Free ISACA CRISC Practice Exams - Page 22 of 73

Question #211

Which of the following is the GREATEST concern when an organization uses a managed security service provider as a firewall administrator?

A . Exposure of log data
B . Lack of governance
C . Increased number of firewall rules
D . Lack of agreed-upon standards

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A managed security service provider (MSSP) is a third-party entity that offers network security services to an organization, such as firewall operation, administration, monitoring, and maintenance1. A firewall is a device or software that controls the incoming and outgoing network traffic based on predefined rules2. A firewall administrator is a person or entity that manages and maintains the firewall configuration, rules, and policies3. When an organization uses an MSSP as a firewall administrator, the greatest concern is the exposure of log data, because log data contains sensitive and valuable information about the organization’s network activity, such as source and destination IP addresses, ports, protocols, timestamps, and user identities4. If the log data is not protected properly by the MSSP, it could be accessed, modified, or stolen by unauthorized parties, such as hackers, competitors, or regulators, which could result in data breaches, compliance violations, reputational damage, or legal liabilities for the organization5. The other options are not as concerning as the exposure of log data, because they do not pose a direct and immediate threat to the organization’s data security and privacy, but rather affect the quality and efficiency of the firewall management, as explained below:

B. Lack of governance is a concern when an organization uses an MSSP as a firewall administrator, because it could lead to misalignment or inconsistency between the organization’s and the MSSP’s objectives, policies, and standards for firewall management. However, this concern can be mitigated by establishing a clear and comprehensive service level agreement (SLA) with the MSSP, which defines the roles, responsibilities, expectations, and performance indicators for the firewall management service6.

C. Increased number of firewall rules is a concern when an organization uses an MSSP as a firewall administrator, because it could create complexity, confusion, or duplication in the firewall configuration, which could affect the firewall performance and security. However, this concern can be mitigated by conducting regular firewall audits and reviews with the MSSP, which can help to rationalize, optimize, and update the firewall rules, and to ensure that they are relevant, effective, and efficient for the organization’s network environment.

D. Lack of agreed-upon standards is a concern when an organization uses an MSSP as a firewall administrator, because it could result in gaps or weaknesses in the firewall design and implementation, which could compromise the firewall functionality and security. However, this concern can be mitigated by adopting and following industry best practices, norms, and expectations for firewall management, such as the National Institute of Standards and Technology (NIST) guidelines, the Center for Internet Security (CIS) benchmarks, or the Payment Card Industry Data Security Standard (PCI DSS) requirements.

Reference: = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 115.

What Is A Managed Security Service Provider (MSSP)? – Fortinet, What is a Firewall? – Definition from Techopedia, Firewall Administrator Job Description – Betterteam, What is a Firewall Log? – Definition from Techopedia, Firewall Log Management: Why It’s Important and How to Do It Right, How to Write a Service Level Agreement (SLA) for an MSSP, [Firewall Auditing: Best Practices for Security and Compliance], [Guidelines on Firewalls and Firewall Policy | CSRC], [CIS Firewall Benchmark – CIS], [PCI DSS and Firewalls – PCI Security Standards Council]

Question #212

A bank has outsourced its statement printing function to an external service provider.

Which of the following is the MOST critical requirement to include in the contract?

A . Monitoring of service costs
B . Provision of internal audit reports
C . Notification of sub-contracting arrangements
D . Confidentiality of customer data

Reveal Solution Hide Solution

Question #213

Which of the following is the GREATEST benefit of centralizing IT systems?

A . Risk reporting
B . Risk classification
C . Risk monitoring
D . Risk identification

Reveal Solution Hide Solution

Question #214

Which of the following would be a risk practitioner’$ BEST recommendation to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile?

A . Manage cyber risk according to the organization’s risk management framework.
B . Define cyber roles and responsibilities across the organization
C . Conduct cyber risk awareness training tailored specifically for senior management
D . Implement a cyber risk program based on industry best practices

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Managing cyber risk according to the organization’s risk management framework is the best recommendation to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile, as it helps to integrate and align the cybersecurity risk management (CSRM) and the enterprise risk management (ERM) processes. A risk management framework is a set of principles, policies, and practices that guide and support the risk management activities within an organization. A risk management framework helps to establish a consistent, comprehensive, and coordinated approach to risk management across the organization and to the external stakeholders.

