Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:
Answer: B
The question says that that the scenarios has been mapped to the policies... so isn't it assumed that the scenarios are already validated and therefore the next step should be to do risk analysis?
Source: Adapted from community discussion — huze
A risk practitioner has observed that risk owners have approved a high number of exceptions to the information security policy. Which of the following should be the risk practitioner's GREATEST concern?
Answer: A
Which of the following is MOST helpful to ensure effective security controls for a cloud service provider?
Answer: C
Which of the following is MOST helpful to ensure effective security controls for a cloud service provider? A. Internal audit reports from the vendor -> not as impartial as C B. A control self-assessment -> not as impartial as C C. A third-party security assessment report -> third party audit is best D. Service level agreement monitoring -> impact to SLA may be a symptom of poor controls but it is better to assess the controls themselves
Source: Adapted from community discussion — cybervds
An audit reveals that several terminated employee accounts maintain access. Which of the following should be the FIRST step to address the risk?
Answer: B
Answer should be B - Disable those accounts. This is the first thing needs to be done. Next, come up with the policy to address this risk
Source: Adapted from community discussion — Rooks
Which of the following is a detective control?
Answer: C
Audit trails, intrusion detection systems (IDSs), and checksums are examples of detective controls. C should be the answer. NOT D - how can rerun procedures be a detective control.?.
Source: Adapted from community discussion — Ceecil1959
A risk practitioner has determined that a key control does not meet design expectations. Which of the following should be done NEXT?
Answer: C
The key thing to remember: Risk practitioner is always a kind of advisor. He never modifies or implements controls directly.
Source: Adapted from community discussion — Kozy
Which of the following would be MOST helpful when estimating the likelihood of negative events?
Answer: D
Threat analysis: An evaluation of the type, scope and nature of events or actions that can result in adverse consequences; identification of the threats that exist against enterprise assets Scope Notes: The threat analysis usually defines the level of threat and the likelihood of it materializing.
Source: Adapted from community discussion — john_boogieman
Improvements in the design and implementation of a control will MOST likely result in an update to:
Answer: D
A risk practitioner is preparing a report to communicate changes in the risk and control environment. The BEST way to engage stakeholder attention is to:
Answer: B
An organization's internal auditors have identified a new IT control deficiency in the organization's identity and access management (IAM) system. It is most important for the risk practitioner to:
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 921. 1449 questions available.
Version 1.0.0. How we source questions