Free ISACA CRISC Practice Exams - Page 24 of 73

Question #231

Which of the following data would be used when performing a business impact analysis (BIA)?

A . Cost-benefit analysis of running the current business
B . Cost of regulatory compliance
C . Projected impact of current business on future business
D . Expected costs for recovering the business

Correct Answer: D
D

Explanation:

A business impact analysis (BIA) is a process that identifies and assesses the effects that accidents, emergencies, disasters, and other unplanned, negative events could have on a business. The BIA (sometimes also called business impact assessment) predicts how a business will be affected by everything from a hurricane to a labor strike1.

One of the data that would be used when performing a BIA is the expected costs for recovering the business. This data can help to estimate the amount of resources and funds that would be needed to restore the normal operations and functions of the business after a disruption. The expected costs for recovering the business can include:

The costs of repairing or replacing damaged or lost assets, such as equipment, inventory, or facilities The costs of hiring or training additional staff, or outsourcing some tasks or services

The costs of implementing alternative or backup systems or processes, such as cloud computing or manual procedures

The costs of communicating and coordinating with customers, suppliers, partners, regulators, and other stakeholders

The costs of complying with legal or contractual obligations, or paying fines or penalties

The costs of mitigating or preventing further losses or damages, such as insurance premiums or security measures23

The expected costs for recovering the business can help to determine the priority and urgency of the recovery activities, and to allocate the available resources and funds accordingly. The expected costs for recovering the business can also help to evaluate the cost-effectiveness and feasibility of the recovery strategies and options, and to justify the investment in the business continuity planning and management4.

The other options are not the data that would be used when performing a BIA, but rather the data that would be used for other purposes or processes. A cost-benefit analysis of running the current business is a data that would be used to compare the advantages and disadvantages of different business decisions or alternatives, such as launching a new product or service, or expanding to a new market. A cost-benefit analysis can help to assess the profitability and viability of the current business, but it does not measure the impact of a disruption on the business5. A cost of regulatory compliance is a data that would be used to estimate the amount of resources and funds that would be required to meet the rules and standards set by the authorities or agencies that govern the business, such as laws, regulations, or policies. A cost of regulatory compliance can help to ensure the legality and accountability of the business, but it does not measure the impact of a disruption on the business. A projected impact of current business on future business is a data that would be used to forecast the potential outcomes and consequences of the current business activities or strategies on the future business performance and growth, such as sales, revenue, market share, or customer satisfaction. A projected impact of current business on future business can help to plan and optimize the future business, but it does not measure the impact of a disruption on the current business.

Reference: =

Business Impact Analysis | Ready.gov

Business Impact Analysis Toolkit | Smartsheet

Business Impact Analysis (BIA): Prepare for Anything [2023] • Asana How To Conduct Business Impact Analysis in 8 Easy Steps – G2 Cost Benefit Analysis – ISACA

[Regulatory Compliance – ISACA]

[Impact Analysis – ISACA]

[CRISC Review Manual, 7th Edition]

Question #232

Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?

A . Directives from legal and regulatory authorities
B . Audit reports from internal information systems audits
C . Automated logs collected from different systems
D . Trend analysis of external risk factors

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Key risk indicators (KRIs) are metrics that help organizations monitor and evaluate the level of risk they are exposed to. They provide early warning signals of potential issues that could affect the achievement of organizational goals12.

The most important data source for monitoring KRIs is automated logs collected from different systems, which are records that capture and store the details and history of the transactions or activities that are performed by the organization’s processes, systems, or controls34.

Automated logs collected from different systems are the most important data source because they provide timely and accurate data and information on the performance and status of the organization’s operations, and enable the detection and reporting of any deviations, anomalies, or issues that may indicate a risk event34.

Automated logs collected from different systems are also the most important data source because they support the accountability and auditability of the organization’s operations, and facilitate the investigation and resolution of any risk event34.

The other options are not the most important data sources, but rather possible inputs or factors that may influence or affect the KRIs.

For example:

Directives from legal and regulatory authorities are documents that provide the expectations and obligations of the external authorities or bodies that govern or oversee the organization’s activities and operations, such as laws, regulations, standards, or contracts5. However, these documents are not the most important data source because they do not directly measure or monitor the level of risk exposure, but rather provide the criteria or framework for risk compliance5.

Audit reports from internal information systems audits are documents that provide the findings and recommendations of the independent and objective assessment of the adequacy and effectiveness of the organization’s information systems, processes, and controls. However, these documents are not the most important data source because they do not directly measure or monitor the level of risk exposure, but rather provide the assurance or improvement for risk management.

Trend analysis of external risk factors is a technique that involves analyzing and forecasting the changes and impacts of the external factors that influence the organization’s operations, such as technology, competition, regulation, or customer behavior. However, this technique is not the most important data source because it does not directly measure or monitor the level of risk exposure, but rather provide the insight or prediction for risk identification.

