Free ISACA CRISC Practice Exams - Page 19 of 73

Question #181

Which of the following would provide the MOST objective assessment of the effectiveness of an organization’s security controls?

A . An internal audit
B . Security operations center review
C . Internal penetration testing
D . A third-party audit

Reveal Solution Hide Solution

Question #182

Which of the following is the GREATEST impact of implementing a risk mitigation strategy?

A . Improved alignment with business goals.
B . Reduction of residual risk.
C . Increased costs due to control implementation.
D . Decreased overall risk appetite.

Reveal Solution Hide Solution

Question #183

An organization has allowed its cyber risk insurance to lapse while seeking a new insurance provider.

The risk practitioner should report to management that the risk has been:

A . transferred
B . mitigated.
C . accepted
D . avoided

Reveal Solution Hide Solution

Question #184

An organization’s stakeholders are unable to agree on appropriate risk responses.

Which of the following would be the BEST course of action?

A . Escalate to senior management.
B . Identify a risk transfer option.
C . Reassess risk scenarios.
D . Benchmark with similar industries.

Reveal Solution Hide Solution

Question #185

An organization has been experiencing an increasing number of spear phishing attacks.

Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?

A . Update firewall configuration
B . Require strong password complexity
C . implement a security awareness program
D . Implement two-factor authentication

Reveal Solution Hide Solution

Question #186

Which of the following is the BEST response when a potential IT control deficiency has been identified?

A . Remediate and report the deficiency to the enterprise risk committee.
B . Verify the deficiency and then notify the business process owner.
C . Verify the deficiency and then notify internal audit.
D . Remediate and report the deficiency to senior executive management.

Reveal Solution Hide Solution

Question #187

Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?

A . The business case for the use of loT
B . The loT threat landscape
C . Policy development for loT
D . The network that loT devices can access

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Risk scenarios: Narratives that describe potential risk events, their causes, consequences, and likelihood1.

Internet of Things (IoT): A network of interconnected devices, software, sensors, and other things that communicate and exchange data without human intervention2.

IoT threat landscape: The range and types of threats and attacks that target IoT devices, systems, and networks3.

The most helpful thing to review when identifying risk scenarios associated with the adoption of IoT technology in an organization is the IoT threat landscape. The IoT threat landscape provides a comprehensive and current overview of the potential sources, methods, and impacts of cyberattacks on IoT devices, systems, and networks. Reviewing the IoT threat landscape can help an organization to:

Identify the most relevant and prevalent threats and vulnerabilities that affect IoT technology, such as weak passwords, insecure interfaces, insufficient data protection, poor device management, or lack of encryption4.

Assess the likelihood and impact of different types of attacks, such as malware infections, denial-of-service attacks, data breaches, unauthorized access, or sabotage4.

Prioritize the most critical and urgent risks that need to be addressed and mitigated.

Develop realistic and plausible risk scenarios that reflect the actual IoT threat environment and the organization’s specific context and objectives.

The other options are not as helpful as the IoT threat landscape when identifying risk scenarios associated with the adoption of IoT technology in an organization, because they do not provide a comprehensive and current view of the potential threats and attacks that target IoT technology. The business case for the use of IoT, which is the justification and rationale for adopting IoT technology based on the expected benefits, costs, and risks, may help to understand the value and purpose of IoT technology for the organization, but it does not provide detailed information on the specific threats and vulnerabilities that affect IoT technology. Policy development for IoT, which is the process of creating and implementing rules and guidelines for the governance, management, and security of IoT technology, may help to establish the standards and expectations for IoT technology within the organization, but it does not provide an overview of the external threats and attacks that target IoT technology. The network that IoT devices can access, which is the infrastructure and system that enables the connectivity and communication of IoT devices, may help to identify the potential entry points and attack vectors for IoT threats, but it does not provide a complete picture of the types and impacts of IoT threats.

Reference: = Risk Scenarios Toolkit, What is the Internet of Things (IoT)? With Examples | Coursera, Top IoT security issues and challenges (2022) C Thales, 8 Internet of Things Threats and Security Risks – SecurityScorecard

Question #188

Which of the following management action will MOST likely change the likelihood rating of a risk scenario related to remote network access?

A . Updating the organizational policy for remote access
B . Creating metrics to track remote connections
C . Implementing multi-factor authentication
D . Updating remote desktop software

Reveal Solution Hide Solution

Question #189

Business areas within an organization have engaged various cloud service providers directly without assistance from the IT department.

What should the risk practitioner do?

