Free ISACA CRISC Practice Exams - Page 10 of 73

Question #91

In a public company, which group is PRIMARILY accountable for ensuring sufficient attention and resources are applied to the risk management process?

A . Board of directors
B . Risk officers
C . Line management
D . Senior management

Reveal Solution Hide Solution

Question #92

Which of the following would be a risk practitioner’s BEST recommendation upon learning of an updated cybersecurity regulation that could impact the organization?

A . Perform a gap analysis
B . Conduct system testing
C . Implement compensating controls
D . Update security policies

Reveal Solution Hide Solution

Question #93

An organization has decided to outsource a web application, and customer data will be stored in the vendor’s public cloud.

To protect customer data, it is MOST important to ensure which of the following?

A . The organization’s incident response procedures have been updated.
B . The vendor stores the data in the same jurisdiction.
C . Administrative access is only held by the vendor.
D . The vendor’s responsibilities are defined in the contract.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Outsourcing a web application and storing customer data in the vendor’s public cloud involves transferring some of the organization’s data processing and storage functions to a third-party service provider. This can bring benefits such as cost savings, scalability, and flexibility, but it also introduces risks such as data breaches, unauthorized access, compliance violations, and loss of control12.

To protect customer data, it is most important to ensure that the vendor’s responsibilities are defined in the contract. A contract is a legally binding agreement that specifies the terms and conditions of the outsourcing relationship, such as the scope, duration, quality, and cost of the services, as well as the rights and obligations of both parties.

A contract should also address the following aspects of data protection:

Data ownership: The contract should clearly state that the organization retains the ownership and control of its customer data, and that the vendor has no rights to use, disclose, or retain the data for any purpose other than providing the agreed services.

Data security: The contract should define the minimum security standards and controls that the vendor must implement and maintain to protect the customer data from unauthorized or accidental access, use, disclosure, modification, or destruction. The contract should also specify the security certifications or audits that the vendor must comply with or undergo to demonstrate its security posture.

Data privacy: The contract should ensure that the vendor complies with the applicable data privacy laws and regulations that govern the collection, processing, and transfer of customer data, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). The contract should also require the vendor to obtain the consent of the customers before collecting or sharing their data, and to respect their rights to access, correct, delete, or restrict their data.

Data breach notification: The contract should establish the procedures and timelines for the vendor to notify the organization and the relevant authorities in the event of a data breach or security incident that affects the customer data. The contract should also define the roles and responsibilities of both parties in responding to and resolving the incident, as well as the remedies and penalties for the vendor’s failure or negligence.

Data backup and recovery: The contract should outline the backup and recovery policies and practices that the vendor must follow to ensure the availability and integrity of the customer data in case of a disaster or system failure. The contract should also specify the frequency and format of the backups, the location and security of the backup storage, and the testing and restoration procedures. Data retention and disposal: The contract should stipulate the retention period and disposal method for the customer data, in accordance with the organization’s data retention policy and the legal or regulatory requirements. The contract should also require the vendor to return or destroy the customer data at the end of the contract or upon the organization’s request, and to provide proof of the data deletion.

By defining the vendor’s responsibilities in the contract, the organization can ensure that the customer data is protected in a consistent and compliant manner, and that the vendor is accountable and liable for any data protection issues or breaches that may arise from the outsourcing arrangement.

The other options are not as important as defining the vendor’s responsibilities in the contract, because they do not address the core issue of establishing a clear and enforceable data protection framework between the organization and the vendor. Updating the organization’s incident response procedures, which are the plans and actions to be taken in the event of a data breach or security incident, may help to mitigate the impact and consequences of such events, but it does not prevent or reduce the likelihood of them occurring in the first place. Storing the data in the same jurisdiction, which means keeping the data within the same geographic or legal boundaries as the organization, may help to avoid some of the data privacy and sovereignty challenges that arise from cross-border data transfers, but it does not guarantee the security and confidentiality of the data. Restricting the administrative access to the vendor, which means limiting the ability to view, modify, or delete the data to the vendor’s personnel only, may help to reduce the risk of unauthorized or accidental access by the organization’s staff, but it does not ensure that the vendor’s staff are trustworthy and competent, and it may also impair the organization’s oversight and control over the data.

Reference: = Consumer data protection and privacy | McKinsey, 9 Tips for Protecting Consumer Data (& Why It’s Important to Keep It …, [Outsourcing Contracts: Key Issues and Best Practices], [Data Protection in Cloud Services: A Guide for Businesses], [Incident Response Planning: Best Practices for Businesses], [Data Localization: What is it and Why is it Important?], [Administrative Access: Definition, Risks, and Best Practices]

Question #94

Which of the following is the PRIMARY purpose of periodically reviewing an organization’s risk profile?

