Free ISACA CRISC Practice Exams - Page 17 of 73

Question #161

Which of the following BEST measures the efficiency of an incident response process?

A . Number of incidents escalated to management
B . Average time between changes and updating of escalation matrix
C . Average gap between actual and agreed response times
D . Number of incidents lacking responses

Question #162

A risk practitioner observes that the fraud detection controls in an online payment system do not perform as expected.

Which of the following will MOST likely change as a result?

A . Impact
B . Residual risk
C . Inherent risk
D . Risk appetite

Reveal Solution Hide Solution

Question #163

All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness, the BEST course of action would be to:

A . select a provider to standardize the disaster recovery plans.
B . outsource disaster recovery to an external provider.
C . centralize the risk response function at the enterprise level.
D . evaluate opportunities to combine disaster recovery plans.

Reveal Solution Hide Solution

Question #164

What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner’s business impact analysis (BIA)?

A . Include the application in the business continuity plan (BCP).
B . Determine the business purpose of the application.
C . Segregate the application from the network.
D . Report the finding to management.

Reveal Solution Hide Solution

Question #165

Which of the following BEST balances the costs and benefits of managing IT risk*?

A . Prioritizing and addressing risk in line with risk appetite. Eliminating risk through preventive and detective controls
B . Considering risk that can be shared with a third party
C . Evaluating the probability and impact of risk scenarios

Reveal Solution Hide Solution

Question #166

Which of the following is the BEST way to protect sensitive data from administrators within a public

cloud?

A . Use an encrypted tunnel lo connect to the cloud.
B . Encrypt the data in the cloud database.
C . Encrypt physical hard drives within the cloud.
D . Encrypt data before it leaves the organization.

Reveal Solution Hide Solution

Question #167

A multinational organization is considering implementing standard background checks to’ all new employees A KEY concern regarding this approach

A . fail to identity all relevant issues.
B . be too costly
C . violate laws in other countries
D . be too line consuming

Reveal Solution Hide Solution

Question #168

What are the MOST essential attributes of an effective Key control indicator (KCI)?

A . Flexibility and adaptability
B . Measurability and consistency
C . Robustness and resilience
D . Optimal cost and benefit

Reveal Solution Hide Solution

Question #169

Which of the following is the MOST important characteristic of an effective risk management program?

A . Risk response plans are documented
B . Controls are mapped to key risk scenarios.
C . Key risk indicators are defined.
D . Risk ownership is assigned

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The most important characteristic of an effective risk management program is that risk ownership is assigned. Risk ownership is the accountability and authority to manage a risk1. Assigning risk ownership means identifying and assigning the person or entity who is responsible for evaluating, treating, monitoring, and reporting on a specific risk2. Assigning risk ownership is essential for ensuring that the risk management program works effectively and efficiently, as it helps to:

Clarify the roles and responsibilities of the different functions or groups involved in risk management and internal control;

Ensure that the risks are managed in accordance with the organization’s objectives, strategies, and risk appetite;

Provide guidance and support to the risk owners in identifying, assessing, and mitigating the risks; Monitor and evaluate the performance and effectiveness of the risk owners and the risk response actions;

Communicate and report on the risk status and issues to the relevant stakeholders and authorities. The other options are not the most important characteristic of an effective risk management program, as they are either less relevant or less specific than assigning risk ownership. Risk response plans are documented. This option is a consequence or outcome of an effective risk management program, not a characteristic of it. Risk response plans are the actions or measures that are taken to modify the risk, such as reducing, avoiding, transferring, or accepting the risk3. Documenting risk response plans means recording and maintaining the details and outcomes of the risk response actions, such as the objectives, scope, resources, timelines, performance indicators, and results4. Documenting risk response plans can help to improve the consistency and transparency of the risk management process, as well as to support the monitoring and evaluation of the risk response actions. However, documenting risk response plans is not the most important characteristic of an effective risk management program, as it does not address the accountability and authority for managing the risk. Controls are mapped to key risk scenarios. This option is a specific or narrow example of an effective risk management program, not a general or broad characteristic of

it. Controls are the measures or actions that are taken to reduce the likelihood or impact of a risk, or to increase the likelihood or impact of an opportunity5. Mapping controls to key risk scenarios means linking the controls to the specific situations or events that may affect the organization’s objectives, operations, or performance6. Mapping controls to key risk scenarios can help to enhance the design and implementation of the controls, as well as to evaluate the effectiveness and efficiency of the controls in mitigating the risk. However, mapping controls to key risk scenarios is not the most important characteristic of an effective risk management program, as it does not cover the other aspects of risk management, such as risk identification, assessment, treatment, and monitoring. Key risk indicators are defined. This option is a component or element of an effective risk management program, not a characteristic of it. Key risk indicators are the metrics that measure the level and trend of a risk that may affect the organization’s objectives, operations, or performance7. Defining key risk indicators means establishing and maintaining the criteria and methods for measuring and reporting on the risk8. Defining key risk indicators can help to enhance the risk identification, assessment, and reporting processes, as well as to support the risk decision making and prioritization. However, defining key risk indicators is not the most important characteristic of an effective risk management program, as it does not indicate the accountability and authority for managing the risk.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1, Page 85.

Question #170

What should be the PRIMARY consideration related to data privacy protection when there are plans for a business initiative to make use of personal information?

A . Do not collect or retain data that is not needed.
B . Redact data where possible.
C . Limit access to the personal data.
D . Ensure all data is encrypted at rest and during transit.

Reveal Solution Hide Solution