Free ISACA CRISC Practice Exams - Page 11 of 73

Question #101

From a risk management perspective, which of the following is the PRIMARY benefit of using automated system configuration validation tools?

A . Residual risk is reduced.
B . Staff costs are reduced.
C . Operational costs are reduced.
D . Inherent risk is reduced.

Reveal Solution Hide Solution

Question #102

Which of the following is MOST helpful in developing key risk indicator (KRl) thresholds?

A . Loss expectancy information
B . Control performance predictions
C . IT service level agreements (SLAs)
D . Remediation activity progress

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Key risk indicator (KRI): A metric that measures the level of risk exposure or the likelihood of a risk event1.

KRI threshold: A predefined value or range that triggers an alert or action when the KRI reaches or exceeds it2.

Loss expectancy: The estimated amount of loss that an organization may incur due to a risk event3. The most helpful thing in developing KRI thresholds is loss expectancy information. Loss expectancy information provides an estimate of the potential or expected impact of a risk event on the organization’s operations, reputation, or objectives. Loss expectancy information can help an organization to:

Quantify and prioritize the risks that pose the greatest threat to the organization Determine the acceptable level of risk exposure or tolerance for each risk

Set the appropriate value or range for the KRI threshold that reflects the risk appetite and the risk mitigation strategy

Monitor and measure the performance and effectiveness of the risk management process and controls

Loss expectancy information can be derived from various sources, such as historical data, statistical analysis, expert judgment, or simulation models3.

The other options are not as helpful as loss expectancy information in developing KRI thresholds, because they do not directly address the potential or expected impact of a risk event. Control performance predictions, which are the forecasts or estimates of how well the risk management controls will perform in preventing, detecting, or mitigating risks, may help to evaluate the adequacy and efficiency of the risk management process and controls, but they do not provide a clear and

quantifiable measure of the risk impact. IT service level agreements (SLAs), which are the contracts or agreements that define the quality and availability of IT services, may help to establish the standards and expectations for IT service delivery and performance, but they do not provide a comprehensive and current view of the risk exposure or likelihood. Remediation activity progress, which is the status or outcome of the actions taken to address and resolve a risk event, may help to monitor and report the effectiveness and compliance of the risk management process and controls, but it is usually done after the risk event has occurred and resolved, not before.

Reference: = Key Risk Indicators: Definition, Examples, and Best Practices, KRI Framework for Operational Risk Management | Workiva, Loss Expectancy: Definition, Calculation, and Examples

Question #103

When reviewing a business continuity plan (BCP). which of the following would be the MOST significant deficiency?

A . BCP testing is net in conjunction with the disaster recovery plan (DRP)
B . Recovery time objectives (RTOs) do not meet business requirements.
C . BCP is often tested using the walk-through method.
D . Each business location has separate, inconsistent BCPs.

Reveal Solution Hide Solution

Question #104

A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss exposure.

The result is that the control is:

A . mature
B . ineffective.
C . optimized.
D . inefficient.

Reveal Solution Hide Solution

Question #105

Which of the following would be a risk practitioner’s GREATEST concern related to the monitoring of key risk indicators (KRIs)?

A . Logs are retained for longer than required.
B . Logs are reviewed annually.
C . Logs are stored in a multi-tenant cloud environment.
D . Logs are modified before analysis is conducted.

Reveal Solution Hide Solution

Question #106

The BEST way to justify the risk mitigation actions recommended in a risk assessment would be to:

A . align with audit results.
B . benchmark with competitor s actions.
C . reference best practice.
D . focus on the business drivers

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The best way to justify the risk mitigation actions recommended in a risk assessment would be to focus on the business drivers, which are the factors that influence the organization’s objectives, performance, and value creation12.

Focusing on the business drivers means aligning the risk mitigation actions with the organization’s strategic goals, priorities, and values, and demonstrating how the actions will support or enhance the organization’s capabilities, opportunities, and competitive advantage12.

Focusing on the business drivers also means communicating the benefits, costs, and trade-offs of the risk mitigation actions to the relevant stakeholders, and showing how the actions will address the organization’s risk appetite, tolerance, and exposure12.

The other options are not the best way to justify the risk mitigation actions, but rather possible sources of information or guidance that may support the justification.

For example:

Aligning with audit results is a way to validate the effectiveness and efficiency of the risk mitigation actions, and to identify any gaps or weaknesses that need improvement34. However, audit results may not reflect the organization’s current or future business drivers, and may not capture the full scope or impact of the risk mitigation actions34.

