Free ISACA CRISC Practice Exams - Page 18 of 73

Question #171

Which of the following will BEST help to ensure the continued effectiveness of the IT risk management function within an organization experiencing high employee turnover?

A . Well documented policies and procedures
B . Risk and issue tracking
C . An IT strategy committee
D . Change and release management

Reveal Solution Hide Solution

Question #172

A risk practitioner has been asked by executives to explain how existing risk treatment plans would affect risk posture at the end of the year.

Which of the following is MOST helpful in responding to this request?

A . Assessing risk with no controls in place
B . Showing projected residual risk
C . Providing peer benchmarking results
D . Assessing risk with current controls in place

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Showing projected residual risk is the most helpful way to respond to the request of explaining how existing risk treatment plans would affect risk posture at the end of the year. Residual risk is the level of risk that remains after the implementation of risk responses1. Projected residual risk is the estimated level of risk that will remain at a future point in time, based on the assumptions and expectations of the risk responses2. By showing projected residual risk, the risk practitioner can: Demonstrate the effectiveness and efficiency of the risk treatment plans, and how they reduce the risk level from the inherent risk (the risk before the risk responses) to the residual risk3.

Compare the projected residual risk with the risk appetite and tolerance, which are the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives4. This can help to determine whether the projected residual risk is acceptable or not, and whether the risk treatment plans are consistent and proportional to the risk level5.

Identify and address any gaps, issues, or challenges that may affect the achievement of the projected

residual risk, and recommend and implement appropriate improvement actions or contingency plans6.

The other options are not the most helpful ways to respond to the request, because:

Assessing risk with no controls in place is not the most helpful way, as it does not reflect the current or future risk posture of the organization. Controls are the measures or actions that are implemented to modify the risk, such as prevent, detect, correct, or mitigate the risk7. Assessing risk with no controls in place can help to measure the inherent risk, but it does not show the impact or outcome of the risk treatment plans.

Providing peer benchmarking results is not the most helpful way, as it does not reflect the specific or unique risk profile of the organization. Peer benchmarking is the process of comparing the organization’s risk level and performance with its peers or competitors, based on a common set of criteria or indicators8. Providing peer benchmarking results can help to provide a reference or a standard for the risk posture, but it does not show the effect or result of the risk treatment plans.

Assessing risk with current controls in place is not the most helpful way, as it does not reflect the future or projected risk posture of the organization. Assessing risk with current controls in place can help to measure the current residual risk, but it does not show the expected or estimated residual risk at the end of the year.

Reference: =

Residual Risk – CIO Wiki

Projected Residual Risk – CIO Wiki

Risk Treatment Plan – CIO Wiki

Risk Appetite and Tolerance – CIO Wiki

Risk Appetite: What It Is and Why It Matters – Gartner

Risk Monitoring and Review – The National Academies Press

Control – CIO Wiki

Benchmarking – CIO Wiki

[Risk Treatment – CIO Wiki]

Question #173

A risk assessment has identified that departments have installed their own WiFi access points on the enterprise network.

Which of the following would be MOST important to include in a report to senior management?

A . The network security policy
B . Potential business impact
C . The WiFi access point configuration
D . Planned remediation actions

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

A risk assessment is a process of identifying, analyzing, and evaluating the risks that may affect the enterprise’s objectives and operations. It involves determining the likelihood and impact of various risk scenarios, and prioritizing them based on their significance and urgency.

A WiFi access point is a device that allows wireless devices to connect to a wired network using radio signals. It can provide convenience and flexibility for users, but it can also introduce security risks, such as unauthorized access, data leakage, malware infection, or denial of service attacks.

If departments have installed their own WiFi access points on the enterprise network, without proper authorization, configuration, or monitoring, it means that they have bypassed the network security policy and controls, and created potential vulnerabilities and exposures for the enterprise. The most important information to include in a report to senior management is the potential business impact of this risk, which is the estimated loss or damage that the enterprise may suffer if the risk materializes. The potential business impact can be expressed in terms of financial, operational, reputational, or legal consequences, and it can help senior management to understand the severity and urgency of the risk, and to decide on the appropriate risk response and allocation of resources.

The other options are not the most important information to include in a report to senior management, because they do not convey the magnitude and significance of the risk, and they may not be relevant or actionable for senior management.

The network security policy is the set of rules and guidelines that define the security objectives, requirements, and responsibilities for the enterprise network. It is important to have a clear and comprehensive network security policy, and to ensure that it is communicated, enforced, and monitored across the enterprise, but it is not the most important information to include in a report to senior management, because it does not indicate the actual or potential impact of the risk, and it may not reflect the current or desired state of the network security.

