Free ISACA CRISC Practice Exams - Page 32 of 73

Question #311

Which of the following provides The MOST useful information when determining a risk management program’s maturity level?

A . Risk assessment results
B . A recently reviewed risk register
C . Key performance indicators (KPIs)
D . The organization’s risk framework

Reveal Solution Hide Solution

Question #312

When a risk practitioner is determining a system’s criticality. it is MOST helpful to review the associated:

A . process flow.
B . business impact analysis (BIA).
C . service level agreement (SLA).
D . system architecture.

Reveal Solution Hide Solution

Question #313

Following an acquisition, the acquiring company’s risk practitioner has been asked to update the organization’s IT risk profile.

What is the MOST important information to review from the acquired company to facilitate this task?

A . Internal and external audit reports
B . Risk disclosures in financial statements
C . Risk assessment and risk register
D . Business objectives and strategies

Reveal Solution Hide Solution

Question #314

Effective risk communication BEST benefits an organization by:

A . helping personnel make better-informed decisions
B . assisting the development of a risk register.
C . improving the effectiveness of IT controls.
D . increasing participation in the risk assessment process.

Reveal Solution Hide Solution

Question #315

Which of the following would MOST likely cause a risk practitioner to reassess risk scenarios?

A . A change in the risk management policy
B . A major security incident
C . A change in the regulatory environment
D . An increase in intrusion attempts

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The most likely cause for a risk practitioner to reassess risk scenarios is a change in the regulatory environment. A regulatory environment is the set of laws, rules, and standards that apply to an organization and its activities, such as data privacy, security, compliance, or governance. A change in the regulatory environment can occur due to various factors, such as new legislation, court rulings, enforcement actions, or industry trends. A change in the regulatory environment can affect the risk scenarios that the organization faces, as it may introduce new or modified risks, or alter the probability or impact of existing risks. For example, a new regulation may require the organization to implement additional or different controls, or to report or disclose more information, which may increase the cost, complexity, or vulnerability of the organization’s processes and systems. A change in the regulatory environment may also affect the risk appetite, tolerance, and capacity of the organization, as it may impose different requirements or expectations for the organization’s risk management performance and outcomes. Therefore, a risk practitioner should reassess the risk scenarios when there is a change in the regulatory environment, to ensure that the risk scenarios are accurate, complete, and relevant, and that the risk response strategies and plans are appropriate, effective, and compliant. The other options are not the most likely cause, although they may be related or influential to the risk scenarios. A change in the risk management policy is a change in the rules and guidelines that define how the organization manages its risks, such as the roles and responsibilities, the processes and procedures, the tools and techniques, or the reporting and communication. A change in the risk management policy can affect the risk scenarios, as it may change the way the organization identifies, analyzes, evaluates, and responds to the risks, but it does not directly create or modify the risks themselves. A major security incident is an event or situation that compromises the confidentiality, integrity, or availability of the organization’s information or systems, such as a data breach, a denial-of-service attack, or a ransomware infection. A major security incident can affect the risk scenarios, as it may indicate or reveal the existence or severity of the risks, or trigger or escalate the consequences of the risks, but it is not a cause, rather it is an effect of the risks. An increase in intrusion attempts is an increase in the frequency or intensity of the unauthorized or malicious attempts to access or exploit the organization’s information or systems, such as phishing, malware, or brute-force attacks. An increase in intrusion attempts can affect the risk scenarios, as it may increase the likelihood or impact of the risks, or expose or exacerbate the vulnerabilities of the organization’s processes and systems, but it is not a cause, rather it is a manifestation of the risks.

Reference: = Risk Scenarios Toolkit – ISACA, How to Write Strong Risk Scenarios and Statements – ISACA, The Impact of Regulatory Change on Business – Deloitte

Question #316

An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization’s customer service operations overseas.

Which of the following would MOST significantly impact management’s decision?

A . Time zone difference of the outsourcing location
B . Ongoing financial viability of the outsourcing company
C . Cross-border information transfer restrictions in the outsourcing country
D . Historical network latency between the organization and outsourcing location

Reveal Solution Hide Solution

Question #317

Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise’s brand on Internet sites?

A . Utilizing data loss prevention (DLP) technology
B . Monitoring the enterprise’s use of the Internet
C . Scanning the Internet to search for unauthorized usage
D . Developing training and awareness campaigns

Reveal Solution Hide Solution

Question #318

Which of the following is the MOST important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time?

A . Ongoing availability of data
B . Ability to aggregate data
C . Ability to predict trends
D . Availability of automated reporting systems

Reveal Solution Hide Solution

Question #319

Which of the following provides the MOST reliable evidence to support conclusions after completing an information systems controls assessment?

A . Risk and control self-assessment (CSA) reports
B . Information generated by the systems
C . Control environment narratives
D . Confirmation from industry peers

Reveal Solution Hide Solution

Question #320

When updating a risk register with the results of an IT risk assessment, the risk practitioner should log:

A . high impact scenarios.
B . high likelihood scenarios.
C . treated risk scenarios.
D . known risk scenarios.

Reveal Solution Hide Solution