Free ISACA CRISC Practice Exams - Page 25 of 73

Question #241

A failure in an organization’s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software.

Which of the following should be the risk practitioner’s IMMEDIATE concern?

A . Threats are not being detected.
B . Multiple corporate build images exist.
C . The IT build process was not followed.
D . The process documentation was not updated.

Reveal Solution Hide Solution

Question #242

An organization has just started accepting credit card payments from customers via the corporate website.

Which of the following is MOST likely to increase as a result of this new initiative?

A . Risk tolerance
B . Risk appetite
C . Inherent risk
D . Residual risk

Reveal Solution Hide Solution

Question #243

Which of The following should be of GREATEST concern for an organization considering the adoption of a bring your own device (BYOD) initiative?

A . Device corruption
B . Data loss
C . Malicious users
D . User support

Reveal Solution Hide Solution

Question #244

Which of the following BEST enables the risk profile to serve as an effective resource to support business objectives?

A . Engaging external risk professionals to periodically review the risk
B . Prioritizing global standards over local requirements in the risk profile
C . Updating the risk profile with risk assessment results
D . Assigning quantitative values to qualitative metrics in the risk register

Reveal Solution Hide Solution

Question #245

An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard.

Which risk treatment was adopted by the organization?

A . Acceptance
B . Transfer
C . Mitigation
D . Avoidance

Reveal Solution Hide Solution

Question #246

An organization has established a single enterprise-wide risk register that records high-level risk scenarios. The IT risk department has created its own register to record more granular scenarios applicable to IT.

Which of the following is the BEST way to ensure alignment between these two registers?

A . Map the granular risk scenarios to the high-level risk register items.
B . List application and server vulnerabilities in the IT risk register.
C . Identify overlapping risk scenarios between the two registers.
D . Maintain both high-level and granular risk scenarios in a single register.

Reveal Solution Hide Solution

Question #247

Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?

A . Solutions for eradicating emerging threats
B . Cost to mitigate the risk resulting from threats
C . Indicators for detecting the presence of threatsl)
D . Source and identity of attackers

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

• External sources of emerging threats are sources that provide information about the latest cyberattacks, hacking techniques, malware, and vulnerabilities that can affect an organization’s IT systems and data. Examples of external sources are security blogs, forums, newsletters, reports, and alerts from reputable organizations such as ISACA, Imperva, Aura, and BitSight123.

• The most useful information an organization can obtain from external sources is the indicators for detecting the presence of threats. Indicators are observable signs or patterns that can help identify, prevent, or mitigate cyberattacks. Examples of indicators are IP addresses, domain names, file hashes, network traffic, system logs, and user behavior4.

• Indicators for detecting the presence of threats are more useful than the other options because they can help an organization to:

o Monitor and analyze its IT environment for any suspicious or malicious activity

o Respond quickly and effectively to any potential or actual incidents

o Reduce the impact and damage of cyberattacks

o Improve its security posture and resilience

• Solutions for eradicating emerging threats are not the most useful information because they may not be applicable or effective for every organization, depending on its specific context, needs, and resources. Moreover, solutions may not be available or known for some new or sophisticated threats.

• Cost to mitigate the risk resulting from threats is not the most useful information because it does not help an organization to identify or prevent cyberattacks. Cost is only one factor to consider when deciding how to manage IT risk, and it may not reflect the true value or impact of the threats.

• Source and identity of attackers are not the most useful information because they may not be relevant or accurate for every organization. Source and identity of attackers are often difficult to trace or verify, and they may not affect the organization’s risk level or response strategy.

Reference: =

• Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, Chapter 2: IT Risk Assessment, Section 2.3: Risk Identification, pp. 83-84

• Risk and Information Systems Control Review Questions, Answers & Explanations Database, 12 Month Subscription, ISACA, 2020, Question ID: 100000

Question #248

Which of the following will BEST ensure that information security risk factors are mitigated when developing in-house applications?

