Free ISACA CRISC Practice Exams - Page 36 of 73

Question #351

An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?

A . Database manager
B . Public relations manager
C . Data privacy manager
D . Business manager

Reveal Solution Hide Solution

Question #352

The MOST effective approach to prioritize risk scenarios is by:

A . assessing impact to the strategic plan.
B . aligning with industry best practices.
C . soliciting input from risk management experts.
D . evaluating the cost of risk response.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The most effective approach to prioritize risk scenarios is by assessing the impact to the strategic plan, because this will help to align the risk management process with the organization’s vision, mission, and goals. The strategic plan is the document that defines the organization’s direction, priorities, and objectives, and guides the allocation of resources and efforts. By assessing the impact to the strategic plan, the organization can determine which risk scenarios pose the greatest threat or opportunity to the achievement of the strategic objectives, and prioritize them accordingly. The other options are not as effective as assessing the impact to the strategic plan, because they do not directly relate to the organization’s specific context, needs, and expectations, as explained below:

B. Aligning with industry best practices is an approach that involves following the standards, norms, and expectations for risk management that are established and followed by the peers or competitors in the same industry or sector. Aligning with industry best practices can help to benchmark and compare the organization’s risk management performance and maturity, and identify areas for improvement or innovation. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not account for the organization’s unique and customized risk scenarios, which may differ from the industry average or standard.

C. Soliciting input from risk management experts is an approach that involves seeking advice, guidance, or feedback from the professionals or specialists who have the knowledge, experience, or skills in risk management. Soliciting input from risk management experts can help to enhance the quality and validity of the risk analysis and evaluation, and provide insights and recommendations for risk mitigation. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not reflect the organization’s risk appetite, preferences, and expectations, which may differ from the risk management experts’ opinions or perspectives.

D. Evaluating the cost of risk response is an approach that involves estimating the resources and efforts required to implement the risk response strategies, such as avoiding, reducing, transferring, or accepting the risk. Evaluating the cost of risk response can help to optimize the risk management efficiency and effectiveness, and balance the potential benefits and costs of taking risks. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not consider the potential consequences and outcomes of the risk scenarios, which may affect the organization’s performance and reputation.

Reference: = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 45. The Ultimate Guide to Risk Prioritization – Hyperproof, Risk Prioritization: What Is It? [2021 Guide & Matrix] – ERM Software, What is Risk Prioritization | Centraleyes, Scenario Planning in Risk Management: Why It is Needed – SmartCompliance

Question #353

What are the MOST important criteria to consider when developing a data classification scheme to facilitate risk assessment and the prioritization of risk mitigation activities?

A . Mitigation and control value
B . Volume and scope of data generated daily
C . Business criticality and sensitivity
D . Recovery point objective (RPO) and recovery time objective (RTO)

Reveal Solution Hide Solution

Question #354

WhichT5f the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?

A . Enforce sanctions for noncompliance with security procedures.
B . Conduct organization-w>de phishing simulations.
C . Require training on the data handling policy.
D . Require regular testing of the data breach response plan.

Reveal Solution Hide Solution

Question #355

An organization is considering allowing users to access company data from their personal devices.

Which of the following is the MOST important factor when assessing the risk?

A . Classification of the data
B . Type of device
C . Remote management capabilities
D . Volume of data

Reveal Solution Hide Solution

Question #356

Which of The following is the MOST comprehensive input to the risk assessment process specific to the effects of system downtime?

A . Business continuity plan (BCP) testing results
B . Recovery lime objective (RTO)
C . Business impact analysis (BIA)
D . results Recovery point objective (RPO)

Reveal Solution Hide Solution

Question #357

The MOST effective way to increase the likelihood that risk responses will be implemented is to:

A . create an action plan
B . assign ownership
C . review progress reports
D . perform regular audits.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Risk responses are the actions or strategies that are taken to address the risks that may affect the organization’s objectives, performance, or value creation12.

The most effective way to increase the likelihood that risk responses will be implemented is to assign ownership, which is the process of identifying and appointing the individuals or groups who are responsible and accountable for the execution and monitoring of the risk responses34.

Assigning ownership is the most effective way because it ensures the clarity and commitment of the roles and responsibilities for the risk responses, and avoids the confusion or ambiguity that may arise from the lack of ownership34.

Assigning ownership is also the most effective way because it enhances the communication and collaboration among the stakeholders involved in the risk responses, and provides the feedback and input that are necessary for the improvement and optimization of the risk responses34.

The other options are not the most effective way, but rather possible steps or tools that may support or complement the assignment of ownership.

For example:

Creating an action plan is a step that involves defining and documenting the specific tasks, resources, timelines, and deliverables for the risk responses34. However, this step is not the most effective way

because it does not guarantee the implementation of the risk responses, especially if there is no clear or agreed ownership for the action plan34.

Reviewing progress reports is a tool that involves collecting and analyzing the information and data on the status and performance of the risk responses, and identifying the issues or gaps that need to be addressed34. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses, especially if there is no ownership for the progress reports or the corrective actions34.

Performing regular audits is a tool that involves conducting an independent and objective assessment of the adequacy and effectiveness of the risk responses, and providing the findings and recommendations for improvement56. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses, especially if there is no ownership for the audit results or the follow-up actions56.

Reference: = 1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017

3: Risk Response Plan in Project Management: Key Strategies & Tips1

4: ProjectManagement.com – How to Implement Risk Responses2

5: IT Audit and Assurance Standards, ISACA, 2014

6: IT Audit and Assurance Guidelines, ISACA, 2014

Question #358

Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators (KRIs)?

A . To monitor changes in the risk environment
B . To provide input to management for the adjustment of risk appetite
C . To monitor the accuracy of threshold levels in metrics
D . To obtain business buy-in for investment in risk mitigation measures

Reveal Solution Hide Solution

Question #359

After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:

A . record risk scenarios in the risk register for analysis.
B . validate the risk scenarios for business applicability.
C . reduce the number of risk scenarios to a manageable set.
D . perform a risk analysis on the risk scenarios.

Reveal Solution Hide Solution

Question #360

What should be the PRIMARY objective for a risk practitioner performing a post-implementation review of an IT risk mitigation project?

A . Documenting project lessons learned
B . Validating the risk mitigation project has been completed
C . Confirming that the project budget was not exceeded
D . Verifying that the risk level has been lowered

Reveal Solution Hide Solution