Question 981 · 1449 in bank
Which of the following statements BEST describes risk appetite?
Show answer
Answer: B
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which of the following statements BEST describes risk appetite?
Answer: B
A contract associated with a cloud service provider MUST include:
Answer: B
Which of the following is MOST helpful in aligning IT risk with business objectives?
Answer: B
A top-down approach is based on an understanding of business objectives and how a risk event could affect the achievement of those objectives. This approach is suitable for general enterprise risk management and analysis of IT and non-IT related events.
Source: Adapted from community discussion — john_boogieman
Establishing an organizational code of conduct is an example of which type of control?
Answer: B
Of course, reviewing the 7th edition review manual, controls are: administrative/managerial, technical/logical, physical/operational - and can be classified by function as detective, preventive, compensating, deterrant, corrective - pages 151, 153, 154. There is no directive in the ISACA book - anyone have a source for directive from ISACA?
Source: Adapted from community discussion — CbtL
Which of the following is the BEST indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees?
Answer: C
Which of the following is the BEST way to validate the results of a vulnerability assessment?
Answer: A
Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?
Answer: D
Agree. Automated logs collected from different systems would be the most important data source for monitoring key risk indicators (KRIs). KRIs are metrics that provide insight into the overall risk profile of an organization and are used to monitor the effectiveness of controls and the level of risk exposure. Automated logs collected from different systems can provide real-time information on events that may be indicative of a potential risk or breach. By monitoring these logs, organizations can detect potential issues early and take action to mitigate the risks.
Source: Adapted from community discussion — john_boogieman
Which of the following is a risk practitioner's BEST recommendation to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile?
Answer: C
Question is around ensuring cyber risk is assessed and reflected in the enterprise-level risk profile. This is best achieved by following the Cyber risk management program inline with the existing risk management framework of the organization. B & D is around efficiency of the program. so is not the best answer. Correct Answer - C A. Conduct cyber risk awareness training tailored specifically for senior management B. Implement a cyber risk program based on industry best practices C. Manage cyber risk according to the organization's risk management framework D. Define cyber roles and responsibilities across the organization
Source: Adapted from community discussion — huze
Which of the following roles is BEST suited to help a risk practitioner understand the impact of IT-related events on business objectives?
Answer: C
C. Senior management Senior management has the highest-level perspective and authority within an organization. They are responsible for setting the organization's strategic direction and business objectives. Understanding the impact of IT-related events on these objectives is critical for aligning IT risk management with the overall goals of the business. Senior management can provide insights, guidance, and decisions regarding how IT risks may affect the achievement of business objectives and how to prioritize risk mitigation efforts accordingly.
Source: Adapted from community discussion — eblue
It is MOST appropriate for changes to be promoted to production after they are:
Answer: A
A. Approved by the business owner. The approval of changes by the business owner is a crucial step before promoting changes to the production environment. This ensures that the changes have been reviewed and authorized by someone with the appropriate authority and understanding of the business implications. The business owner's approval typically comes after thorough testing and validation processes, ensuring that the changes meet the required standards and do not introduce new risks or issues. This step is essential for maintaining the integrity, stability, and security of the production environment.
Source: Adapted from community discussion — Kennethlim79
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 981. 1449 questions available.
Version 1.0.0. How we source questions