Managing cyber risk according to the organization’s risk management framework helps to ensure cyber risk is assessed and reflected in the enterprise-level risk profile by providing the following benefits:

It enables a holistic and comprehensive view of the cyber risk landscape and its interdependencies with the business processes and functions.

It facilitates the communication and collaboration among the business and IT stakeholders and enhances their understanding and awareness of the cyber risk exposure and control environment. It supports the development and implementation of effective and efficient cyber risk response and mitigation strategies and actions that are aligned with the business risk appetite and objectives.

It provides feedback and learning opportunities for the cyber risk management and control processes and helps to foster a culture of continuous improvement and innovation.

The other options are not the best recommendations to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile. Defining cyber roles and responsibilities across the organization is a good practice to clarify and assign the duties and accountabilities for the cyber risk management and control processes, but it does not directly address the cyber risk assessment and integration with the enterprise-level risk profile. Conducting cyber risk awareness training tailored specifically for senior management is a useful method to educate and engage the senior management in the cyber risk management and control processes, but it does not provide a systematic or consistent way to assess and reflect the cyber risk in the enterprise-level risk profile. Implementing a cyber risk program based on industry best practices is a possible action to improve and enhance the cyber risk management and control processes, but it does not ensure the alignment or integration with the organization’s risk management framework or the enterprise-level risk profile.

Reference: = Integrating Cybersecurity and Enterprise Risk Management (ERM) – NIST, IT Risk Resources | ISACA, Identifying and Estimating Cybersecurity Risk for Enterprise Risk …

Question #215

Which of the following s MOST likely to deter an employee from engaging in inappropriate use of company owned IT systems?

A . A centralized computer security response team
B . Regular performance reviews and management check-ins
C . Code of ethics training for all employees
D . Communication of employee activity monitoring

Reveal Solution Hide Solution

Question #216

Which of the following is MOST important information to review when developing plans for using emerging technologies?

A . Existing IT environment
B . IT strategic plan
C . Risk register
D . Organizational strategic plan

Reveal Solution Hide Solution

Question #217

Which of the following would be the GREATEST risk associated with a new implementation of single sign-on?

A . Complex security administration
B . Single point of failure
C . Inability to access key information
D . User resistance to single sign-on

Reveal Solution Hide Solution

Question #218

Which of the following is necessary to enable an IT risk register to be consolidated with the rest of

the organization’s risk register?

A . Risk taxonomy
B . Risk response
C . Risk appetite
D . Risk ranking

Reveal Solution Hide Solution

Question #219

Which of the following is the BEST method for determining an enterprise’s current appetite for risk?

A . Comparative analysis of peer companies
B . Reviews of brokerage firm assessments
C . Interviews with senior management
D . Trend analysis using prior annual reports

Reveal Solution Hide Solution

Question #220

During the initial risk identification process for a business application, it is MOST important to include which of the following stakeholders?

A . Business process owners
B . Business process consumers
C . Application architecture team
D . Internal audit

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The MOST important stakeholders to include during the initial risk identification process for a business application are the business process owners, because they are the ones who have the authority and responsibility for the business processes that are supported or enabled by the business application. The business process owners can provide valuable input and feedback on the business objectives, requirements, and expectations of the business application, as well as the potential risks, impacts, and opportunities that may affect the business processes and outcomes. The other options are not as important as the business process owners, because:

Option B: Business process consumers are the ones who use or benefit from the business processes that are supported or enabled by the business application, such as customers, employees, or partners. They can provide useful information and perspectives on the user needs, preferences, and satisfaction of the business application, but they are not as important as the business process owners, who have the ultimate accountability and authority for the business processes and outcomes.

Option C: Application architecture team is the one who designs and develops the technical architecture and components of the business application, such as the hardware, software, network, and data. They can provide technical expertise and guidance on the feasibility, functionality, and security of the business application, but they are not as important as the business process owners, who have the primary stake and interest in the business application and its alignment with the business processes and objectives.

Option D: Internal audit is the one who provides independent assurance and consulting services on the governance, risk management, and control processes of the organization, including the business application. They can provide objective and impartial evaluation and recommendation on the effectiveness and efficiency of the business application and its compliance with the internal and external standards and regulations, but they are not as important as the business process owners, who have the direct involvement and influence on the business application and its performance and value.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 103.