Free ISACA CRISC Practice Exams - Page 28 of 73

Question #271

Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?

A . The outsourcing of related IT processes
B . Outcomes of periodic risk assessments
C . Changes in service level objectives
D . Findings from continuous monitoring

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Key performance indicators (KPIs) are metrics used to measure and evaluate the achievement of the organization’s objectives and strategies1. KPIs for critical IT assets are KPIs that focus on the performance and value of the IT assets that are essential for the organization’s operations and functions2. KPIs for critical IT assets may include metrics such as availability, reliability, utilization, cost, and security of the IT assets3. The need to review and update KPIs for critical IT assets may be driven by various factors, such as changes in the business environment, customer expectations, or regulatory requirements. However, the most likely factor that would drive the need to review and update KPIs for critical IT assets is the outcomes of periodic risk assessments. A risk assessment is a process that involves identifying, analyzing, and evaluating the risks and their potential impacts on the organization’s objectives and performance4. A periodic risk assessment is a risk assessment that is performed at regular intervals, such as monthly, quarterly, or annually, to capture the changes and updates in the risk environment and the risk profile5. The outcomes of periodic risk assessments would most likely drive the need to review and update KPIs for critical IT assets, as they would provide insights into the current and emerging risks that may affect the performance and value of the critical IT assets, as well as the effectiveness and efficiency of the existing and planned controls and responses. By reviewing and updating the KPIs for critical IT assets based on the outcomes of periodic risk assessments, the organization can ensure that the KPIs are relevant, realistic, and aligned with the organization’s risk appetite and tolerance, and that they provide accurate and timely information for decision making and reporting. The outsourcing of related IT processes, changes in service level objectives, and findings from continuous monitoring are not the most likely factors that would drive the need to review and update KPIs for critical IT assets, as they do not provide the same level of information and impact as the outcomes of periodic risk assessments. The outsourcing of related IT processes is a decision that involves transferring some or all of the IT processes that support or enable the critical IT assets to an external service provider. The outsourcing of related IT processes may affect the performance and value of the critical IT assets, but it does not necessarily require a review and update of the KPIs for critical IT assets, as the KPIs may still be valid and applicable for the outsourced IT processes. Changes in service level objectives are changes in the expected or agreed level of quality or performance of the IT services that support or enable the critical IT assets. Changes in service level objectives may affect the performance and value of the critical IT assets, but they do not necessarily require a review and update of the KPIs for critical IT assets, as the KPIs may still be consistent and compatible with the changed service level objectives. Findings from continuous monitoring are the results or outcomes of the ongoing observation and measurement of the performance and compliance of the IT processes and systems that support or enable the critical IT assets. Findings from continuous monitoring may affect the performance and value of the critical IT assets, but they do not necessarily require a review and update of the KPIs for critical IT assets, as the KPIs may still be relevant and reliable for the continuously monitored IT processes and systems.

Reference: = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.

Question #272

Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?

A . Percentage of projects with key risk accepted by the project steering committee
B . Reduction in risk policy noncompliance findings
C . Percentage of projects with developed controls on scope creep
D . Reduction in audits involving external risk consultants

Reveal Solution Hide Solution

Question #273

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

A . Providing assurance of control effectiveness
B . Implementing internal controls
C . Monitoring risk responses
D . Applying risk treatments

Reveal Solution Hide Solution

Question #274

An organization is making significant changes to an application. At what point should the application risk profile be updated?

A . After user acceptance testing (UAT)
B . Upon release to production
C . During backlog scheduling
D . When reviewing functional requirements

Reveal Solution Hide Solution

Question #275

Senior management has asked a risk practitioner to develop technical risk scenarios related to a recently developed enterprise resource planning (ERP) system. These scenarios will be owned by the system manager.

Which of the following would be the BEST method to use when developing the scenarios?

A . Cause-and-effect diagram
B . Delphi technique
C . Bottom-up approach
D . Top-down approach

Reveal Solution Hide Solution

Question #276

Which of the following is MOST important to review when an organization needs to transition the majority of its employees to remote work during a crisis?

A . Customer notification plans
B . Capacity management
C . Access management
D . Impacts on IT project delivery

Reveal Solution Hide Solution

Question #277

Which of the following would BEST help identify the owner for each risk scenario in a risk register?

A . Determining which departments contribute most to risk
B . Allocating responsibility for risk factors equally to asset owners
C . Mapping identified risk factors to specific business processes
D . Determining resource dependency of assets

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

A risk register is a tool that records and tracks the identified risks, their causes, impacts, likelihood, responses, and owners. The owner for each risk scenario is the person or group who has the authority and accountability to manage the risk and its response. The best way to identify the owner for each risk scenario in a risk register is to map the identified risk factors to specific business processes. Risk factors are the internal and external variables that influence the occurrence and impact of risks. Business processes are the activities that produce value for the enterprise, such as sales, marketing, production, or delivery. By mapping the risk factors to the business processes, the risk practitioner can determine which business process is affected by or contributes to the risk, and who is responsible for the business process. The owner for each risk scenario should be the person or group who is responsible for the business process that is associated with the risk. The other options are not the best way to identify the owner for each risk scenario, as they involve different criteria or methods:

Determining which departments contribute most to risk means that the risk practitioner evaluates the degree of involvement or exposure of each department to the risk. This may not be a reliable or consistent way to identify the owner for each risk scenario, as the risk may span across multiple departments, or the department may not have the authority or accountability to manage the risk. Allocating responsibility for risk factors equally to asset owners means that the risk practitioner assigns the same level of responsibility to each person or group who owns an asset that is affected by or contributes to the risk. An asset is a resource that has value for the enterprise, such as hardware, software, data, or people. This may not be a fair or effective way to identify the owner for each risk scenario, as the asset owners may have different levels of involvement or exposure to the risk, or may not have the authority or accountability to manage the risk.

Determining resource dependency of assets means that the risk practitioner analyzes the relationship and interdependence of the assets that are affected by or contribute to the risk. This may help to identify the potential impact or likelihood of the risk, but it does not directly help to identify the owner for each risk scenario, as the resource dependency may not reflect the authority or accountability to manage the risk.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1.1, pp. 95-96.

Question #278

Legal and regulatory risk associated with business conducted over the Internet is driven by:

A . the jurisdiction in which an organization has its principal headquarters
B . international law and a uniform set of regulations.
C . the laws and regulations of each individual country
D . international standard-setting bodies.

Reveal Solution Hide Solution

Question #279

After the implementation of internal of Things (IoT) devices, new risk scenarios were identified.

What is the PRIMARY reason to report this information to risk owners?

A . To reevaluate continued use to IoT devices
B . The add new controls to mitigate the risk
C . The recommend changes to the IoT policy
D . To confirm the impact to the risk profile

Reveal Solution Hide Solution

Question #280

Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?

A . A management-approved risk dashboard
B . A current control framework
C . A regularly updated risk register
D . Regularly updated risk management procedures

Reveal Solution Hide Solution