Free ISACA CRISC Practice Exams - Page 12 of 73

Question #111

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported.

The risk practitioner should recommend to:

A . reset the alert threshold based on peak traffic
B . analyze the traffic to minimize the false negatives
C . analyze the alerts to minimize the false positives
D . sniff the traffic using a network analyzer

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

An intrusion detection system (IDS) is a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations1. An IDS can generate alerts when it detects any potential threats, but not all alerts are accurate or relevant. There are two types of errors that can affect the performance and reliability of an IDS: false positives and false negatives2.

A false positive is when an IDS incorrectly flags a benign or normal activity as malicious or suspicious. For example, an IDS may alert on a legitimate network scan or a harmless software update. False positives can reduce the credibility and efficiency of an IDS, as they can overwhelm the security team with unnecessary alerts, distract them from the real threats, and cause them to ignore or disable the IDS3.

A false negative is when an IDS fails to flag a malicious or suspicious activity as such. For example, an IDS may miss a stealthy or novel attack that does not match any known signatures or patterns. False negatives can compromise the security and integrity of the network, as they can allow attackers to bypass the IDS and cause damage or steal data without being detected4.

The risk practitioner should recommend to analyze the alerts to minimize the false positives, because this is the best way to improve the accuracy and usefulness of the IDS. By analyzing the alerts, the risk practitioner can:

Identify the sources and causes of the false positives, such as misconfigured or outdated IDS rules, network anomalies, or legitimate traffic that resembles malicious traffic5.

Adjust or fine-tune the IDS settings, such as the alert threshold, the sensitivity level, the detection method, or the rule base, to reduce the number of false positives without increasing the risk of false negatives.

Validate or verify the alerts with other sources of information, such as logs, network traffic analysis, or threat intelligence, to confirm or dismiss the alerts as true or false positives.

Prioritize or classify the alerts based on their severity, impact, or likelihood, to focus on the most critical or relevant alerts and avoid alert fatigue.

The other options are not the best course of action, because:

Resetting the alert threshold based on peak traffic is not a reliable or effective way to minimize the false positives, as it may also increase the risk of false negatives. The alert threshold is the level of activity or deviation that triggers an alert from the IDS. If the threshold is set too high, the IDS may miss some malicious or suspicious activity that occurs below the threshold. If the threshold is set too low, the IDS may generate too many alerts for normal or benign activity that exceeds the threshold. The optimal threshold depends on various factors, such as the network size, topology, traffic volume, and baseline. Peak traffic is not a good indicator of the optimal threshold, as it may vary depending on the time, day, or season, and it may not reflect the normal or expected network behavior. Analyzing the traffic to minimize the false negatives is not the main issue or goal in this scenario, as the problem is the high number of alerts, not the low number of alerts. Analyzing the traffic can help to identify the malicious or suspicious activity that the IDS may have missed, but it does not address the root cause of the false positives or improve the IDS performance. Moreover, analyzing the traffic can be time-consuming and resource-intensive, especially for large or complex networks, and it may require specialized tools or skills that the risk practitioner may not have.

Sniffing the traffic using a network analyzer is not a suitable or feasible option in this scenario, as it may violate the privacy or security policies of the network or the organization. Sniffing the traffic means capturing and inspecting the network packets that are transmitted or received by the devices on the network. A network analyzer is a tool that can perform this function and display the packet data in a readable format. However, sniffing the traffic can also expose sensitive or confidential information, such as passwords, usernames, or credit card numbers, that may be contained in the packets. Therefore, sniffing the traffic may require authorization or consent from the network owners or users, and it may be restricted or prohibited by law or regulation.

Reference: =

What is an intrusion detection system (IDS)? – IBM

Intrusion detection system – Wikipedia

What Are Intrusion Detection Systems? – MUO

12 Best Intrusion Detection System (IDS) Software 2024 – Comparitech What is an Intrusion Detection System (IDS)? – Fortinet

[False Positive and False Negative in Intrusion Detection System] [False Positives and False Negatives in Intrusion Detection Systems] [How to Reduce False Positives for Your IDS/IPS]

[How to Set the Right Alert Thresholds for Your IDS/IPS] [Network Traffic Analysis: What It Is and How It Works] [What is a Network Analyzer? – Definition from Techopedia]

Question #112

Which of the following BEST enables effective risk-based decision making?

A . Performing threat modeling to understand the threat landscape
B . Minimizing the number of risk scenarios for risk assessment
C . Aggregating risk scenarios across a key business unit
D . Ensuring the risk register is updated to reflect changes in risk factors

Reveal Solution Hide Solution

Question #113

Which of the following BEST enables detection of ethical violations committed by employees?

