Free ISACA CRISC Practice Exams - Page 16 of 73

Question #151

Who is the BEST person to an application system used to process employee personal data?

A . Compliance manager
B . Data privacy manager
C . System administrator
D . Human resources (HR) manager

Question #152

An organization is implementing internet of Things (loT) technology to control temperature and lighting in its headquarters.

Which of the following should be of GREATEST concern?

A . Insufficient network isolation
B . impact on network performance
C . insecure data transmission protocols
D . Lack of interoperability between sensors

Reveal Solution Hide Solution

Question #153

Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?

A . Replace the action owner with a more experienced individual.
B . Implement compensating controls until the preferred action can be completed.
C . Change the risk response strategy of the relevant risk to risk avoidance.
D . Develop additional key risk indicators (KRIs) until the preferred action can be completed.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

• A risk treatment plan is a document that describes the actions and resources needed to implement the chosen risk response strategy for each identified risk1. A risk response strategy is the way an organization decides to address a risk, such as avoiding, accepting, mitigating, or transferring it2.

• Sometimes, a risk treatment plan may not be completed on time due to various reasons, such as delays, resource constraints, technical issues, or changes in the risk environment. In such cases, the best approach is to implement compensating controls until the preferred action can be completed3.

• Compensating controls are alternative or additional controls that provide a similar level of assurance or protection as the original controls, when the latter are not feasible or sufficient3. Compensating controls can help to reduce the residual risk or maintain the risk within the acceptable level until the risk treatment plan is fully executed3.

• For example, if the risk treatment plan involves installing a firewall to protect the network from external threats, but the firewall is not available or compatible with the current system, a compensating control could be to use encryption, authentication, or monitoring tools to secure the network traffic until the firewall is installed3.

• Implementing compensating controls is better than the other options because it allows the organization to continue with the risk treatment plan while maintaining an adequate level of security and compliance. The other options are not advisable for the following reasons:

o Replacing the action owner with a more experienced individual (option A) may not solve the problem if the issue is not related to the action owner’s competence or performance. Moreover, replacing the action owner may cause disruption, confusion, or conflict in the risk management process.

o Changing the risk response strategy of the relevant risk to risk avoidance (option C) may not be possible or desirable if the risk is associated with a critical or beneficial activity or process. Risk avoidance means eliminating the source of the risk or discontinuing the activity that causes the risk2. This may result in losing opportunities, benefits, or value for the organization.

o Developing additional key risk indicators (KRIs) until the preferred action can be completed (option D) may not be effective or efficient if the existing KRIs are already sufficient to monitor and measure the risk. KRIs are metrics or data points that provide early warning signals or information about the level or trend of a risk456. Developing additional KRIs may not reduce the risk or improve the risk treatment plan, but may increase the complexity and cost of the risk management process.

Reference: =

• Key Risk Indicators: Examples & Definitions – SolveXia

• Key Risk Indicators: A Practical Guide | SafetyCulture

• Complete Guide to Key Risk Indicators ― RiskOptics

• Risk Response Plan in Project Management: Key Strategies & Tips

• Risk response strategies: mitigation, transfer, avoidance, acceptance – Twproject: project management software,resource management, time tracking, planning, Gantt, kanban

• Risk Response Strategies: A Guide to Navigating Uncertainty – Teamly

• Compensating Controls | Audit and Compliance | Pathlock

Question #154

Which of the following would provide the MOST useful input when evaluating the appropriateness of risk responses?

A . Incident reports
B . Cost-benefit analysis
C . Risk tolerance
D . Control objectives

Reveal Solution Hide Solution

Question #155

Which of the following should be the PRIMARY consideration when assessing the automation of control monitoring?

A . impact due to failure of control
B . Frequency of failure of control
C . Contingency plan for residual risk
D . Cost-benefit analysis of automation

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Automation of control monitoring is the application of technology to allow continuous or high-frequency, automated monitoring of controls to validate the effectiveness of controls designed to mitigate risk1.

Automation of control monitoring can provide benefits such as increased test coverage, improved timeliness, reduced risk velocity, greater visibility, improved consistency, and the ability to identify trends23.

However, automation of control monitoring also involves costs such as the acquisition, implementation, maintenance, and updating of the technology, as well as the training and support of the staff who use it45.

Therefore, the primary consideration when assessing the automation of control monitoring is the cost-benefit analysis of automation, which compares the expected benefits and costs of automation and determines whether the benefits outweigh the costs or vice versa45.

