Free ISACA CRISC Practice Exams - Page 7 of 73

Question #61

Who should be accountable for authorizing information system access to internal users?

A . Information security officer
B . Information security manager
C . Information custodian
D . Information owner

Question #62

An external security audit has reported multiple findings related to control noncompliance.

Which of the following would be MOST important for the risk practitioner to communicate to senior management?

A . A recommendation for internal audit validation
B . Plans for mitigating the associated risk
C . Suggestions for improving risk awareness training
D . The impact to the organization’s risk profile

Reveal Solution Hide Solution

Question #63

Which of the following should be management’s PRIMARY focus when key risk indicators (KRIs) begin to rapidly approach defined thresholds?

A . Designing compensating controls
B . Determining if KRIs have been updated recently
C . Assessing the effectiveness of the incident response plan
D . Determining what has changed in the environment

Reveal Solution Hide Solution

Question #64

Which of the following would be- MOST helpful to understand the impact of a new technology system on an organization’s current risk profile?

A . Hire consultants specializing m the new technology.
B . Review existing risk mitigation controls.
C . Conduct a gap analysis.
D . Perform a risk assessment.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

A risk assessment is a process of measuring and comparing the likelihood and impact of various risk scenarios, and prioritizing them based on their significance and urgency. A risk assessment can help the organization to understand and document the risks that may affect its objectives and operations, and to support the decision making and planning for the risk management.

Performing a risk assessment would be the most helpful to understand the impact of a new technology system on an organization’s current risk profile, because it can help the organization to address the following questions:

What are the potential benefits and challenges of implementing the new technology system, and how do they align with the organization’s objectives and needs?

What are the existing or emerging risks that may affect the new technology system, and how do they relate to the organization’s current risk profile?

How likely and severe are the risks that may affect the new technology system, and what are the possible consequences or impacts for the organization and its stakeholders?

How can the risks that may affect the new technology system be mitigated or prevented, and what are the available or feasible options or solutions?

Performing a risk assessment can help the organization to understand the impact of the new technology system on its current risk profile by providing the following benefits:

It can enable the comparison and evaluation of the current and desired state and performance of the organization’s risk management function, and to identify and quantify the gaps or opportunities for improvement.

It can provide useful references and benchmarks for the alignment and integration of the new technology system with the organization’s risk management function, and for the compliance with the organization’s risk policies and standards.

It can support the implementation and monitoring of the new technology system, and for the allocation and optimization of the resources, time, and budget for the new technology system.

The other options are not the most helpful to understand the impact of a new technology system on an organization’s current risk profile, because they do not provide the same level of detail and insight that performing a risk assessment provides, and they may not be specific or applicable to the organization’s objectives and needs.

Hiring consultants specializing in the new technology means engaging or contracting external experts or professionals that have the skills and knowledge on the new technology system, and that can provide advice or guidance on the implementation and management of the new technology system. Hiring consultants specializing in the new technology can help the organization to enhance its competence and performance on the new technology system, but it is not the most helpful, because it does not measure and compare the likelihood and impact of the risks that may affect the new technology system, and it may not be relevant or appropriate for the organization’s current risk profile.

Reviewing existing risk mitigation controls means examining and evaluating the adequacy and effectiveness of the controls or countermeasures that are intended to reduce or eliminate the risks that may affect the organization’s objectives and operations. Reviewing existing risk mitigation controls can help the organization to improve and optimize its risk management function, but it is not the most helpful, because it does not identify and prioritize the risks that may affect the new technology system, and it may not cover all the relevant or significant risks that may affect the new technology system.

Conducting a gap analysis means comparing and contrasting the current and desired state and performance of the organization’s objectives and operations, and identifying and quantifying the gaps or differences that need to be addressed or corrected. Conducting a gap analysis can help the organization to identify and document its improvement needs and opportunities, but it is not the most helpful, because it does not measure and compare the likelihood and impact of the risks that may affect the new technology system, and it may not be aligned or integrated with the organization’s current risk profile.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 208 CRISC Practice Quiz and Exam Prep

Question #65

Which of the following would MOST likely cause a risk practitioner to change the likelihood rating in the risk register?

A . Risk appetite
B . Control cost
C . Control effectiveness
D . Risk tolerance

Reveal Solution Hide Solution

Question #66

An organization has outsourced its backup and recovery procedures to a third-party cloud provider.

Which of the following should be the risk practitioner’s NEXT course of action?

A . Remove the associated risk from the register.
B . Validate control effectiveness and update the risk register.
C . Review the contract and service level agreements (SLAs).
D . Obtain an assurance report from the third-party provider.

Reveal Solution Hide Solution

Question #67

Which of the following is a PRIMARY benefit of engaging the risk owner during the risk assessment process?

A . Identification of controls gaps that may lead to noncompliance
B . Prioritization of risk action plans across departments
C . Early detection of emerging threats
D . Accurate measurement of loss impact

Reveal Solution Hide Solution

Question #68

Which of the following is the GREATEST benefit of identifying appropriate risk owners?

A . Accountability is established for risk treatment decisions
B . Stakeholders are consulted about risk treatment options
C . Risk owners are informed of risk treatment options
D . Responsibility is established for risk treatment decisions.

Reveal Solution Hide Solution

Question #69

Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an organization?

A . Better understanding of the risk appetite
B . Improving audit results
C . Enabling risk-based decision making
D . Increasing process control efficiencies

Reveal Solution Hide Solution

Question #70

A root because analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators.

Who should be accountable for resolving the situation?

A . HR training director
B . Business process owner
C . HR recruitment manager
D . Chief information officer (CIO)

Reveal Solution Hide Solution