Free ISACA CRISC Practice Exams - Page 27 of 73

Question #261

Who is MOST appropriate to be assigned ownership of a control

A . The individual responsible for control operation
B . The individual informed of the control effectiveness
C . The individual responsible for resting the control
D . The individual accountable for monitoring control effectiveness

Reveal Solution Hide Solution

Question #262

Which of the following provides the MOST useful information for developing key risk indicators (KRIs)?

A . Business impact analysis (BIA) results
B . Risk scenario ownership
C . Risk thresholds
D . Possible causes of materialized risk

Reveal Solution Hide Solution

Question #263

An organization requires a third party for processing customer personal data.

Which of the following is the BEST approach when sharing data over a public network?

A . Include a nondisclosure agreement (NDA) for personal data in the contract.
B . Implement a digital rights protection tool to monitor data.
C . Use a virtual private network (VPN) to communicate data.
D . Transfer a read-only version of the data.

Reveal Solution Hide Solution

Question #264

A zero-day vulnerability has been discovered in a globally used brand of hardware server that allows hackers to gain access to affected IT systems.

Which of the following is MOST likely to change as a result of this situation?

A . Control effectiveness
B . Risk appetite
C . Risk likelihood
D . Key risk indicator (KRI)

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The most likely factor to change as a result of a zero-day vulnerability being discovered in a globally used brand of hardware server that allows hackers to gain access to affected IT systems is the risk likelihood. Risk likelihood is the probability or frequency of a risk event occurring, or the possibility of a risk event occurring within a given time period. Risk likelihood is one of the key dimensions of risk analysis, along with the risk impact. Risk likelihood helps to determine the severity and priority of the risk, and to select the most appropriate and effective risk response. Risk likelihood also helps to evaluate the cost-benefit and trade-off of the risk response, and to measure the residual risk and the risk performance. The risk likelihood is likely to change as a result of a zero-day vulnerability, because a zero-day vulnerability is a security flaw that has been discovered but not yet patched by the vendor, which means that it can be exploited by hackers before the affected systems can be updated or protected. A zero-day vulnerability increases the risk likelihood, because it creates a window of opportunity for hackers to launch attacks that could compromise the affected systems, and because it may not be detected or prevented by the existing security controls or measures. The other options are not as likely to change as the risk likelihood, although they may also be affected or influenced by the zero-day vulnerability. Control effectiveness, risk appetite, and key risk indicator (KRI) are all factors that could change as a result of a zero-day vulnerability, but they are not the most likely factor to change. Control effectiveness is the extent to which the risk controls or responses achieve the intended risk objectives or outcomes. Control effectiveness could change as a result of a zero-day vulnerability, because the existing controls may not be able to detect or prevent the exploitation of the vulnerability, or because new or additional controls may be needed to address the vulnerability. However, control effectiveness is not the most likely factor to change, because it depends on the type and level of the controls that are already in place or that can be implemented, and because it may not change until the vulnerability is actually exploited or the risk response is executed. Risk appetite is the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives. Risk appetite could change as a result of a zero-day vulnerability, because the vulnerability could affect the organization’s objectives or operations, and because the organization may need to adjust its risk tolerance or threshold to cope with the vulnerability. However, risk appetite is not the most likely factor to change, because it is a strategic and long-term decision that is driven by the organization’s mission, vision, values, and strategy, and because it may not change until the vulnerability is resolved or the risk impact is realized. Key risk indicator (KRI) is a metric that measures the likelihood and impact of risks, and helps monitor and prioritize the most critical risks. KRI could change as a result of a zero-day vulnerability, because the vulnerability could increase the likelihood and impact of the risks, and because the organization may need to update or revise its KRI to reflect the current risk situation. However, KRI is not the most likely factor to change, because it is a monitoring and reporting tool that is derived from the risk analysis and response, and because it may not change until the vulnerability is exploited or the risk response is implemented.

Reference: = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-25.

Question #265

Which of the following should be the PRIMARY input when designing IT controls?

