Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?
Answer: D
Agree 'D'. It is the best indicator to know if the root cause of the incidents is being resolved or not and therefore of the effectiveness of its management.
Source: Adapted from community discussion — john_boogieman
In response to the threat of ransomware, an organization has implemented cybersecurity awareness activities. The risk practitioner's BEST recommendation to further reduce the impact of ransomware attacks would be to implement:
Answer: D
The question is very tricky. Not sure I am right - but think, (C) is the answer. A. encryption for data at rest B. encryption for data in motion C. two-factor authentication D. continuous data backup controls A & B are obviously wrong. Encryption as a control will not protect against a ransomware attack. D is a bit confusing - however, if you think a bit, a continuous (realtime) backup will also not help as ransomeware would have infected the files, that due to realtime back-up it will also be corrupt. Now, (C) is good.... it hopefully prevents or makes more difficult for a Treat actor to gain and retain access as it will be difficult to compromise the MFA.
Source: Adapted from community discussion — huze
Which of the following would be MOST useful when measuring the progress of a risk response action plan?
Answer: C
I correct for 'C', reason: The risk register is a static document that provides a snapshot of the organization's risks at a specific point in time. While the risk register can be updated over time to reflect changes in the risk landscape, it does not provide a direct measure of the effectiveness of the risk response action plan. On the other hand, the percentage of mitigated risk scenarios is a more dynamic measure that provides insight into the progress of the risk response action plan over time. By tracking the percentage of risk scenarios that have been mitigated, an organization can measure the effectiveness of its risk response strategies and identify areas where additional attention may be needed.
Source: Adapted from community discussion — john_boogieman
An organization uses a vendor to destroy hard drives. Which of the following would BEST reduce the risk of data leakage?
Answer: C
C. Use an accredited vendor to dispose of the hard drives Using an accredited vendor ensures that the vendor follows industry best practices and standards for the secure disposal of hard drives. Accreditation typically means that the vendor's processes and capabilities have been vetted and found to be compliant with established standards, significantly reducing the risk of data leakage. While the other options can also contribute to the security of the disposal process, they don't provide the same level of assurance that an accredited vendor does. Encryption (Option A) is useful while the hard drive is in use, but not necessarily when it's about to be destroyed. Degaussing (Option B) is a method of destroying data, but using an accredited vendor might encompass degaussing and other secure methods. Requiring confirmation (Option D) is a good practice but doesn't ensure that the destruction process was securely handled.
Source: Adapted from community discussion — 01010100
When evaluating enterprise IT risk management, it is MOST important to:
Answer: D
Correct: B -> The very first step is to check if IT and IT related activities (eg.: IT Risk Management) is always aligned with business. Overall, IT always support business, number 1 criteria. (Classic ISACA answers). If the activity is aligned with business, then checking answer D comes.
Source: Adapted from community discussion — Kozy
Which of the following is MOST important to communicate to senior management during the initial implementation of a risk management program?
Answer: C
Which of the following should be management's PRIMARY consideration when approving risk response action plans?
Answer: A
In this phase (approval of the response plans) a risk response is not being selected (it has already been carried out) but rather the action plans that implement them.
Source: Adapted from community discussion — john_boogieman
An unauthorized individual has socially engineered entry into an organization's secured physical premises. Which of the following is the BEST way to prevent future occurrences?
Answer: D
A risk owner should be the person accountable for:
Answer: A
Should be Managing Controls. According to the ISACA Glossary: Risk owner The person in whom the organization has invested the authority and accountability for making risk-based decisions and who owns the loss associated with a realized risk scenario. Scope Notes: The risk owner may not be responsible for the implementation of risk treatment. https://www.isaca.org/resources/glossary
Source: Adapted from community discussion — aselunar
Which of the following is the MOST effective key performance indicator (KPI) for change management?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 961. 1449 questions available.
Version 1.0.0. How we source questions