A . Transaction log monitoring
B . Access control attestation
C . Periodic job rotation
D . Whistleblower program

Reveal Solution Hide Solution

Question #114

An organization has provided legal text explaining the rights and expected behavior of users accessing a system from geographic locations that have strong privacy regulations.

Which of the following control types has been applied?

A . Detective
B . Directive
C . Preventive
D . Compensating

Reveal Solution Hide Solution

Question #115

Which of the following is the BEST metric to demonstrate the effectiveness of an organization’s change management process?

A . Increase in the frequency of changes
B . Percent of unauthorized changes
C . Increase in the number of emergency changes
D . Average time to complete changes

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

A change management process is a set of procedures and activities that aim to ensure that changes in an organization’s IT systems and services are implemented in a controlled and coordinated manner. The effectiveness of a change management process can be measured by how well it reduces the risks and costs associated with changes, and how well it supports the business objectives and customer expectations. One of the best metrics to demonstrate the effectiveness of a change management process is the percent of unauthorized changes. Unauthorized changes are changes that are made without following the established change management process, such as obtaining approval, documenting the change, testing the change, and communicating the change. Unauthorized changes can introduce errors, defects, security breaches, and disruptions to the IT systems and services, and can negatively affect the business performance and customer satisfaction. Therefore, a low percent of unauthorized changes indicates that the change management process is effective in ensuring that changes are properly planned, approved, executed, and monitored. The other options are not the best metrics to demonstrate the effectiveness of a change management process, as they do not directly reflect the quality and control of the changes. An increase in the frequency of changes may indicate that the organization is agile and responsive to the changing business needs and customer demands, but it does not necessarily mean that the changes are well-managed and beneficial. An increase in the number of emergency changes may indicate that the organization is able to handle urgent and critical situations, but it may also suggest that the organization is reactive and lacks proper planning and analysis of the changes. The average time to complete changes may indicate the efficiency and speed of the change management process, but it does not measure the effectiveness and value of the changes.

Reference: = CRISC Review Manual, pages 156-1571; CRISC Review Questions, Answers & Explanations Manual, page 712

Question #116

Which of the following is the PRIMARY objective of a risk awareness program?

A . To demonstrate senior management support
B . To enhance organizational risk culture
C . To increase awareness of risk mitigation controls
D . To clearly define ownership of risk

Reveal Solution Hide Solution

Question #117

Which of the following is the BEST indication of a mature organizational risk culture?

A . Corporate risk appetite is communicated to staff members.
B . Risk owners understand and accept accountability for risk.
C . Risk policy has been published and acknowledged by employees.
D . Management encourages the reporting of policy breaches.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Organizational risk culture is the term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose. Organizational risk culture influences how the organization identifies, assesses, and manages risks, and how it aligns its risk appetite and tolerance with its objectives and strategies1.

The best indication of a mature organizational risk culture is that risk owners understand and accept accountability for risk, because it means that the organization:

Clearly defines and assigns the roles and responsibilities of the risk owners, who are the individuals or groups who have the authority and ability to manage the risks within their scope or domain Empowers and supports the risk owners to perform their risk management duties, such as identifying, assessing, responding, monitoring, and reporting the risks

Holds the risk owners accountable for the outcomes and consequences of the risks, and evaluates their performance and compliance with the risk policies, standards, and procedures

Encourages and rewards the risk owners for demonstrating risk awareness and competence, and for contributing to the risk management improvement and learning23

The other options are not the best indications of a mature organizational risk culture, but rather some of the elements or aspects of it. Corporate risk appetite is the amount and type of risk that the organization is willing to accept in order to achieve its objectives. Corporate risk appetite is communicated to staff members to guide their risk decision making and behavior, and to ensure the consistency and alignment of the risk taking and tolerance across the organization. Risk policy is the document that establishes the principles, framework, and process for managing the risks within the organization. Risk policy is published and acknowledged by employees to ensure their awareness and compliance with the risk management expectations and requirements. Management is the group of individuals who have the authority and responsibility to direct and control the organization’s activities and resources. Management encourages the reporting of policy breaches to ensure the transparency and accountability of the risk management performance and outcomes, and to identify and address the risk management issues and gaps4.