A . Benchmark of industry standards
B . Internal and external risk reports
C . Recommendations from IT risk experts
D . Outcome of control self-assessments

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The primary input when designing IT controls should be internal and external risk reports. IT controls are specific activities performed by persons or systems to ensure that business objectives are met, and that the confidentiality, integrity, and availability of data and the overall management of the IT function are ensured1. Designing IT controls means creating and implementing the appropriate measures or actions to reduce the likelihood or impact of the IT risks that may affect the organization2. Internal and external risk reports are documents that provide information and analysis on the current and potential IT risks that the organization faces, as well as their sources, drivers, consequences, and responses3. Internal risk reports are generated by the organization itself, such as by the IT risk management function, the internal audit function, or the business units. External risk reports are obtained from external sources, such as regulators, industry associations, or third-party service providers. Internal and external risk reports are the primary input when designing IT controls, because they help to:

Identify and prioritize the IT risks that need to be addressed by the IT controls;

Evaluate the likelihood and impact of the IT risks, and compare them against the organization’s risk appetite and tolerance;

Determine the most suitable and effective IT control objectives and activities to mitigate the IT risks; Align the IT control design and implementation with the organization’s objectives, strategies, and values;

Monitor and measure the performance and effectiveness of the IT controls in reducing the IT risks. The other options are not the primary input when designing IT controls, as they are either less relevant or less specific than internal and external risk reports. Benchmark of industry standards is a comparison of the organization’s IT control practices and performance with those of other organizations in the same industry or sector4. Benchmark of industry standards can help to improve the quality and consistency of the IT control design and implementation, as well as to identify the best practices and gaps. However, benchmark of industry standards is not the primary input when designing IT controls, as it does not address the specific IT risks that the organization faces, or the IT control objectives and activities that are appropriate and effective for the organization. Recommendations from IT risk experts are the suggestions or advice from the professionals or specialists who have the knowledge and experience in IT risk management and IT control design and implementation5. Recommendations from IT risk experts can help to enhance the IT control design and implementation, as well as to provide guidance and support to the organization. However, recommendations from IT risk experts are not the primary input when designing IT controls, as they are based on the opinions and perceptions of the experts, and may not

reflect the actual or objective level and nature of the IT risks, or the IT control objectives and activities that are suitable and efficient for the organization. Outcome of control self-assessments is the result or conclusion of the evaluation and testing of the design and operation of the existing IT controls by the organization itself, such as by the IT control owners, the IT risk management function, or the business units6. Outcome of control self-assessments can help to improve the IT control design and implementation, as well as to detect and correct any issues or deficiencies. However, outcome of control self-assessments is not the primary input when designing IT controls, as it does not cover the new or emerging IT risks that the organization may face, or the IT control objectives and activities that are relevant and necessary for the organization.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1, Page 189.

Question #266

Which of the following is the BEST way to determine the value of information assets for risk management purposes?

A . Assess the loss impact if the information is inadvertently disclosed.
B . Calculate the overhead required to keep the information secure throughout its life cycle.
C . Calculate the replacement cost of obtaining the information from alternate sources.
D . Assess the market value offered by consumers of the information.

Reveal Solution Hide Solution

Question #267

Which of the following should be the PRIMARY consideration when implementing controls for monitoring user activity logs?

A . Ensuring availability of resources for log analysis
B . Implementing log analysis tools to automate controls
C . Ensuring the control is proportional to the risk
D . Building correlations between logs collected from different sources

Reveal Solution Hide Solution

Question #268

Which of the following resources is MOST helpful to a risk practitioner when updating the likelihood rating in the risk register?

A . Risk control assessment
B . Audit reports with risk ratings
C . Penetration test results
D . Business impact analysis (BIA)

Reveal Solution Hide Solution

Question #269

An organization is considering modifying its system to enable acceptance of credit card payments.

To reduce the risk of data exposure, which of the following should the organization do FIRST?

A . Conduct a risk assessment.
B . Update the security strategy.
C . Implement additional controls.
D . Update the risk register.

Reveal Solution Hide Solution

Question #270

Which of the following BEST supports ethical IT risk management practices?

A . Robust organizational communication channels
B . Mapping of key risk indicators (KRIs) to corporate strategy
C . Capability maturity models integrated with risk management frameworks
D . Rigorously enforced operational service level agreements (SLAs)

Reveal Solution Hide Solution