✑ Identify potential failure modes ✑ Assess severity, occurrence and detection ✑ Perform score assessments by using a scale of 1 -10 (low to high rating) to score these assessments. ✑ Compute the RPN for a particular failure mode as Severity multiplied by occurrence and detection. RPN = Severity * Occurrence * Detection Hence, RPN = 4 * 5 * 6 - = 120 Incorrect Answers: B, C, D: These are not RPN for given values of severity, occurrence, and detection.
Which of the following is the BEST way to validate whether controls have been implemented according to the risk mitigation action plan?
Answer: B
How come the answer is A? KRI is for future purposes. I think the answer should be C as with testing it can confirm the proper implementation.
Source: Adapted from community discussion — Rooks
Which of the following controls would BEST decrease exposure if a password is compromised?
Answer: C
If your password has been compromised, the only solution is password change (C). Password has already been compromised, so encryption is not the correct answer. A. Passwords have format restrictions B. Passwords are masked C. Password changes are mandated D. Passwords are encrypted
Source: Adapted from community discussion — Anon530
Who should be responsible for implementing and maintaining security controls?
Answer: A
Which of the following activities would BEST contribute to promoting an organization-wide risk-aware culture?
Answer: A
By discussing the Risk components, it should promote awareness of the risk within the business and slowly make the business risk aware culture.
Source: Adapted from community discussion — huze
An organization has engaged a third party to provide an Internet gateway encryption service that protects sensitive data uploaded to a cloud service. This is an example of risk:
Answer: A
If the organization set up their own gateway to encrypt the traffic, it would be mitigation. They are outsourcing the gateway to a third party. It is not as far reaching as say outsourcing an entire process, it seems to be sharing/transfer (ISACA uses the terms interchangeably.)
Source: Adapted from community discussion — CbtL
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 911. 1449 questions available.
Version 1.0.0. How we source questions