Free ISACA CRISC Practice Exams - Page 30 of 73

Question #291

A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls.

Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?

A . Identify previous data breaches using the startup company’s audit reports.
B . Have the data privacy officer review the startup company’s data protection policies.
C . Classify and protect the data according to the parent company’s internal standards.
D . Implement a firewall and isolate the environment from the parent company’s network.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Data protection is the process of safeguarding sensitive personal information from unauthorized access, use, disclosure, modification, or destruction. Data protection can help to ensure the privacy and security of the data subjects, and to comply with the legal and regulatory requirements that apply to the data processing activities1.

A highly regulated organization that acquired a medical technology startup company that processes sensitive personal information with weak data protection controls faces a high risk of data breaches, fines, lawsuits, reputational damage, or loss of customer trust. The best way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company is to

classify and protect the data according to the parent company’s internal standards, because it can help to:

Identify and categorize the sensitive personal information based on its value, sensitivity, and criticality, such as confidential, restricted, internal, or public

Apply and enforce the appropriate data protection policies, procedures, and controls for each data category, such as encryption, access control, backup, retention, or disposal

Align and integrate the data protection practices and processes of the startup company with those of the parent company, and ensure the consistency and compliance across the organization

Balance and optimize the trade-off between data protection and data usability, and allow the startup company to leverage the data for innovation and growth, as long as it meets the data protection standards of the parent company23

The other options are not the best ways for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company, but rather some of the steps or aspects of data protection. Identify previous data breaches using the startup company’s audit reports is a step that can help to assess the current data protection status and gaps of the startup company, and to learn from the past incidents and mistakes, but it does not address the future data protection needs and challenges of the startup company. Have the data privacy officer review the startup company’s data protection policies is an aspect that can help to ensure the legal and regulatory compliance of the data protection activities of the startup company, and to provide guidance and oversight for the data protection issues and risks, but it does not ensure the technical and operational effectiveness and efficiency of the data protection controls of the startup company. Implement a firewall and isolate the environment from the parent company’s network is a control that can help to prevent or limit the external or internal attacks or threats to the data of the startup company, and to reduce the exposure or impact of a data breach, but it does not ensure the availability or accessibility of the data for the legitimate and authorized purposes of the startup company.

Reference: =

Data Protection – ISACA

Data Classification – ISACA

Data Protection Best Practices – ISACA

[CRISC Review Manual, 7th Edition]

Question #292

Which of the following is the GREATEST risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider?

A . More complex test restores
B . Inadequate service level agreement (SLA) with the provider
C . More complex incident response procedures
D . Inadequate data encryption

Reveal Solution Hide Solution

Question #293

Which of the following controls will BEST detect unauthorized modification of data by a database administrator?

A . Reviewing database access rights
B . Reviewing database activity logs
C . Comparing data to input records
D . Reviewing changes to edit checks

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Unauthorized modification of data by a database administrator is a security risk that involves altering, deleting, or inserting data on a database without proper authorization or approval, by a person who has privileged access to the database, such as a database administrator12.

The best control to detect unauthorized modification of data by a database administrator is to review database activity logs, which are records that capture and store the details and history of the transactions or activities that are performed on the database, such as who, what, when, where, and how34.

Reviewing database activity logs is the best control because it provides evidence and visibility of the database operations, and enables the detection and reporting of any deviations, anomalies, or issues that may indicate unauthorized modification of data by a database administrator34.

Reviewing database activity logs is also the best control because it supports the accountability and auditability of the database operations, and facilitates the investigation and resolution of any unauthorized modification of data by a database administrator34.

The other options are not the best controls, but rather possible measures or techniques that may supplement or enhance the review of database activity logs.

For example:

Reviewing database access rights is a measure that involves verifying and validating the permissions and privileges that are granted or revoked to the users or roles who can access or modify the data on the database56. However, this measure is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the database administrator has legitimate access rights to the data56.

Comparing data to input records is a technique that involves matching and reconciling the data on the database with the original or source data that are entered or imported into the database, and identifying and correcting any discrepancies or errors78. However, this technique is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the input records are also modified or compromised78.

Reviewing changes to edit checks is a technique that involves examining and evaluating the modifications or updates to the edit checks, which are rules or validations that are applied to the data on the database to ensure their accuracy, completeness, and consistency9. However, this technique is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the edit checks are bypassed or disabled9.

Reference: =

1: Database Security: Attacks and Solutions | SpringerLink2

2: Unauthorised Modification of Data With Intent to Cause Impairment3

3: Database Activity Monitoring – Wikipedia4

4: Database Activity Monitoring (DAM) | Imperva5

5: Database Access Control – Wikipedia6

6: Database Access Control: Best Practices for Database Security7

7: Data Reconciliation – Wikipedia8

8: Data Reconciliation and Gross Error Detection9

9: Edit Check – Wikipedia

: Edit Checks: A Data Quality Tool

Question #294

Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?

A . Conduct a simulated phishing attack.
B . Update spam filters
C . Revise the acceptable use policy
D . Strengthen disciplinary procedures

Reveal Solution Hide Solution

Question #295

The analysis of which of the following will BEST help validate whether suspicious network activity is malicious?

