Free ISACA CRISC Practice Exams - Page 3 of 73

Question #21

A recent regulatory requirement has the potential to affect an organization’s use of a third party to supply outsourced business services.

Which of the following is the BEST course of action?

A . Conduct a gap analysis.
B . Terminate the outsourcing agreement.
C . Identify compensating controls.
D . Transfer risk to the third party.

Reveal Solution Hide Solution

Question #22

Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?

A . Configuration updates do not follow formal change control.
B . Operational staff perform control self-assessments.
C . Controls are selected without a formal cost-benefit
D . analysis-Management reviews security policies once every two years.

Reveal Solution Hide Solution

Question #23

Which of the following is MOST helpful in providing an overview of an organization’s risk management program?

A . Risk management treatment plan
B . Risk assessment results
C . Risk management framework
D . Risk register

Reveal Solution Hide Solution

Question #24

The BEST way to determine the likelihood of a system availability risk scenario is by assessing the:

A . availability of fault tolerant software.
B . strategic plan for business growth.
C . vulnerability scan results of critical systems.
D . redundancy of technical infrastructure.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

A system availability risk scenario is a situation where a system or a service is not accessible or functional due to a failure or an attack. The likelihood of such a scenario depends on the vulnerabilities or weaknesses that exist in the system or the service, and the threats or attackers that could exploit them. Therefore, by scanning the critical systems or services for vulnerabilities and analyzing the results, one can estimate the probability or frequency of a system availability risk scenario1.

A vulnerability scan is a process of identifying and evaluating the potential security risks in a system or a service. A vulnerability scan report provides a list of vulnerabilities that have been detected, categorized by their severity levels, and accompanied by remediation recommendations. By reviewing the report, one can understand the current security posture of the system or the service, and the actions that need to be taken to address the vulnerabilities2.

The other options are not the best ways to determine the likelihood of a system availability risk scenario, but rather some of the factors or outcomes of it. Availability of fault tolerant software is a factor that can reduce the likelihood of a system availability risk scenario, as it means that the software can continue to operate without interruption even if some of its components fail. Fault tolerant software can achieve this by using backup or redundant components, or by implementing error detection and correction mechanisms3. Strategic plan for business growth is an outcome of a system availability risk scenario, as it can affect the organization’s objectives and strategies. A system availability risk scenario can have negative impacts on the organization’s performance, reputation, customer satisfaction, and competitive advantage, and thus hamper its growth potential4. Redundancy of technical infrastructure is a factor that can reduce the likelihood of a system availability risk scenario, as it means that the infrastructure has duplicate or alternative devices or paths that can take over in case of a failure or an attack. Redundancy of technical infrastructure can ensure network availability and prevent data loss5.

Reference: = Describe the risk scenarios | NZ Digital government

How to Read a Vulnerability Scan Report | Evolve Security

Learn about Fault Tolerant Servers | What is Fault Tolerance?-Stratus The Importance of Redundancies in Your Infrastructure – INAP What is Redundancy? – Your IT Department

[CRISC Review Manual, 7th Edition]

Question #25

Which of the following is MOST important to promoting a risk-aware culture?

A . Regular testing of risk controls
B . Communication of audit findings
C . Procedures for security monitoring
D . Open communication of risk reporting

Reveal Solution Hide Solution

Question #25

Which of the following is MOST important to promoting a risk-aware culture?

A . Regular testing of risk controls
B . Communication of audit findings
C . Procedures for security monitoring
D . Open communication of risk reporting

Reveal Solution Hide Solution

Question #27

An IT organization is replacing the customer relationship management (CRM) system.

Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?

A . Chief information security officer
B . Business process owner
C . Chief risk officer
D . IT controls manager

Reveal Solution Hide Solution

Question #28

The PRIMARY advantage of involving end users in continuity planning is that they:

A . have a better understanding of specific business needs
B . can balance the overall technical and business concerns
C . can see the overall impact to the business
D . are more objective than information security management.

Reveal Solution Hide Solution

Question #29

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective.

Which of the following should be the risk practitioner’s FIRST course of action?

A . Recommend risk remediation of the ineffective controls.
B . Compare the residual risk to the current risk appetite.
C . Determine the root cause of the control failures.
D . Escalate the control failures to senior management.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The control evaluation phase of a risk assessment is the phase where the risk practitioner evaluates the effectiveness and efficiency of the existing or planned controls that mitigate the identified risks. Controls are the actions or measures that reduce the likelihood or impact of the risks to an acceptable level. The control evaluation phase involves testing, reviewing, and auditing the controls, and identifying any gaps or weaknesses that need to be addressed. If the control evaluation phase reveals that multiple controls are ineffective, the risk practitioner’s first course of action should be to determine the root cause of the control failures. The root cause is the underlying or fundamental reason that leads to the problem or issue, such as the control failure. By determining the root cause of the control failures, the risk practitioner can understand why the controls are not working as intended, and what factors or variables are influencing the control performance. This will help the risk practitioner to identify and implement the most appropriate and effective risk response strategy and actions, such as recommending risk remediation, comparing the residual risk, or escalating the control failures. The other options are not the first course of action, as they involve different steps or outcomes of the risk management process:

Recommend risk remediation of the ineffective controls means that the risk practitioner suggests the actions or measures that can improve or restore the effectiveness of the controls, such as by modifying, replacing, or adding the controls. This may be a useful step in the risk management process, but it is not the first course of action, as it may not address the root cause of the control failures, or may not be feasible or efficient for the enterprise’s needs.

Compare the residual risk to the current risk appetite means that the risk practitioner evaluates the level of risk that remains after considering the existing or planned controls, and compares it with the amount and type of risk that the enterprise is willing to accept in pursuit of its objectives. This may be a helpful step in the risk management process, but it is not the first course of action, as it may not reflect the true or current level of risk exposure, or may not account for the uncertainties or complexities of the risks or the controls.

Escalate the control failures to senior management means that the risk practitioner communicates the control failures to the senior leaders of the enterprise, who oversee the enterprise-wide risk management program, and provide guidance and direction to the risk owners and practitioners. This may be a necessary step in the risk management process, but it is not the first course of action, as it may not provide sufficient or timely information or action to address the control failures, or may not reflect the urgency or priority of the control failures.

Reference: = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.3.1, pp. 62-63.

Question #30

The PRIMARY benefit associated with key risk indicators (KRls) is that they:

A . help an organization identify emerging threats.
B . benchmark the organization’s risk profile.
C . identify trends in the organization’s vulnerabilities.
D . enable ongoing monitoring of emerging risk.

Reveal Solution Hide Solution