A . Align business objectives with risk appetite.
B . Enable risk-based decision making.
C . Design and implement risk response action plans.
D . Update risk responses in the risk register

Reveal Solution Hide Solution

Question #95

Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?

A . To provide input to the organization’s risk appetite
B . To monitor the vendor’s control effectiveness
C . To verify the vendor’s ongoing financial viability
D . To assess the vendor’s risk mitigation plans

Reveal Solution Hide Solution

Question #96

An organization has experienced several incidents of extended network outages that have exceeded tolerance.

Which of the following should be the risk practitioner’s FIRST step to address this situation?

A . Recommend additional controls to address the risk.
B . Update the risk tolerance level to acceptable thresholds.
C . Update the incident-related risk trend in the risk register.
D . Recommend a root cause analysis of the incidents.

Reveal Solution Hide Solution

Question #97

Which of the following would BEST assist in reconstructing the sequence of events following a security incident across multiple IT systems in the organization’s network?

A . Network monitoring infrastructure
B . Centralized vulnerability management
C . Incident management process
D . Centralized log management

Reveal Solution Hide Solution

Question #98

The MAIN reason for creating and maintaining a risk register is to:

A . assess effectiveness of different projects.
B . define the risk assessment methodology.
C . ensure assets have low residual risk.
D . account for identified key risk factors.

Reveal Solution Hide Solution

Question #99

Reviewing results from which of the following is the BEST way to identify information systems control deficiencies?

A . Vulnerability and threat analysis
B . Control remediation planning
C . User acceptance testing (UAT)
D . Control self-assessment (CSA)

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Information systems control deficiencies are the weaknesses or flaws in the design or implementation of the controls that are intended to ensure the confidentiality, integrity, availability, and reliability of the information systems and resources. Information systems control deficiencies may reduce the effectiveness or efficiency of the controls, and expose the organization to various risks, such as unauthorized access, data loss, system failure, etc.

Reviewing results from control self-assessment (CSA) is the best way to identify information systems control deficiencies, because CSA is a process of evaluating and verifying the adequacy and effectiveness of the information systems controls, using the input and feedback from the individuals or groups that are involved or responsible for the information systems activities or functions. CSA can help the organization to identify and document the information systems control deficiencies, and to align them with the organization’s information systems objectives and requirements.

CSA can be performed using various techniques, such as questionnaires, surveys, interviews, workshops, etc. CSA can also be integrated with the organization’s governance, risk management, and compliance functions, and aligned with the organization’s policies and standards.

The other options are not the best ways to identify information systems control deficiencies, because they do not provide the same level of detail and insight that CSA provides, and they may not be relevant or actionable for the organization.

Vulnerability and threat analysis is a process of identifying and evaluating the weaknesses or flaws in the organization’s assets, processes, or systems that can be exploited or compromised by the potential threats or sources of harm that may affect the organization’s objectives or operations. Vulnerability and threat analysis can help the organization to assess and prioritize the risks, and to design and implement appropriate controls or countermeasures to mitigate or prevent the risks, but it is not the best way to identify information systems control deficiencies, because it does not indicate whether the existing information systems controls are adequate and effective, and whether they comply with the organization’s policies and standards.

Control remediation planning is a process of selecting and implementing the actions or plans to address or correct the information systems control deficiencies that have been identified, analyzed, and evaluated. Control remediation planning involves choosing one of the following types of control responses: mitigate, transfer, avoid, or accept. Control remediation planning can help the organization to improve and optimize the information systems controls, and to reduce or eliminate the information systems control deficiencies, but it is not the best way to identify information systems control deficiencies, because it is a subsequent or follow-up process that depends on the prior identification of the information systems control deficiencies.

User acceptance testing (UAT) is a process of verifying and validating the functionality and usability of the information systems and resources, using the input and feedback from the end users or customers that interact with the information systems and resources. UAT can help the organization to ensure that the information systems and resources meet the user or customer expectations and requirements, and to identify and resolve any issues or defects that may affect the user or customer satisfaction, but it is not the best way to identify information systems control deficiencies, because it does not focus on the information systems controls, and it may not cover all the relevant or significant information systems control deficiencies that may exist or arise.

Reference = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 186 CRISC Practice Quiz and Exam Prep

Question #100

A business manager wants to leverage an existing approved vendor solution from another area within the organization.

Which of the following is the risk practitioner’s BEST course of action?

A . Recommend allowing the new usage based on prior approval.
B . Request a new third-party review.
C . Request revalidation of the original use case.
D . Assess the risk associated with the new use case.

Reveal Solution Hide Solution