The WiFi access point configuration is the set of parameters and settings that define the functionality, performance, and security of the WiFi access point. It is important to have a secure and consistent WiFi access point configuration, and to follow the best practices and standards for wireless network security, but it is not the most important information to include in a report to senior management, because it does not indicate the actual or potential impact of the risk, and it may not be relevant or understandable for senior management.

The planned remediation actions are the steps and measures that are intended to mitigate, transfer, avoid, or accept the risk, and to restore the normal operation and security of the enterprise network. It is important to have a feasible and effective plan for remediation actions, and to implement and monitor them in a timely and efficient manner, but it is not the most important information to include in a report to senior management, because it does not indicate the actual or potential impact of the risk, and it may not be feasible or appropriate without senior management’s approval or support.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 146

Question #174

A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security.

Which of the following observations would be MOST relevant to escalate to senior management?

A . An increase in attempted distributed denial of service (DDoS) attacks
B . An increase in attempted website phishing attacks
C . A decrease in achievement of service level agreements (SLAs)
D . A decrease in remediated web security vulnerabilities

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A web-based service provider is an organization that offers online services or applications to its customers or users, such as e-commerce, social media, cloud computing, etc. A web-based service provider depends on the availability, reliability, and security of its web servers, networks, and systems to deliver its services or applications.

A low risk appetite for system outages means that the organization is not willing to accept a high level or frequency of system outages, which are interruptions or disruptions in the normal operation or functionality of the web servers, networks, or systems. System outages can cause customer dissatisfaction, revenue loss, reputation damage, or legal liability for the web-based service provider. A current risk profile for online security is the current state or condition of the online security risks that may affect the web-based service provider’s objectives and operations. It includes the identification, analysis, and evaluation of the online security risks, and the prioritization and response to them based on their significance and urgency.

The most relevant observation to escalate to senior management is an increase in attempted distributed denial of service (DDoS) attacks, which are malicious attacks that aim to overwhelm or overload the web servers, networks, or systems with a large volume or frequency of requests or traffic, and prevent them from responding to legitimate requests or traffic. An increase in attempted DDoS attacks indicates a high likelihood and impact of system outages, and a high level of threat or vulnerability for the web-based service provider’s online security. Escalating this observation to senior management can help them to understand the severity and urgency of the risk, and to decide on the appropriate risk response and allocation of resources.

The other options are not the most relevant observations to escalate to senior management, because they do not indicate a high likelihood or impact of system outages, and they may not be relevant or actionable for senior management.

An increase in attempted website phishing attacks means an increase in malicious attempts to deceive or trick the web-based service provider’s customers or users into providing their personal or financial information, such as usernames, passwords, credit card numbers, etc., by impersonating the web-based service provider’s website or email. An increase in attempted website phishing attacks indicates a high level of threat or vulnerability for the web-based service provider’s online security, but it may not directly cause system outages, unless the phishing attacks are used to compromise the web servers, networks, or systems. Escalating this observation to senior management may not be the most relevant, because it may not reflect the web-based service provider’s risk appetite for system outages, and it may not require senior management’s involvement or approval.

A decrease in achievement of service level agreements (SLAs) means a decrease in the extent or degree to which the web-based service provider meets or exceeds the agreed or expected standards or criteria for the quality, performance, or availability of its services or applications, as specified in the contracts or agreements with its customers or users. A decrease in achievement of SLAs indicates a low level of customer satisfaction, retention, or loyalty, and a low level of competitiveness or profitability for the web-based service provider. Escalating this observation to senior management may not be the most relevant, because it may not reflect the web-based service provider’s risk appetite for system outages, and it may not require senior management’s involvement or approval. A decrease in remediated web security vulnerabilities means a decrease in the number or percentage of web security vulnerabilities that have been identified and resolved or mitigated by the web-based service provider. Web security vulnerabilities are weaknesses or flaws in the web servers, networks, or systems that can be exploited by malicious attackers to compromise or damage the web-based service provider’s online security. A decrease in remediated web security vulnerabilities indicates a low level of effectiveness or efficiency for the web-based service provider’s web security

controls or processes. Escalating this observation to senior management may not be the most relevant, because it may not reflect the web-based service provider’s risk appetite for system outages, and it may not require senior management’s involvement or approval.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 161 CRISC Practice Quiz and Exam Prep

Question #175

Which of the following is the MOST effective way to mitigate identified risk scenarios?