Reference: =

1: Key Risk Indicators: A Practical Guide | SafetyCulture1

2: Key risk indicator – Wikipedia2

3: Database Activity Monitoring – Wikipedia3

4: Database Activity Monitoring (DAM) | Imperva4

5: Regulatory Compliance – Wikipedia5

: Regulatory Compliance Management Software | MetricStream

: IT Audit and Assurance Standards, ISACA, 2014

: IT Audit and Assurance Guidelines, ISACA, 2014

: Trend Analysis – Investopedia

: Trend Analysis: A Definition and Examples

Question #233

Which of the following would BEST enable a risk practitioner to embed risk management within the organization?

A . Provide risk management feedback to key stakeholders.
B . Collect and analyze risk data for report generation.
C . Monitor and prioritize risk data according to the heat map.
D . Engage key stakeholders in risk management practices.

Reveal Solution Hide Solution

Question #234

An organization has granted a vendor access to its data in order to analyze customer behavior.

Which of the following would be the MOST effective control to mitigate the risk of customer data leakage?

A . Enforce criminal background checks.
B . Mask customer data fields.
C . Require vendor to sign a confidentiality agreement.
D . Restrict access to customer data on a "need to know” basis.

Reveal Solution Hide Solution

Question #235

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery plan (DRP)?

A . Number of users that participated in the DRP testing
B . Number of issues identified during DRP testing
C . Percentage of applications that met the RTO during DRP testing
D . Percentage of issues resolved as a result of DRP testing

Reveal Solution Hide Solution

Question #236

Which of the following is the MOST important information to be communicated during security awareness training?

A . Management’s expectations
B . Corporate risk profile
C . Recent security incidents
D . The current risk management capability

Reveal Solution Hide Solution

Question #237

During an acquisition, which of the following would provide the MOST useful input to the parent company’s risk practitioner when developing risk scenarios for the post-acquisition phase?

A . Risk management framework adopted by each company
B . Risk registers of both companies
C . IT balanced scorecard of each company
D . Most recent internal audit findings from both companies

Reveal Solution Hide Solution

Question #238

To implement the MOST effective monitoring of key risk indicators (KRIs), which of the following needs to be in place?

A . Threshold definition
B . Escalation procedures
C . Automated data feed
D . Controls monitoring

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Key risk indicators (KRIs) are the metrics or measures that provide information and insight on the level and trend of the risks that may affect the organization’s objectives and operations. KRIs can help the organization to monitor and communicate the risks, and to support the decision making and planning for the risk management.

To implement the most effective monitoring of KRIs, one of the essential elements that needs to be in place is threshold definition, which is the process of establishing and specifying the acceptable or tolerable ranges or limits for the KRIs, based on the organization’s risk appetite and tolerance.

Threshold definition can help the organization to monitor KRIs by providing the following benefits: It can enable the comparison and evaluation of the actual or current values of the KRIs with the expected or desired values of the KRIs, and to identify and quantify the deviations or variations that may indicate the changes or developments in the risk level or performance.

It can trigger the alerts or notifications when the values of the KRIs exceed or fall below the thresholds, and to initiate the appropriate actions or responses to address or correct the risks and their impacts.

It can provide useful references and benchmarks for the alignment and integration of the KRIs with the organization’s risk management function, and for the compliance with the organization’s risk policies and standards.

The other options are not the essential elements that need to be in place to implement the most effective monitoring of KRIs, because they do not address the main purpose and benefit of threshold definition, which is to establish and specify the acceptable or tolerable ranges or limits for the KRIs. Escalation procedures are the processes and guidelines for communicating and sharing the information and status of the risks and their responses among the relevant stakeholders, and for escalating or transferring the risks and their responses to the appropriate levels or parties when necessary or required. Escalation procedures can help the organization to monitor KRIs by ensuring the awareness and involvement of the stakeholders, but they are not the essential elements that need to be in place, because they do not establish and specify the acceptable or tolerable ranges or limits for the KRIs.

Automated data feed is the process of using a software tool or system to collect and transmit the data or information that are related or relevant to the KRIs, and to ensure the accuracy, reliability, and timeliness of the data or information. Automated data feed can help the organization to monitor KRIs by providing the data or information that are necessary and relevant for the KRIs, but they are not the essential elements that need to be in place, because they do not establish and specify the acceptable or tolerable ranges or limits for the KRIs.

Controls monitoring is the process of verifying and validating the adequacy and effectiveness of the controls that are intended to ensure the confidentiality, integrity, availability, and reliability of the information systems and resources that are affected by the risks. Controls monitoring can help the organization to monitor KRIs by providing the assurance and evidence on the performance and compliance of the controls, but they are not the essential elements that need to be in place, because they do not establish and specify the acceptable or tolerable ranges or limits for the KRIs.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 206 CRISC Practice Quiz and Exam Prep

Question #239

Which of the following is the MOST important course of action for a risk practitioner when reviewing the results of control performance monitoring?

A . Evaluate changes to the organization’s risk profile.
B . Validate whether the controls effectively mitigate risk.
C . Confirm controls achieve regulatory compliance.
D . Analyze appropriateness of key performance indicators (KPIs).

Reveal Solution Hide Solution

Question #240

Which of the following is BEST measured by key control indicators (KCIs)?

A . Historical trends of the organizational risk profile
B . Cost efficiency of risk treatment plan projects
C . Comprehensiveness of risk assessment procedures
D . Effectiveness of organizational defense in depth

Reveal Solution Hide Solution