Reference: = Risk culture – Institute of Risk Management

Risk Owner – ISACA

Taking control of organizational risk culture | McKinsey

[CRISC Review Manual, 7th Edition]

Question #118

Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

A . Interview control owners.
B . Observe the control enhancements in operation.
C . Inspect external audit documentation.
D . Review management’s detailed action plans.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

A control is an action or measure that reduces the likelihood or impact of a risk to an acceptable level. A control issue is a problem or weakness that affects the effectiveness or efficiency of a control, such as a gap, deficiency, or failure. A control enhancement is an improvement or modification that increases the effectiveness or efficiency of a control, such as by adding, replacing, or updating the control. An external audit is an independent and objective examination of the enterprise’s activities, processes, or systems, such as the risk management program or the control environment, by an external party, such as a regulator or a third-party auditor. The best way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit is to observe the control enhancements in operation. This will enable the risk practitioner to evaluate the actual performance and outcome of the control enhancements, and to determine whether they have resolved or mitigated the control issues. The other options are not the best way to verify that management has addressed control issues, as they involve different methods or sources of verification:

Interview control owners means that the risk practitioner asks questions or collects feedback from the persons or groups who have the authority and accountability to manage the controls and their issues, such as the business process owners or the IT controls managers. This may provide some information or evidence on the control enhancements, but it may not be as reliable or objective as observing the control enhancements in operation, as the control owners may have biases, conflicts, or gaps in their knowledge or perception of the control enhancements.

Inspect external audit documentation means that the risk practitioner reviews the reports or records of the external audit, such as the audit findings, recommendations, or opinions. This may provide some information or evidence on the control issues, but it may not be as current or relevant as observing the control enhancements in operation, as the external audit documentation may not reflect the latest or updated status or results of the control enhancements, or may not cover all the aspects or components of the control enhancements.

Review management’s detailed action plans means that the risk practitioner examines the documents that specify the actions to be taken by the management to address the control issues, such as the resources required, the timelines, the owners, and the expected outcomes. This may provide some information or evidence on the control enhancements, but it may not be as accurate or sufficient as observing the control enhancements in operation, as the management’s detailed action plans may not match the actual implementation or execution of the control enhancements, or may not account for the uncertainties or complexities of the control enhancements.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.3.1, pp. 62-63.

Question #119

Who is accountable for authorizing application access in a cloud Software as a Service (SaaS) solution?

A . Cloud service provider
B . IT department
C . Senior management
D . Business unit owner

Reveal Solution Hide Solution

Question #120

Which of the following is the BEST indicator of the effectiveness of IT risk management processes?

A . Percentage of business users completing risk training
B . Percentage of high-risk scenarios for which risk action plans have been developed
C . Number of key risk indicators (KRIs) defined
D . Time between when IT risk scenarios are identified and the enterprise’s response

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

IT risk management is the process of identifying, assessing, and mitigating the risks related to the use of information technology (IT) in the organization. IT risk management aims to ensure the confidentiality, integrity, and availability of IT resources and information, and to support the IT governance and strategy of the organization1.

The best indicator of the effectiveness of IT risk management processes is the time between when IT risk scenarios are identified and the enterprise’s response. This indicator can help to measure how quickly and efficiently the organization can detect and respond to the IT risks, and how well the organization can prevent or minimize the negative impacts of the IT risks. The time between when IT risk scenarios are identified and the enterprise’s response can include:

The time taken to identify and report the IT risk scenarios, using various methods and sources, such as risk assessments, audits, monitoring, alerts, or incidents

The time taken to analyze and evaluate the IT risk scenarios, using various tools and techniques, such as risk matrices, risk registers, risk indicators, or risk models

The time taken to select and implement the IT risk responses, using various strategies and controls, such as avoidance, mitigation, transfer, or acceptance

The time taken to review and improve the IT risk management processes, using various feedback and learning mechanisms, such as lessons learned, best practices, or benchmarks23

The other options are not the best indicators of the effectiveness of IT risk management processes, but rather some of the inputs or outputs of IT risk management processes. Percentage of business users completing risk training is an indicator of the awareness and competence of the IT users and providers, which can affect the IT risk management performance, but it does not measure the IT risk management processes directly. Percentage of high-risk scenarios for which risk action plans have been developed is an indicator of the completeness and coverage of the IT risk management activities, which can affect the IT risk management outcomes, but it does not measure the IT risk management processes directly. Number of key risk indicators (KRIs) defined is an indicator of the scope and complexity of the IT risk management objectives, which can affect the IT risk management resources and capabilities, but it does not measure the IT risk management processes directly.

Reference: =

IT Risk Management – ISACA

Risk Management Process – ISACA

Risk Response – ISACA

[CRISC Review Manual, 7th Edition]