A . Assign ownership of the risk response plan
B . Provide awareness in early detection of risk.
C . Perform periodic audits on identified risk.
D . areas Document the risk tolerance of the organization.

Reveal Solution Hide Solution

Question #176

Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?

A . Trends in IT resource usage
B . Trends in IT maintenance costs
C . Increased resource availability
D . Increased number of incidents

Reveal Solution Hide Solution

Question #177

Within the three lines of defense model, the accountability for the system of internal control resides with:

A . the chief information officer (CIO).
B . the board of directors
C . enterprise risk management
D . the risk practitioner

Reveal Solution Hide Solution

Question #178

Which of the following is the MOST likely reason an organization would engage an independent reviewer to assess its IT risk management program?

A . To ensure IT risk management is focused on mitigating emerging risk
B . To confirm that IT risk assessment results are expressed in quantitative terms
C . To evaluate threats to the organization’s operations and strategy
D . To identify gaps in the alignment of IT risk management processes and strategy

Reveal Solution Hide Solution

Question #179

Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?

A . To measure business exposure to risk
B . To identify control vulnerabilities
C . To monitor the achievement of set objectives
D . To raise awareness of operational issues

Reveal Solution Hide Solution

Question #180

Which of the following is the GREATEST benefit of incorporating IT risk scenarios into the corporate risk register?

A . Corporate incident escalation protocols are established.
B . Exposure is integrated into the organization’s risk profile.
C . Risk appetite cascades to business unit management
D . The organization-wide control budget is expanded.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

IT risk scenarios are hypothetical situations that describe the sources, causes, and consequences of IT-related risks, and the potential impacts on the organization’s objectives, performance, and value creation12.

A corporate risk register is a document that records and tracks the significant risks that the organization faces, and the responses and actions that are taken to address them34.

The greatest benefit of incorporating IT risk scenarios into the corporate risk register is that exposure is integrated into the organization’s risk profile, which is a comprehensive and integrated representation of the risks that may affect the organization’s objectives, performance, and value creation56.

Exposure is integrated into the organization’s risk profile means that the organization has a complete and consistent view of the IT risk landscape, and the potential impacts and interdependencies of IT risks on other types of risks, such as financial, operational, strategic, or reputational risks56. Exposure is integrated into the organization’s risk profile also means that the organization can make informed and balanced decisions on the risk responses and actions, and allocate the appropriate resources and priorities to the IT risk management and control processes56.

The other options are not the greatest benefit, but rather possible outcomes or consequences of incorporating IT risk scenarios into the corporate risk register.

For example:

Corporate incident escalation protocols are established is an outcome of incorporating IT risk scenarios into the corporate risk register that indicates the organization has defined and implemented the procedures and mechanisms for reporting and resolving IT-related incidents, and for escalating them to the appropriate authorities or levels when necessary78. However, this outcome does not measure or reflect the exposure or the risk profile of the organization, which may depend on other factors such as the frequency, severity, or complexity of the incidents78.

Risk appetite cascades to business unit management is a consequence of incorporating IT risk scenarios into the corporate risk register that indicates the organization has communicated and aligned the risk appetite, which is the amount and type of risk that the organization is willing to accept or pursue, to the business unit management, who are responsible for executing the risk strategy and objectives at the operational level. However, this consequence does not indicate or imply the exposure or the risk profile of the organization, which may vary depending on the context, environment, or stakeholder expectations.

The organization-wide control budget is expanded is an outcome of incorporating IT risk scenarios into the corporate risk register that indicates the organization has increased the amount of resources and funds that are allocated to the control processes, which are the procedures and activities that aim to ensure the effectiveness and efficiency of the organization’s operations, the reliability of its information, and the compliance with its policies and regulations. However, this outcome does not affect or determine the exposure or the risk profile of the organization, which is independent of the control budget.

Reference: =

1: IT Risk Scenarios – Morland-Austin3

2: Risk Scenarios Toolkit, ISACA, 2019

3: Risk Register Template and Examples | Prioritize and Manage Risk1

4: Risk Register Examples for Cybersecurity Leaders4

5: Risk IT Framework, ISACA, 2009

6: IT Risk Management Framework, University of Toronto, 2017

7: Security Incident Reporting and Response, University of Toronto, 2017

8: Security Incident Reporting and Response, ISACA, 2019

: Risk Appetite: Linking Strategy, Risk and Performance, ISACA, 2012

: Risk Appetite and Tolerance, ISACA Journal, Volume 4, 2013

: The Control Process | Principles of Management2

: Control Management: What it is + Why It’s Essential | Adobe Workfront5