The other options are not the primary consideration, but rather secondary or tertiary factors that may influence the decision to automate or not. For example, the impact due to failure of control and the frequency of failure of control are aspects of the risk assessment that may indicate the need for automation, but they do not provide the basis for evaluating the feasibility and desirability of automation45. Similarly, the contingency plan for residual risk is a component of the risk response that may include automation as a risk mitigation strategy, but it does not measure the effectiveness and efficiency of automation45.

Reference: = 2: A Practical Approach to Continuous Control Monitoring, ISACA Journal, Volume 2, 2015 3: Continuous Controls Monitoring: The Next Generation Of Controls Testing, Forbes Technology Council, June 2, 2022

1: Making Continuous Controls Monitoring Work for Everyone, ISACA Now Blog, June 13, 2022

4: Controls Automation – Monitoring vs. Operation – Part 3, Turnkey Consulting, July 29, 2021

5: What’s Continuous Control Monitoring and Why Is It Important?, MetricStream Blog, October 15, 2019

Question #156

Which of the following is the FIRST step in risk assessment?

A . Review risk governance
B . Asset identification
C . Identify risk factors
D . Inherent risk identification

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The first step in risk assessment is asset identification, which is the process of identifying and documenting the assets that are relevant and valuable to the organization, such as people, information, systems, processes, or infrastructure1.

Asset identification can help to:

Establish the scope and boundaries of the risk assessment, and ensure that all the assets within the scope are considered and covered2.

Determine the criticality and priority of the assets, and assign them appropriate values or ratings based on their importance and contribution to the organization’s objectives3.

Identify the potential threats and vulnerabilities that may affect the assets, and assess their likelihood and impact on the assets4.

The other options are not the first step in risk assessment, because:

Review risk governance is not the first step, but rather a prerequisite or a foundation for risk assessment. Risk governance is the system of principles, policies, roles, and responsibilities that guide and oversee the risk management activities and initiatives of the organization5. Reviewing risk

governance can help to ensure that the risk assessment is aligned with the organization’s risk strategy, culture, and appetite, and that the risk assessment process is consistent, effective, and efficient6.

Identify risk factors is not the first step, but rather a subsequent or a parallel step to asset identification. Risk factors are the elements or conditions that influence or contribute to the occurrence or outcome of a risk event7. Identifying risk factors can help to understand the causes and sources of the risks, and to analyze and evaluate the risks based on their probability and severity. Inherent risk identification is not the first step, but rather a later or a dependent step on asset identification and risk factor identification. Inherent risk is the level of risk that exists before the implementation of risk responses. Identifying inherent risk can help to measure the exposure or uncertainty of the assets, and to determine the need and extent of the risk responses.

Reference: =

Risk Governance – CIO Wiki

Risk Governance Framework – CIO Wiki

Asset Identification – CIO Wiki

Asset Identification and Valuation – ISACA

Asset Criticality – CIO Wiki

Threat and Vulnerability Assessment – CIO Wiki

Risk Factor – CIO Wiki

[Risk Factor Analysis – CIO Wiki]

[Inherent Risk – CIO Wiki]

[Inherent Risk Assessment – CIO Wiki]

[Risk Assessment – CIO Wiki]

Question #157

Which of the following describes the relationship between risk appetite and risk tolerance?

A . Risk appetite is completely independent of risk tolerance.
B . Risk tolerance is used to determine risk appetite.
C . Risk appetite and risk tolerance are synonymous.
D . Risk tolerance may exceed risk appetite.

Reveal Solution Hide Solution

Question #158

Which of the following will BEST help to ensure implementation of corrective action plans?

A . Establishing employee awareness training
B . Assigning accountability to risk owners
C . Selling target dates to complete actions
D . Contracting to third parties

Reveal Solution Hide Solution

Question #159

An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level.

Which of the following should the risk practitioner do FIRST?

A . Identify staff members who have access to the organization’s sensitive data.
B . Identify locations where the organization’s sensitive data is stored.
C . Identify risk scenarios and owners associated with possible data loss vectors.
D . Identify existing data loss controls and their levels of effectiveness.

Reveal Solution Hide Solution

Question #160

When testing the security of an IT system, il is MOST important to ensure that;

A . tests are conducted after business hours.
B . operators are unaware of the test.
C . external experts execute the test.
D . agreement is obtained from stakeholders.

Reveal Solution Hide Solution