Benchmarking with competitor’s actions is a way to compare the organization’s risk mitigation actions with the best practices or standards of the industry or market, and to identify any areas of improvement or differentiation56. However, competitor’s actions may not be suitable or applicable for the organization’s specific context, needs, or challenges, and may not align with the organization’s business drivers56.

Referencing best practice is a way to adopt the proven or accepted methods or techniques for risk mitigation, and to ensure the quality and consistency of the risk mitigation actions78. However, best practice may not be the most optimal or innovative solution for the organization’s unique situation, and may not address the organization’s business drivers78.

Reference: = 1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017

3: IT Audit and Assurance Standards, ISACA, 2014

4: IT Audit and Assurance Guidelines, ISACA, 2014

5: Benchmarking IT Risk Management Practices, ISACA Journal, Volume 4, 2017

6: Benchmarking: A Tool for Improving IT Risk Management, ISACA Now Blog, March 27, 2017

7: IT Risk Management Best Practices, ISACA Journal, Volume 1, 2018

8: IT Risk Management Best Practices, ISACA Now Blog, January 9, 2018

Question #107

A risk practitioner implemented a process to notify management of emergency changes that may not be approved.

Which of the following is the BEST way to provide this information to management?

A . Change logs
B . Change management meeting minutes
C . Key control indicators (KCIs)
D . Key risk indicators (KRIs)

Reveal Solution Hide Solution

Question #108

The PRIMARY goal of conducting a business impact analysis (BIA) as part of an overall continuity planning process is to:

A . obtain the support of executive management.
B . map the business processes to supporting IT and other corporate resources.
C . identify critical business processes and the degree of reliance on support services.
D . document the disaster recovery process.

Reveal Solution Hide Solution

Question #109

Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization’s security incident handling process?

A . The number of security incidents escalated to senior management
B . The number of resolved security incidents
C . The number of newly identified security incidents
D . The number of recurring security incidents

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

A security incident handling process is a set of procedures and activities that aim to identify, analyze, contain, eradicate, recover from, and learn from security incidents that affect the confidentiality, integrity, or availability of information assets12.

The maturity of a security incident handling process is the degree to which the process is defined, managed, measured, controlled, and improved, and the extent to which it meets the organization’s objectives and expectations34.

The best key performance indicator (KPI) to measure the maturity of a security incident handling process is the number of recurring security incidents, which is the frequency or rate of security incidents that are repeated or reoccur after being resolved or closed56.

The number of recurring security incidents is the best KPI because it reflects the effectiveness and efficiency of the security incident handling process, and the ability of the process to prevent or reduce the recurrence of security incidents through root cause analysis, corrective actions, and continuous improvement56.

The number of recurring security incidents is also the best KPI because it is directly related to the organization’s objectives and expectations, such as minimizing the impact and cost of security incidents, enhancing the security posture and resilience of the organization, and complying with the relevant standards and regulations56.

The other options are not the best KPIs, but rather possible metrics that may support or complement the measurement of the maturity of the security incident handling process.

For example:

The number of security incidents escalated to senior management is a metric that indicates the severity or complexity of security incidents, and the involvement or awareness of the senior management in the security incident handling process56. However, this metric does not measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56.

The number of resolved security incidents is a metric that indicates the output or outcome of the security incident handling process, and the performance or productivity of the security incident handling team56. However, this metric does not measure the quality or sustainability of the resolution, or the ability of the process to prevent or reduce security incidents56.

The number of newly identified security incidents is a metric that indicates the input or demand of the security incident handling process, and the capability or capacity of the security incident detection and identification mechanisms56. However, this metric does not measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56.

Reference: =

1: Computer Security Incident Handling Guide, NIST Special Publication 800-61, Revision 2, August 2012

2: ISO/IEC 27035:2016 Information technology ― Security techniques ― Information security incident management

3: Capability Maturity Model Integration (CMMI) for Services, Version 1.3, November 2010

4: COBIT 2019 Framework: Introduction and Methodology, ISACA, 2018

5: KPIs for Security Operations & Incident Response, SecurityScorecard Blog, June 7, 2021

6: Key Performance Indicators (KPIs) for Security Operations and Incident Response, DFLabs White Paper, 2018

Question #110

An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%.

This is an example of:

A . risk mitigation.
B . risk evaluation.
C . risk appetite.
D . risk tolerance.

Reveal Solution Hide Solution