A . Identify information security controls in the requirements analysis
B . Identify key risk indicators (KRIs) as process output.
C . Design key performance indicators (KPIs) for security in system specifications.
D . Include information security control specifications in business cases.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Information security risk factors are the sources of uncertainty that may affect the confidentiality, integrity, or availability of information assets within an organization. Information security risk factors can include threats, vulnerabilities, or impacts that may compromise the security of information assets. Information security risk factors should be mitigated when developing in-house applications, which are software applications that are designed, developed, and maintained by the organization itself, rather than by external vendors or providers. Mitigating information security risk factors when developing in-house applications can help prevent or reduce the occurrence or consequences of security incidents, such as data breaches, cyberattacks, unauthorized access, or data loss. The best way to ensure that information security risk factors are mitigated when developing in-house applications is to identify information security controls in the requirements analysis. The requirements analysis is the stage of the system development life cycle (SDLC) where the business needs and expectations of the application are defined and documented. The requirements analysis should include the functional and non-functional requirements of the application, such as the features, functions, performance, quality, reliability, and security of the application. Identifying information security controls in the requirements analysis can help ensure that the security requirements of the application are clearly specified and agreed upon by the stakeholders, and that they are aligned with the organization’s security policies, standards, and regulations. Identifying information security controls in the requirements analysis can also help ensure that the security requirements are integrated into the design, development, testing, and deployment of the application, and that they are verified and validated throughout the SDLC. Identifying information security controls in the requirements analysis can also help ensure that the security requirements are traceable, measurable, and manageable, and that they can be monitored and reviewed for effectiveness and efficiency.

Reference: = THE SYSTEM DEVELOPMENT LIFE CYCLE (SDLC), p. 2-3, System Development Life Cycle – GeeksforGeeks, 7.3: Systems Development Life Cycle – Engineering LibreTexts, What Is SDLC? 7 Phases of System Development Life Cycle – Intetics.

Question #249

The number of tickets to rework application code has significantly exceeded the established threshold.

Which of the following would be the risk practitioner s BEST recommendation?

A . Perform a root cause analysis
B . Perform a code review
C . Implement version control software.
D . Implement training on coding best practices

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A root cause analysis is a process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. A root cause analysis can provide useful insights and solutions on the origin and nature of the problem or incident, and prevent or reduce its recurrence or impact.

Performing a root cause analysis is the risk practitioner’s best recommendation when the number of tickets to rework application code has significantly exceeded the established threshold, because it can help the organization to address the following questions: Why did the application code require rework?

What were the errors or defects in the application code?

How did the errors or defects affect the functionality or usability of the application?

Who was responsible or accountable for the application code development and testing?

When and how were the errors or defects detected and reported?

What were the costs or consequences of the rework for the organization and its stakeholders?

How can the errors or defects be prevented or minimized in the future?

Performing a root cause analysis can help the organization to improve and optimize the application code quality and performance, and to reduce or eliminate the need for rework. It can also help the organization to align the application code development and testing with the organization’s objectives and requirements, and to comply with the organization’s policies and standards.

The other options are not the risk practitioner’s best recommendations when the number of tickets to rework application code has significantly exceeded the established threshold, because they do not address the main purpose and benefit of performing a root cause analysis, which is to identify and understand the underlying or fundamental causes or factors that contribute to or result in the problem or incident.

Performing a code review is a process of examining and evaluating the application code for its quality, functionality, and security, using the input and feedback from the peers, experts, or tools. Performing a code review can help the organization to identify and resolve the errors or defects in the application code, but it is not the risk practitioner’s best recommendation, because it does not indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders.

Implementing version control software is a process of using a software tool to manage and track the changes and modifications to the application code, and to ensure the consistency and integrity of the application code. Implementing version control software can help the organization to control and monitor the application code development and testing, but it is not the risk practitioner’s best recommendation, because it does not indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders.

Implementing training on coding best practices is a process of providing and facilitating the learning and development of the skills and knowledge on the principles, guidelines, and standards for the application code development and testing. Implementing training on coding best practices can help the organization to enhance the competence and performance of the application code developers and testers, but it is not the risk practitioner’s best recommendation, because it does not indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 189 CRISC Practice Quiz and Exam Prep

Question #250

A MAJOR advantage of using key risk indicators (KRIs) is that they:

A . Identify scenarios that exceed defined risk appetite.
B . Help with internal control assessments concerning risk appetite.
C . Assess risk scenarios that exceed defined thresholds.
D . Identify when risk exceeds defined thresholds.

Reveal Solution Hide Solution