Free ISACA CRISC Practice Exams - Page 29 of 73

Question #281

A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet.

What should be the risk practitioner’s FIRST course of action?

A . invoke the established incident response plan.
B . Inform internal audit.
C . Perform a root cause analysis
D . Conduct an immediate risk assessment

Reveal Solution Hide Solution

Question #282

The BEST key performance indicator (KPI) to measure the effectiveness of the security patching

process is the percentage of patches installed:

A . by the security administration team.
B . successfully within the expected time frame.
C . successfully during the first attempt.
D . without causing an unplanned system outage.

Reveal Solution Hide Solution

Question #283

To minimize risk in a software development project, when is the BEST time to conduct a risk analysis?

A . During the business requirement definitions phase
B . Before periodic steering committee meetings
C . At each stage of the development life cycle
D . During the business case development

Reveal Solution Hide Solution

Question #284

An organization is analyzing the risk of shadow IT usage.

Which of the following is the MOST important input into the assessment?

A . Business benefits of shadow IT
B . Application-related expresses
C . Classification of the data
D . Volume of data

Reveal Solution Hide Solution

Question #285

Who should be responsible (of evaluating the residual risk after a compensating control has been

A . Compliance manager
B . Risk owner
C . Control owner
D . Risk practitioner

Reveal Solution Hide Solution

Question #286

An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers.

Which of the following should be the MOST important consideration for a risk-based review of the user requirements?

A . Number of claims affected by the user requirements
B . Number of customers impacted
C . Impact to the accuracy of claim calculation
D . Level of resources required to implement the user requirements

Reveal Solution Hide Solution

Question #287

Of the following, who is accountable for ensuing the effectiveness of a control to mitigate risk?

A . Control owner
B . Risk manager
C . Control operator
D . Risk treatment owner

Reveal Solution Hide Solution

Question #288

Which of the following is the BEST reason to use qualitative measures to express residual risk levels related to emerging threats?

A . Qualitative measures require less ongoing monitoring.
B . Qualitative measures are better aligned to regulatory requirements.
C . Qualitative measures are better able to incorporate expert judgment.
D . Qualitative measures are easier to update.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Qualitative measures are methods of expressing risk levels using descriptive terms, such as high, medium, or low, based on subjective criteria, such as likelihood, impact, or severity. Qualitative measures are often used to identify and prioritize risks, and to communicate risk information to stakeholders1.

Residual risk is the level of risk that remains after the risk response has been implemented. Residual risk reflects the effectiveness and efficiency of the risk response, and the need for further action or monitoring2.

Emerging threats are new or evolving sources or causes of risk that have the potential to adversely affect the organization’s objectives, assets, or operations. Emerging threats are often characterized by uncertainty, complexity, and ambiguity, and may require innovative or adaptive risk responses3. The best reason to use qualitative measures to express residual risk levels related to emerging threats is that qualitative measures are better able to incorporate expert judgment. Expert judgment is the opinion or advice of a person or a group of people who have specialized knowledge, skills, or experience in a particular domain or field. Expert judgment can help to:

Provide insights and perspectives on the nature and characteristics of the emerging threats, and their possible causes and consequences

Assess the likelihood and impact of the emerging threats, and their interactions and dependencies with other risks

Evaluate the suitability and effectiveness of the risk responses, and their alignment with the organization’s risk appetite and tolerance

Identify and recommend the best practices and lessons learned for managing the emerging threats, and for improving the risk management process45

Qualitative measures are better able to incorporate expert judgment than quantitative measures, which are methods of expressing risk levels using numerical or measurable values, such as percentages, probabilities, or monetary amounts. Quantitative measures are often used to estimate and analyze risks, and to support risk decision making1. However, quantitative measures may not be suitable or feasible for expressing residual risk levels related to emerging threats, because: Quantitative measures require reliable and sufficient data and information, which may not be available or accessible for the emerging threats

Quantitative measures rely on mathematical models and techniques, which may not be able to capture or reflect the complexity and uncertainty of the emerging threats

Quantitative measures may create a false sense of precision or accuracy, which may not be justified or warranted for the emerging threats

Quantitative measures may be influenced or manipulated by biases or assumptions, which may not be valid or appropriate for the emerging threats67

Therefore, qualitative measures are better able to incorporate expert judgment, which can enhance the understanding and management of the residual risk levels related to emerging threats.

The other options are not the best reasons to use qualitative measures to express residual risk levels related to emerging threats, but rather some of the advantages or disadvantages of qualitative measures. Qualitative measures require less ongoing monitoring than quantitative measures, because they are simpler and easier to apply and update. However, this does not mean that qualitative measures can eliminate or reduce the need for monitoring, which is an essential part of the risk management process. Qualitative measures are better aligned to regulatory requirements than quantitative measures, because they are more consistent and comparable across different domains and contexts. However, this does not mean that qualitative measures can satisfy or comply with all the regulatory requirements, which may vary depending on the industry or sector. Qualitative measures are easier to update than quantitative measures, because they do not depend on complex calculations or formulas. However, this does not mean that qualitative measures can always reflect the current or accurate risk levels, which may change over time or due to external factors.

Reference: =

Qualitative Risk Analysis vs. Quantitative Risk Analysis – ISACA

Residual Risk – ISACA

Emerging Threats – ISACA

Expert Judgment – ISACA

Expert Judgment in Project Management: Narrowing the Theory-Practice Gap

Quantitative Risk Analysis – ISACA

Quantitative Risk Analysis: A Critical Review

[CRISC Review Manual, 7th Edition]

Question #289

Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?

A . Defining expectations in the enterprise risk policy
B . Increasing organizational resources to mitigate risks
C . Communicating external audit results
D . Avoiding risks that could materialize into substantial losses

Reveal Solution Hide Solution

Question #290

Which of the following provides the MOST helpful reference point when communicating the results of a risk assessment to stakeholders?

A . Risk tolerance
B . Risk appetite
C . Risk awareness
D . Risk policy

Reveal Solution Hide Solution