Free ISACA CRISC Practice Exams - Page 13 of 73

Question #121

The MAIN reason for prioritizing IT risk responses is to enable an organization to:

A . determine the risk appetite.
B . determine the budget.
C . define key performance indicators (KPIs).
D . optimize resource utilization.

Reveal Solution Hide Solution

Question #122

Mapping open risk issues to an enterprise risk heat map BEST facilitates:

A . risk response.
B . control monitoring.
C . risk identification.
D . risk ownership.

Reveal Solution Hide Solution

Question #123

A risk practitioner notes control design changes when comparing risk response to a previously approved action plan.

Which of the following is MOST important for the practitioner to confirm?

A . Appropriate approvals for the control changes
B . The reason the action plan was modified
C . The risk owner’s approval of the revised action plan
D . The effectiveness of the resulting control

Reveal Solution Hide Solution

Question #124

Which of the following BEST enables an organization to determine whether risk management is aligned with its goals and objectives?

A . The organization has approved policies that provide operational boundaries.
B . Organizational controls are in place to effectively manage risk appetite.
C . Environmental changes that impact risk are continually evaluated.
D . The organization has an approved enterprise architecture (EA) program.

Reveal Solution Hide Solution

Question #125

A risk action plan has been changed during the risk mitigation effort.

Which of the following is MOST important for the risk practitioner to verify?

A . Impact of the change on inherent risk.
B . Approval for the change by the risk owner.
C . Business rationale for the change.
D . Risk to the mitigation effort due to the change.

Reveal Solution Hide Solution

Question #126

When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

A . Risk action plans and associated owners
B . Recent audit and self-assessment results
C . Potential losses compared to treatment cost
D . A list of assets exposed to the highest risk

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

When reporting risk assessment results to senior management, the most important information to include to enable risk-based decision making is the potential losses compared to treatment cost. This information helps to quantify the impact and likelihood of the risks, and to evaluate the cost and benefit of the risk responses. This information also helps to prioritize and allocate resources for the risk management program, and to align the risk management program with the enterprise’s objectives, strategy, and risk appetite. The other options are not as important as the potential losses compared to treatment cost, as they provide different types of information for the risk management process:

Risk action plans and associated owners are the documents that specify the actions to be taken to address the identified risks, the resources required, the timelines, the owners, and the expected outcomes. This information helps to implement and monitor the risk management program, and to assign the authority and accountability for the risk management activities.

Recent audit and self-assessment results are the outcomes of the independent and objective examination of the risk management program, such as by internal or external auditors, or by the risk owners or practitioners themselves. This information helps to provide assurance and feedback on the effectiveness and efficiency of the risk management program, and to identify the gaps or weaknesses that need to be addressed.

A list of assets exposed to the highest risk are the resources that have the most value for the enterprise, such as hardware, software, data, or services, and that are affected by or contribute to the highest risks. This information helps to identify and protect the critical assets of the enterprise, and to reduce the exposure and impact of the risks to the assets.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.1.1, pp. 58-59.

Question #127

A business impact analysis (BIA) enables an organization to determine appropriate IT risk mitigation actions by:

A . validating whether critical IT risk has been addressed.
B . assigning accountability for IT risk to business functions.
C . identifying IT assets that support key business processes.
D . defining the requirements for an IT risk-aware culture

Reveal Solution Hide Solution

Question #128

Which of the following would BEST ensure that identified risk scenarios are addressed?

A . Reviewing the implementation of the risk response
B . Creating a separate risk register for key business units
C . Performing real-time monitoring of threats
D . Performing regular risk control self-assessments

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The best way to ensure that identified risk scenarios are addressed is to review the implementation of the risk response. The risk response is the action or plan that is taken to reduce, avoid, transfer, or accept the risk, depending on the chosen risk treatment option1. Reviewing the implementation of the risk response means checking whether the risk response actions are executed as planned, whether they are effective and efficient in mitigating the risk, and whether they are aligned with the organization’s objectives and risk appetite2. Reviewing the implementation of the risk response helps to monitor and control the risk, identify any gaps or issues, and make any necessary adjustments or improvements. The other options are not the best ways to ensure that identified risk scenarios are addressed, as they are either less comprehensive or less specific than reviewing the implementation of the risk response. Creating a separate risk register for key business units is a way of documenting and tracking the risks that affect different parts of the organization. However, this is not the same as addressing the risk scenarios, as it does not indicate how the risks are treated or resolved. Performing real-time monitoring of threats is a way of detecting and responding to any changes or events that may increase the likelihood or impact of the risks. However, this is not the same as addressing the risk scenarios, as it does not measure the effectiveness or efficiency of the risk response actions. Performing regular risk control self-assessments is a way of evaluating and testing the design and operation of the controls that are implemented to mitigate the risks. However, this is not the same as addressing the risk scenarios, as it does not cover the other aspects of the risk response, such as risk avoidance, transfer, or acceptance.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.7, Page 59.

Question #129

Which of the following is the MOST cost-effective way to test a business continuity plan?

A . Conduct interviews with key stakeholders.
B . Conduct a tabletop exercise.
C . Conduct a disaster recovery exercise.
D . Conduct a full functional exercise.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

A business continuity plan (BCP) is a document that describes the procedures and actions that an organization will take to ensure the continuity of its critical functions and operations in the event of a disruption or disaster12.

Testing a business continuity plan is a method of evaluating the effectiveness and readiness of the BCP, and identifying and addressing any gaps or weaknesses in the plan34.

