CRISC practice questions 951–960

1. Question 951 · 1449 in bank

   An organization is considering acquiring a new line of business and wants to develop new IT risk scenarios to guide its decisions. Which of the following would add the MOST value to the new risk scenarios?

   • AAudit findings
   • BExpected losses
   • CCost-benefit analysis
   • DOrganizational threats

   Show answer

   Answer: D

   Explanation

   By identifying and assessing the relevant threats, an organization can better understand the potential impact and likelihood of specific risks associated with acquiring a new line of business. Expected losses, on the other hand, provide an estimate of the financial impact of a risk event after it has occurred, and may not be as relevant when developing new risk scenarios for a new line of business.

   Source: Adapted from community discussion — john_boogieman

   Next question

2. Question 952 · 1449 in bank

   For the first time, the procurement department has requested that IT grant remote access to third-party suppliers. Which of the following is the BEST course of action for IT in responding to the request?

   • APropose a solution after analyzing IT risk
   • BDesign and implement key authentication controls
   • CDesign and implement a secure remote access process
   • DAdequate internal standards to fit the new business case

   Show answer

   Answer: A

   Next question

3. Question 953 · 1449 in bank

   Which of the following is the BEST control to detect an advanced persistent threat (APT)?

   • AMonitoring social media activities
   • BConducting regular penetration tests
   • CUtilizing antivirus systems and firewalls
   • DImplementing automated log monitoring

   Show answer

   Answer: D

   Explanation

   Answer is D. Implementing automated log monitoring The key word in this question is "detect." The answer given is incorrect. A pen test will not detect an APT. Pen testing is to find exploitable vulnerabilities in your network. It doesn't tell you if you have already by compromised by an APT. C. Utilizing antivirus systems and firewalls is also incorrect. AV may detect, but firewall is a preventative measure. An APT would not likely be detected by AV. APT are very advanced hackers, and probably use advanced technics - not script kiddie stuff that AV would detect. The correct answer is D. Implementing automated log monitoring. SIEM would correlate logs from multiple systems and analyze them. Of all the possible answer, this is the best way to detect APT.

   Source: Adapted from community discussion — Anon530

   Next question

4. Question 954 · 1449 in bank

   What is the PRIMARY reason to periodically review key performance indicators (KPIs)?

   • AIdentify trends
   • BOptimize resources needed for controls
   • CEnsure compliance
   • DPromote a risk-aware culture

   Show answer

   Answer: B

   Explanation

   P185 of 7th edition ISACA CRISC manual - "KPIs help to identify underperforming aspects of organizations and areas of business that may require additional resources and attention" Hence my choice for B

   Source: Adapted from community discussion — jseeker

   Next question

5. Question 955 · 1449 in bank

   Which of the following would be MOST helpful to an information security management team when allocating resources to mitigate exposures?

   • AInternal audit findings
   • BRelevant risk case studies
   • CRisk assessment results
   • DPenetration testing results

   Show answer

   Answer: C

   Next question

6. Question 956 · 1449 in bank

   To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:

   • Aclearly define the project scope
   • Bperform background checks on the vendor
   • Cnotify network administrators before testing
   • Drequire the vendor to sign a nondisclosure agreement (NDA)

   Show answer

   Answer: A

   Next question

7. Question 957 · 1449 in bank

   From a risk management perspective, the PRIMARY objective of using maturity models is to enable:

   • Asolution delivery
   • Bstrategic alignment
   • Cresource utilization
   • Dperformance evaluation

   Show answer

   Answer: D

   Explanation

   D. Performance evaluation. From a risk management perspective, the primary objective of using maturity models is to enable performance evaluation. Maturity models provide a structured framework to assess and evaluate the maturity or sophistication of an organization's processes, practices, and capabilities. By evaluating the maturity of various aspects of an organization, including risk management processes, the organization can identify strengths, weaknesses, and areas for improvement, all of which are essential for effective risk management.

   Source: Adapted from community discussion — Staanlee

   Next question

8. Question 958 · 1449 in bank

   Which of the following is the BEST indication of an effective risk management program?

   • ARisk action plans are approved by senior management
   • BMitigating controls are designed and implemented
   • CResidual risk is within the organizational risk appetite
   • DRisk is recorded and tracked in the risk register

   Show answer

   Answer: C

   Explanation

   as to know Residual risk we have to have all Risk management stadies passed...also we may not need any mitigiation (if there are inherit Risks are within risk appetite)

   Source: Adapted from community discussion — Stanislav_crisc

   Next question

9. Question 959 · 1449 in bank

   A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?

   • AAn increase in attempted distributed denial of service (DDoS) attacks
   • BAn increase in attempted website phishing attacks
   • CA decrease in remediated web security vulnerabilities
   • DA decrease in achievement of service level agreements (SLAs)

   Show answer

   Answer: D

   Explanation

   I was thinking of "A" as it is directly mapped to service outage; but I read the question carefully and asked myself what the upper management cares about !. If option "A" was "An increase in SUCCESSFUL attempted distributed denial of service (DDoS) attacks " then it will be "A" but everyday many organizations are subjected to hundreds of (failed) DDOS attempts. The management cares about their customers satisfaction and they need the service uptime to be 99%+. Failure to achieve SLA would have the great concern to the management (reputation risk, customers will be looking for alternative organization, etc.)

   Source: Adapted from community discussion — mraiyan

   Next question

10. Question 960 · 1449 in bank

    Participants in a risk workshop have become focused on the financial cost to mitigate risk rather than choosing the most appropriate response. Which of the following is the BEST way to address this type of issue in the long term?

    • AReview the risk register and risk scenarios
    • BCalculate annualized loss expectancy of risk scenarios
    • CRaise the maturity of organizational risk management
    • DPerform a return on investment analysis

    Show answer

    Answer: C

    Explanation

    The fact that financial cost 'as is' prevails over the selection of an appropriate response is a sign of immaturity of the risk management process as it has to be weighed in balance with risk appetite and tolerance. 7th CRISC manual 'capability maturity models' A capability maturity model (CMM) describes an evolutionary improvement from an immature to a disciplined process that improves quality and effectiveness, improving risk management practices.

    Source: Adapted from community discussion — john_boogieman

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 951. 1449 questions available.