Free ISACA CRISC Practice Exams - Page 21 of 73

Question #201

An assessment of information security controls has identified ineffective controls.

Which of the following should be the risk practitioner’s FIRST course of action?

A . Determine whether the impact is outside the risk appetite.
B . Request a formal acceptance of risk from senior management.
C . Report the ineffective control for inclusion in the next audit report.
D . Deploy a compensating control to address the identified deficiencies.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The risk practitioner’s first course of action when an assessment of information security controls has identified ineffective controls should be A. Determine whether the impact is outside the risk appetite1

According to the CRISC Review Manual, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite reflects the organization’s risk culture, strategy, and values2

When an assessment of information security controls has identified ineffective controls, it means that the controls are not providing the expected level of protection or assurance for the information assets or processes. This may result in increased exposure or vulnerability to threats, or reduced ability to achieve objectives. Therefore, the risk practitioner should first determine whether the impact of the ineffective controls is outside the risk appetite, as this would indicate the need for urgent action or escalation3

The other options are not the first course of action when an assessment of information security controls has identified ineffective controls, because:

• B. Requesting a formal acceptance of risk from senior management may be appropriate if the impact of the ineffective controls is within the risk appetite, and the organization decides to accept the risk as it is. However, this should not be the first course of action, as it may not address the root cause of the ineffective controls, or the potential consequences or opportunities for improvement4

• C. Reporting the ineffective control for inclusion in the next audit report may be part of the risk communication and reporting process, but it should not be the first course of action, as it may delay the resolution or mitigation of the issue, or the implementation of corrective actions.

Moreover, the next audit report may not be timely or relevant for the decision-makers or stakeholders who need to be informed of the ineffective controls5

• D. Deploying a compensating control to address the identified deficiencies may be a possible risk response option, but it should not be the first course of action, as it may require further analysis, evaluation, and approval. Moreover, deploying a compensating control may not be the most effective or efficient solution, as it may introduce additional complexity, cost, or risk.

1: CRISC Review Questions, Answers & Explanations Database, Question ID: 100003 2: CRISC Review Manual, 7th Edition, page 28 3: CRISC Review Manual, 7th Edition, page 223 4: CRISC Review Manual, 7th Edition, page 224 5: CRISC Review Manual, 7th Edition, page 225: CRISC Review Manual, 7th Edition, page 226

Question #202

Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?

A . Single loss expectancy (SLE)
B . Cost of the information system
C . Availability of additional compensating controls
D . Potential business impacts are within acceptable levels

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The BEST information when determining whether to accept residual risk of a critical system to be implemented is the potential business impacts are within acceptable levels, because it indicates that the residual risk, which is the risk that remains after the risk response actions, does not exceed the risk tolerance and appetite of the organization, and that it does not pose a significant threat or disruption to the business objectives and processes. The potential business impacts are the consequences or outcomes of the residual risk on the organization’s performance, reputation, and value.

The other options are not as informative as the potential business impacts, because:

Option A: Single loss expectancy (SLE) is a measure of the monetary loss that is expected from a single occurrence of a risk event, but it does not provide the best information when determining whether to accept residual risk, because it does not consider the frequency or probability of the risk event, or the qualitative aspects of the risk impact, such as customer satisfaction, employee morale, or regulatory compliance.

Option B: Cost of the information system is a measure of the total expenditure that is required to acquire, develop, operate, and maintain the information system, but it does not provide the best information when determining whether to accept residual risk, because it does not reflect the value or benefit of the information system, or the risk exposure or variation that the information system may introduce or encounter.

Option C: Availability of additional compensating controls is a measure of the alternative or supplementary controls that can be implemented to reduce the residual risk, but it does not provide the best information when determining whether to accept residual risk, because it does not indicate the effectiveness or efficiency of the compensating controls, or the cost-benefit analysis of implementing them.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 122.

Question #203

Which of the following is the MAIN reason to continuously monitor IT-related risk?

A . To redefine the risk appetite and risk tolerance levels based on changes in risk factors
B . To update the risk register to reflect changes in levels of identified and new IT-related risk
C . To ensure risk levels are within acceptable limits of the organization’s risk appetite and risk tolerance
D . To help identify root causes of incidents and recommend suitable long-term solutions

Reveal Solution Hide Solution

Question #204

A risk practitioner has been asked to evaluate a new cloud-based service to enhance an organization’s access management capabilities.

When is the BEST time for the risk practitioner to provide opinions on control strength?

A . After the initial design
B . Before production rollout
C . After a few weeks in use
D . Before end-user testing

Reveal Solution Hide Solution

Question #205

Which of the following should be the PRIMARY basis for deciding whether to disclose information related to risk events that impact external stakeholders?

A . Stakeholder preferences
B . Contractual requirements
C . Regulatory requirements
D . Management assertions

Reveal Solution Hide Solution

Question #206

A risk practitioner has been notified of a social engineering attack using artificial intelligence (AI) technology to impersonate senior management personnel.

Which of the following would BEST mitigate the impact of such attacks?

A . Subscription to data breach monitoring sites
B . Suspension and takedown of malicious domains or accounts
C . Increased monitoring of executive accounts
D . Training and awareness of employees for increased vigilance

Reveal Solution Hide Solution

Question #207

Which of the following is the MOST critical factor to consider when determining an organization’s risk appetite?

A . Fiscal management practices
B . Business maturity
C . Budget for implementing security
D . Management culture

Reveal Solution Hide Solution

Question #208

An organization needs to send files to a business partner to perform a quality control audit on the organization’s record-keeping processes. The files include personal information on the organization’s customers.

Which of the following is the BEST recommendation to mitigate privacy risk?

A . Obfuscate the customers’ personal information.
B . Require the business partner to delete personal information following the audit.
C . Use a secure channel to transmit the files.
D . Ensure the contract includes provisions for sharing personal information.

Reveal Solution Hide Solution

Question #209

Which of the following is the BEST approach to mitigate the risk associated with a control deficiency?

A . Perform a business case analysis
B . Implement compensating controls.
C . Conduct a control sell-assessment (CSA)
D . Build a provision for risk

Reveal Solution Hide Solution

Question #210

A maturity model will BEST indicate:

A . confidentiality and integrity.
B . effectiveness and efficiency.
C . availability and reliability.
D . certification and accreditation.

Reveal Solution Hide Solution