Free ISACA CRISC Practice Exams - Page 23 of 73

Question #221

Who is ULTIMATELY accountable for risk treatment?

A . Risk owner
B . Enterprise risk management (ERM)
C . Risk practitioner
D . Control owner

Reveal Solution Hide Solution

Question #222

Which of the following would qualify as a key performance indicator (KPI)?

A . Aggregate risk of the organization
B . Number of identified system vulnerabilities
C . Number of exception requests processed in the past 90 days
D . Number of attacks against the organization’s website

Reveal Solution Hide Solution

Question #223

Which of the following BEST confirms the existence and operating effectiveness of information systems controls?

A . Self-assessment questionnaires completed by management
B . Review of internal audit and third-party reports
C . Management review and sign-off on system documentation
D . First-hand direct observation of the controls in operation

Reveal Solution Hide Solution

Question #224

A risk practitioner has been asked to advise management on developing a log collection and correlation strategy.

Which of the following should be the MOST important consideration when developing this strategy?

A . Ensuring time synchronization of log sources.
B . Ensuring the inclusion of external threat intelligence log sources.
C . Ensuring the inclusion of all computing resources as log sources.
D . Ensuring read-write access to all log sources

Reveal Solution Hide Solution

Question #225

Which of the following proposed benefits is MOST likely to influence senior management approval to reallocate budget for a new security initiative?

A . Reduction in the number of incidents
B . Reduction in inherent risk
C . Reduction in residual risk
D . Reduction in the number of known vulnerabilities

Reveal Solution Hide Solution

Question #226

Of the following, who should be responsible for determining the inherent risk rating of an application?

A . Application owner
B . Senior management
C . Risk practitioner
D . Business process owner

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Inherent risk rating is a measure of the natural level of risk that is part of an application, before any controls are applied1. Inherent risk rating helps to identify and prioritize the applications that pose the highest risk to the organization and require the most attention and resources for risk management2. The responsibility for determining the inherent risk rating of an application should belong to the risk practitioner, as they have the expertise and knowledge to perform a comprehensive and consistent risk assessment of the application, using a standard methodology and criteria3. The risk practitioner should also communicate and report the inherent risk rating of the application to the relevant stakeholders, such as the application owner, senior management, and business process owner, and provide recommendations for risk mitigation4. The application owner, senior management, and business process owner are not the best choices for determining the inherent risk rating of an application, as they may not have the same level of skill and objectivity as the risk practitioner. The application owner is the person who has the authority and accountability for the application and its performance5. The application owner may be involved in providing input and feedback to the risk practitioner during the risk assessment process, but they may not be able to assess the inherent risk rating of the application independently and impartially, as they may have a vested interest in the application’s success and reputation6. Senior management is the group of executives who set the strategic direction and objectives of the organization and oversee its performance7. Senior management may be involved in approving and endorsing the risk assessment process and its results, but they may not be able to assess the inherent risk rating of the application in detail and depth, as they may have a broader and higher-level perspective of the organization’s risk profile and priorities8. The business process owner is the person who has the authority and accountability for a business process that is supported or enabled by the application. The business process owner may be involved in providing input and feedback to the risk practitioner during the risk assessment process, but they may not be able to assess the inherent risk rating of the application accurately and comprehensively, as they may have a limited and specific view of the application’s functionality and value.

Reference: = 2: Introduction to application risk rating & assessment | Infosec3: Application Security Risk: Assessment and Modeling – ISACA4: Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.1: Inherent Risk Rating – Shared Assessments – Third Party Risk Management5: [Application Owner – Gartner IT Glossary] 6: Perform Inherent Risk Analysis – Oracle7: [Senior Management – Definition, Roles and Responsibilities] 8: Rating Inherent and Residual Risk – Barn Owl: [Business Process Owner – Gartner IT Glossary]: [Business Process Owner – Roles and Responsibilities]

Question #227

Which of the following BEST protects organizational data within a production cloud environment?

A . Data encryption
B . Continuous log monitoring
C . Right to audit
D . Data obfuscation

Reveal Solution Hide Solution

Question #228

Which of the following is the STRONGEST indication an organization has ethics management issues?

A . Employees do not report IT risk issues for fear of consequences.
B . Internal IT auditors report to the chief information security officer (CISO).
C . Employees face sanctions for not signing the organization’s acceptable use policy.
D . The organization has only two lines of defense.

Reveal Solution Hide Solution

Question #229

A contract associated with a cloud service provider MUST include:

A . ownership of responsibilities.
B . a business recovery plan.
C . provision for source code escrow.
D . the providers financial statements.

Reveal Solution Hide Solution

Question #230

Which of the following is the PRIMARY role of the board of directors in corporate risk governance?

A . Approving operational strategies and objectives
B . Monitoring the results of actions taken to mitigate risk
C . Ensuring the effectiveness of the risk management program
D . Ensuring risk scenarios are identified and recorded in the risk register

Reveal Solution Hide Solution