A . Recommend the IT department remove access to the cloud services.
B . Engage with the business area managers to review controls applied.
C . Escalate to the risk committee.
D . Recommend a risk assessment be conducted.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The best action for the risk practitioner to take when business areas within an organization have engaged various cloud service providers directly without assistance from the IT department is to recommend a risk assessment be conducted. A risk assessment is a process of identifying, analyzing, and evaluating the risks associated with the use of cloud services, such as financial, privacy, compliance, security, performance, quality, and technical risks12. A risk assessment can help to determine the current and potential risk exposure and impact of the cloud services, as well as the effectiveness and efficiency of the existing or proposed controls. A risk assessment can also help to prioritize the risks and to develop and implement appropriate risk response strategies and plans, such as risk avoidance, reduction, sharing, or acceptance. Recommending a risk assessment is the best action, because it can provide valuable information and guidance to the business areas and the IT department for managing the cloud services in a consistent, effective, and efficient manner, and for aligning the cloud services with the organizational objectives, strategy, and risk appetite. The other options are not the best action, although they may be related or subsequent steps in the risk management process. Recommending the IT department remove access to the cloud services is a drastic and impractical action, as it may disrupt the business operations and services, and it may not address the underlying causes or drivers of the cloud service adoption. Engaging with the business area managers to review controls applied is a useful and collaborative action, as it can help to understand and evaluate the current state and practices of the cloud service usage, and to identify and address any gaps or issues in the control environment. However, this action should be based on or supported by a risk assessment, rather than preceding or replacing it. Escalating to the risk committee is a reporting and communication action, as it can help to inform and involve the senior management and other stakeholders in the risk management process, and to obtain their support and approval for the risk response actions. However, this action should be done after or along with a risk assessment, rather than before or instead of it.

Reference: = Best Practices to Manage Risks in the Cloud – ISACA, Cloud Risk Management – PwC UK

Question #190

When reviewing management’s IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios.

What should be the NEXT course of action?

A . Assess management’s risk tolerance.
B . Recommend management accept the low-risk scenarios.
C . Propose mitigating controls
D . Re-evaluate the risk scenarios associated with the control

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

IT control self-assessments are techniques that involve identifying and evaluating the effectiveness and efficiency of the IT controls that are designed and implemented to mitigate the IT risks, by the managers and staff within the organization12.

An ineffective control is a control that does not achieve its intended objective or purpose, or does not operate as designed or expected34.

A low residual risk scenario is a situation or occurrence that has a low likelihood and impact of affecting the organization’s objectives, performance, or value creation, after considering the existing controls and their effectiveness56.

The next course of action when reviewing management’s IT control self-assessments and noting an ineffective control that links to several low residual risk scenarios is to recommend management accept the low-risk scenarios, which is a risk response strategy that involves acknowledging and tolerating the level of risk exposure, and not taking any further action to reduce or eliminate it78. Recommending management accept the low-risk scenarios is the next course of action because it is the most cost-effective and reasonable option, given that the level of risk exposure is low and acceptable, and the cost and effort of implementing or improving the control may outweigh the potential benefits or value78.

Recommending management accept the low-risk scenarios is also the next course of action because it is consistent with the risk management process and objectives, which are to identify and address the risks that may affect the achievement of the organization’s goals and the delivery of value to the stakeholders, and to optimize the balance between risk and reward78.

The other options are not the next course of action, but rather possible alternatives or steps that may be considered or followed in different circumstances or scenarios.

For example:

Assessing management’s risk tolerance is a step that involves determining and communicating the acceptable or tolerable level of risk exposure for the organization or its business units, based on the

organization’s risk appetite, criteria, and objectives78. However, this step is not the next course of action because it is usually done before or during the risk assessment process, and not after noting an ineffective control that links to several low residual risk scenarios78.

Proposing mitigating controls is a course of action that involves suggesting or recommending additional or alternative controls that can reduce or eliminate the level of risk exposure, and improve the effectiveness and efficiency of the risk management process78. However, this course of action is not the next course of action because it is not necessary or appropriate for low residual risk scenarios, as the cost and effort of implementing or improving the controls may outweigh the potential benefits or value78.

Re-evaluating the risk scenarios associated with the control is a course of action that involves revising and updating the likelihood and impact of the risk scenarios, and the level of risk exposure or tolerance for the organization, based on the current or changed conditions or factors that influence the risk landscape78. However, this course of action is not the next course of action because it is not required or relevant for low residual risk scenarios, as the level of risk exposure is already low and acceptable, and the ineffective control does not significantly affect the risk assessment78.

Reference: =

1: Control Self Assessments – PwC1

2: Control self-assessment – Wikipedia2

3: Ineffective Controls: What They Are and How to Identify Them3

4: Ineffective Controls: What They Are and How to Identify Them4

5: Residual Risk – Definition and Examples5

6: Residual Risk: Definition, Formula & Management6

7: Risk IT Framework, ISACA, 2009

8: IT Risk Management Framework, University of Toronto, 2017