The most cost-effective way to test a business continuity plan is to conduct a tabletop exercise, which is a type of simulation that involves gathering the key stakeholders and participants of the BCP, and discussing and reviewing the roles, responsibilities, and actions that they will take in response to a hypothetical scenario of a disruption or disaster56.

A tabletop exercise is the most cost-effective way because it requires minimal resources and time, and can be conducted in a regular meeting room or online platform56.

A tabletop exercise is also the most cost-effective way because it provides a high-level overview and assessment of the BCP, and can identify and address the major issues or challenges that may arise in the implementation of the plan56.

The other options are not the most cost-effective ways, but rather possible alternatives or supplements that may have different levels of complexity or cost.

For example:

Conducting interviews with key stakeholders is a way of testing a business continuity plan that involves asking and answering questions about the BCP, and collecting feedback and suggestions from the people who are involved or affected by the plan78. However, this way is not the most cost-effective because it may not cover all the aspects or scenarios of the BCP, and may not facilitate the interaction or collaboration among the stakeholders78.

Conducting a disaster recovery exercise is a way of testing a business continuity plan that involves activating and executing the BCP in a realistic and controlled environment, and measuring the outcomes and impacts of the plan. However, this way is not the most cost-effective because it requires a lot of resources and time, and may disrupt or interfere with the normal operations of the organization.

Conducting a full functional exercise is a way of testing a business continuity plan that involves simulating and testing the BCP in a live and dynamic environment, and involving the external entities and stakeholders that are part of the plan. However, this way is not the most cost-effective because it requires the most resources and time, and may pose the highest risk or challenge to the organization.

Reference: =

1: Business Continuity Plan (BCP) Definition1

2: Business Continuity Planning – Ready.gov2

3: Testing, testing: how to test your business continuity plan4

4: Comprehensive Guide to Business Continuity Testing | Agility5

5: How to Conduct a Tabletop Exercise for Business Continuity3

6: Tabletop Exercises: A Guide to Success6

7: How to Conduct Testing of a Business Continuity Plan7

8: Business Continuity Plan Testing: Interviewing Techniques8

: Disaster Recovery Testing: A Step-by-Step Guide

: Disaster Recovery Testing Scenarios: A Guide to Success

: Functional Exercises: A Guide to Success

: Functional Exercise Toolkit

Question #130

During an IT risk scenario review session, business executives question why they have been assigned ownership of IT-related risk scenarios. They feel IT risk is technical in nature and therefore should be owned by IT.

Which of the following is the BEST way for the risk practitioner to address these concerns?

A . Describe IT risk scenarios in terms of business risk.
B . Recommend the formation of an executive risk council to oversee IT risk.
C . Provide an estimate of IT system downtime if IT risk materializes.
D . Educate business executives on IT risk concepts.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

IT risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of IT-related threats or opportunities on the organization’s objectives, performance, or value creation12. Business risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of business-related threats or opportunities on the organization’s objectives, performance, or value creation34.

The best way for the risk practitioner to address the concerns of the business executives who question why they have been assigned ownership of IT-related risk scenarios is to describe IT risk scenarios in terms of business risk, which is a technique that involves translating and communicating the IT risk scenarios into the language and context of the business risk scenarios, and highlighting the linkages and dependencies between them56.

Describing IT risk scenarios in terms of business risk is the best way because it helps the business executives to understand and appreciate the relevance and importance of IT risk scenarios, and how they affect the achievement of the organization’s goals and the delivery of value to the stakeholders56.

Describing IT risk scenarios in terms of business risk is also the best way because it helps the business executives to accept and fulfill their roles and responsibilities as the owners of IT risk scenarios, and to collaborate and coordinate with the IT team and other stakeholders in the risk management process56.

The other options are not the best ways, but rather possible alternatives or supplements that may support or enhance the description of IT risk scenarios in terms of business risk.

For example: Recommending the formation of an executive risk council to oversee IT risk is a way that involves establishing and empowering a group of senior leaders from different business units and functions to provide the strategic direction, guidance, and oversight for the IT risk management process78. However, this way is not the best way because it does not directly address the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be feasible or effective without a clear and common understanding of IT risk scenarios among the council members78.

Providing an estimate of IT system downtime if IT risk materializes is a way that involves quantifying and communicating the potential loss or disruption of the IT systems or services that support the organization’s operations, if the IT risk scenarios occur9. However, this way is not the best way because it does not fully capture or convey the impact of IT risk scenarios on the organization’s objectives, performance, or value creation, and it may not be relevant or meaningful for some IT risk scenarios that are not related to IT system downtime9.

Educating business executives on IT risk concepts is a way that involves providing and delivering the knowledge and skills on the principles, frameworks, and techniques of IT risk management, and the roles and responsibilities of the IT risk owners and stakeholders. However, this way is not the best way because it does not specifically address the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be sufficient or effective without a practical and contextual application of IT risk concepts to the organization’s situation and goals.

Reference: =

1: IT Scenario Analysis in Enterprise Risk Management – ISACA2

2: New Toolkit and Course From ISACA Help Practitioners Develop Risk Scenarios – ISACA1

3: Business Risk – Investopedia3

4: Business Risk: Definition, Types, Examples & How to Manage4

5: Risk IT Framework, ISACA, 2009

6: IT Risk Management Framework, University of Toronto, 2017

7: Executive Risk Council – ISACA5

8: Executive Risk Council: A Guide to Success6

9: IT System Downtime – ISACA7

: IT System Downtime: Causes, Costs, and How to Prevent It8

: IT Risk Education – ISACA9

: IT Risk Education: A Guide to Success