Free ISACA CRISC Practice Exams - Page 35 of 73

Question #341

A risk practitioner wants to identify potential risk events that affect the continuity of a critical business process.

Which of the following should the risk practitioner do FIRST?

A . Evaluate current risk management alignment with relevant regulations.
B . Determine if business continuity procedures are reviewed and updated on a regular basis.
C . Review the methodology used to conduct the business impact analysis (BIA).
D . Conduct a benchmarking exercise against industry peers.

Reveal Solution Hide Solution

Question #342

Which of the following should be the GREATEST concern for an organization that uses open source software applications?

A . Lack of organizational policy regarding open source software
B . Lack of reliability associated with the use of open source software
C . Lack of monitoring over installation of open source software in the organization
D . Lack of professional support for open source software

Reveal Solution Hide Solution

Question #342

Which of the following should be the GREATEST concern for an organization that uses open source software applications?

A . Lack of organizational policy regarding open source software
B . Lack of reliability associated with the use of open source software
C . Lack of monitoring over installation of open source software in the organization
D . Lack of professional support for open source software

Reveal Solution Hide Solution

Question #344

Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization’s risk register?

A . Limit access to senior management only.
B . Encrypt the risk register.
C . Implement role-based access.
D . Require users to sign a confidentiality agreement.

Reveal Solution Hide Solution

Question #345

Which of the following will BEST help to ensure new IT policies address the enterprise’s requirements?

A . involve IT leadership in the policy development process
B . Require business users to sign acknowledgment of the poises
C . involve business owners in the pokey development process
D . Provide policy owners with greater enforcement authority

Reveal Solution Hide Solution

Question #346

The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of:

A . vulnerability scans.
B . recurring vulnerabilities.
C . vulnerabilities remediated,
D . new vulnerabilities identified.

Reveal Solution Hide Solution

Question #347

An organization is unable to implement a multi-factor authentication requirement until the next fiscal year due to budget constraints. Consequently, a policy exception must be submitted.

Which of the following is MOST important to include in the analysis of the exception?

A . Sections of the policy that may justify not implementing the requirement
B . Risk associated with the inability to implement the requirement
C . Budget justification to implement the new requirement during the current year
D . Industry best practices with respect to implementation of the proposed control

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The most important factor to include in the analysis of the policy exception is the risk associated with the inability to implement the multi-factor authentication requirement. A policy exception is a temporary or permanent deviation from the established policies or standards of the organization, due to various reasons, such as budget constraints, technical limitations, or business needs. A policy exception must be submitted and approved by the appropriate authority, and it must include a clear and comprehensive analysis of the rationale, impact, and mitigation of the exception. The risk associated with the inability to implement the multi-factor authentication requirement is the most important factor to include in the analysis, because it evaluates the probability and severity of potential threats or incidents that could exploit the lack of multi-factor authentication, such as unauthorized access, data breach, or identity theft. The risk analysis also helps to justify the need and urgency of the policy exception, and to propose alternative or compensating controls to reduce or transfer the risk, such as password policies, access restrictions, or encryption. The other options are not the most important factor, although they may be relevant or supportive to the policy exception analysis. Sections of the policy that may justify not implementing the requirement are the clauses or provisions in the policy that allow or enable the policy exception, such as exemptions, waivers, or variances. These sections can help to validate the legitimacy and feasibility of the policy exception, but they do not assess the risk or the impact of the exception. Budget justification to implement the new requirement during the current year is the explanation and evidence of the financial resources and constraints that affect the implementation of the multi-factor authentication requirement. This justification can help to demonstrate the cost-benefit and return on investment of the requirement, but it does not measure the risk or the mitigation of the exception. Industry best practices with respect to implementation of the proposed control are the proven methods and standards that are adopted by the leading organizations in a specific field or sector for implementing the multi-factor authentication requirement. These best practices can help to benchmark and improve the quality and effectiveness of the requirement, but they do not quantify the risk or the impact of the exception.

Reference: = Policy Exception Management – ISACA, Multi-Factor Authentication Policy – University of Arkansas, Common Conditional Access policy: Require MFA for all users

Question #348

The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

A . identify specific project risk.
B . obtain a holistic view of IT strategy risk.
C . understand risk associated with complex processes.
D . incorporate subject matter expertise.

Reveal Solution Hide Solution

Question #349

Which of the following is MOST important to understand when developing key risk indicators (KRIs)?

A . KRI thresholds
B . Integrity of the source data
C . Control environment
D . Stakeholder requirements

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Key risk indicators (KRIs) are metrics used by organizations to monitor and assess potential risks that may impact their objectives and performance. KRIs also provide early warning signals that help organizations identify, analyze, and address risks before they escalate into significant issues1. The most important factor to understand when developing KRIs is stakeholder requirements, which are the needs and expectations of the persons or entities that have an interest or influence in the organization’s risk management2. By understanding stakeholder requirements, the organization can ensure that the KRIs are aligned with the organization’s strategy, vision, and mission, and that they reflect the current and emerging risks and their potential consequences. Understanding stakeholder requirements can also help to establish and communicate the roles and responsibilities of the stakeholders, and to enforce the accountability and performance of the risk management. KRI thresholds, integrity of the source data, and control environment are not the most important factors to understand when developing KRIs, as they do not provide the same level of insight and relevance as stakeholder requirements. KRI thresholds are the values or ranges that indicate the level of risk exposure and the need for action or escalation3. KRI thresholds can help to measure and monitor the performance and compliance of the risk management, but they do not ensure that the KRIs are appropriate and accurate for the organization’s risk profile. Integrity of the source data is the quality and reliability of the data that are used to support or enable the development of KRIs4. Integrity of the source data can enhance the validity and consistency of the KRIs, but it does not ensure that the KRIs are comprehensive and compatible with the organization’s risk environment. Control environment is the set of policies, processes, and systems that provide the foundation and structure for the risk management5. Control environment can improve the security and efficiency of the risk management, but it does not ensure that the KRIs are relevant and realistic for the organization’s risk objectives and strategies.

Reference: = 1: Key Risk Indicators: A Practical Guide | SafetyCulture2: Stakeholder Requirements – an overview | ScienceDirect Topics3: Risk Threshold:

Definition, Meaning & Example – PM Study Circle4: Data Integrity – an overview | ScienceDirect Topics5: Control Environment – an overview | ScienceDirect Topics: [Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.1: Key Risk Indicators, pp. 181-185.]: [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.1: Control Design, pp. 233-235.]: [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.2: Control Implementation, pp. 243-245.]: [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.3: Control Monitoring and Maintenance, pp. 251-253.]

Question #350

Recent penetration testing of an organization’s software has identified many different types of security risks.

Which of the following is the MOST likely root cause for the identified risk?

A . SIEM software is producing faulty alerts.
B . Threat modeling was not utilized in the software design process.
C . The configuration management process is not applied consistently during development.
D . An identity and access management (IAM) tool has not been properly integrated into the software.

Reveal Solution Hide Solution