A . Logs and system events
B . Intrusion detection system (IDS) rules
C . Vulnerability assessment reports
D . Penetration test reports

Reveal Solution Hide Solution

Question #296

Which of the following is the BEST metric to demonstrate the effectiveness of an organization’s patch management process?

A . Average time to implement patches after vendor release
B . Number of patches tested prior to deployment
C . Increase in the frequency of patches deployed into production
D . Percent of patches implemented within established timeframe

Reveal Solution Hide Solution

Question #297

Of the following, who is responsible for approval when a change in an application system is ready for release to production?

A . Information security officer
B . IT risk manager
C . Business owner
D . Chief risk officer (CRO)

Reveal Solution Hide Solution

Question #298

An IT risk practitioner has been asked to regularly report on the overall status and effectiveness of

the IT risk management program.

Which of the following is MOST useful for this purpose?

A . Balanced scorecard
B . Capability maturity level
C . Internal audit plan
D . Control self-assessment (CSA)

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A balanced scorecard is a strategic management tool that helps to measure and communicate the performance of an organization or a program against its goals and objectives. A balanced scorecard typically consists of four perspectives: financial, customer, internal process, and learning and growth. Each perspective has a set of key performance indicators (KPIs) that reflect the critical success factors and desired outcomes of the organization or the program1.

A balanced scorecard is most useful for reporting on the overall status and effectiveness of the IT risk management program, because it can provide a comprehensive and balanced view of the program’s performance across multiple dimensions. A balanced scorecard can help to align the IT risk management program with the business strategy and vision, and to demonstrate the value and impact of the program to the stakeholders. A balanced scorecard can also help to identify the strengths and weaknesses of the IT risk management program, and to monitor and improve the program’s processes and outcomes2.

The other options are not as useful as a balanced scorecard for reporting on the overall status and effectiveness of the IT risk management program. A capability maturity level is a measure of the maturity and quality of a process or a practice, based on a predefined set of criteria and standards. A capability maturity level can help to assess and benchmark the IT risk management program’s processes and practices, but it does not provide a holistic view of the program’s performance and results3. An internal audit plan is a document that outlines the scope, objectives, and methodology of an internal audit activity. An internal audit plan can help to evaluate and verify the IT risk management program’s controls and compliance, but it does not provide a strategic view of the program’s goals and outcomes4. A control self-assessment (CSA) is a technique that involves the participation of the process owners and the staff in assessing the effectiveness and efficiency of their own controls. A CSA can help to enhance the awareness and ownership of the IT risk management program’s controls, but it does not provide an objective and independent view of the program’s performance and impact.

Reference: =

Balanced Scorecard Basics – Balanced Scorecard Institute Using the Balanced Scorecard to Measure and Manage IT Risk Capability Maturity Model Integration (CMMI) Overview Internal Audit Planning: The Basics – The IIA

[Control Self-Assessment – ISACA]

Question #299

Which of the following is the MOST important reason to validate that risk responses have been executed as outlined in the risk response plan”

A . To ensure completion of the risk assessment cycle
B . To ensure controls arc operating effectively
C . To ensure residual risk Is at an acceptable level
D . To ensure control costs do not exceed benefits

Reveal Solution Hide Solution

Question #300

Which of the following activities is PRIMARILY the responsibility of senior management?

A . Bottom-up identification of emerging risks
B . Categorization of risk scenarios against a standard taxonomy
C . Prioritization of risk scenarios based on severity
D . Review of external loss data

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The primary responsibility of senior management in risk management is to prioritize the risk scenarios based on severity. Risk scenarios are hypothetical events or situations that could affect the achievement of the objectives. Risk severity is a measure of the overall level of risk, based on the combination of the probability and impact of the risk scenario. Prioritizing the risk scenarios based on severity is the primary responsibility of senior management, because it helps to allocate the resources and actions to the most critical and urgent risks, and to align the risk management process with the organizational strategy and risk appetite. Senior management also has the authority and accountability to make the final decisions and approve the risk response plans for the prioritized risks. The other options are not the primary responsibility of senior management, although they may be involved or consulted in these activities. Bottom-up identification of emerging risks is a process of identifying and reporting the new or changing risks that may arise from the operational or tactical level of the organization. This is usually the responsibility of the risk owners or the risk practitioners, who have the knowledge and experience of the specific functions and processes. Categorization of risk scenarios against a standard taxonomy is a process of classifying and organizing the risk scenarios into predefined categories or groups, based on their nature, source, or impact. This is usually the responsibility of the risk analysts or the risk coordinators, who have the skills and tools to perform the risk analysis and assessment. Review of external loss data is a process of collecting and analyzing the data and information on the losses or incidents that occurred in other organizations or industries, due to similar or related risks. This is usually the responsibility of the risk researchers or the risk consultants, who have the access and expertise to obtain and interpret the external data and information.

Reference: = The Role of Executive Management in ERM – Corporate Compliance Insights, Guidelines on Risk Management Practices C Board and Senior Management, Risk Manager Job Description [+2023 TEMPLATE] – Workable