Free ISACA CRISC Practice Exams - Page 8 of 73

Question #71

Which of the following is MOST important when developing risk scenarios?

A . The scenarios are based on industry best practice.
B . The scenarios focus on current vulnerabilities.
C . The scenarios are relevant to the organization.
D . The scenarios include technical consequences.

Question #72

An organization has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data.

What should be The FIRST course of action?

A . Invoke the incident response plan.
B . Determine the business impact.
C . Conduct a forensic investigation.
D . Invoke the business continuity plan (BCP).

Reveal Solution Hide Solution

Question #73

Which of the following is the MOST important objective of establishing an enterprise risk management (ERM) function within an organization?

A . To have a unified approach to risk management across the organization
B . To have a standard risk management process for complying with regulations
C . To optimize risk management resources across the organization
D . To ensure risk profiles are presented in a consistent format within the organization

Reveal Solution Hide Solution

Question #74

A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two years ago.

Which of the following is the GREATEST concern with this request?

A . The risk assessment team may be overly confident of its ability to identify issues.
B . The risk practitioner may be unfamiliar with recent application and process changes.
C . The risk practitioner may still have access rights to the financial system.
D . Participation in the risk assessment may constitute a conflict of interest.

Reveal Solution Hide Solution

Question #75

Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

A . Accountability may not be clearly defined.
B . Risk ratings may be inconsistently applied.
C . Different risk taxonomies may be used.
D . Mitigation efforts may be duplicated.

Reveal Solution Hide Solution

Question #76

IT risk assessments can BEST be used by management:

A . for compliance with laws and regulations
B . as a basis for cost-benefit analysis.
C . as input for decision-making
D . to measure organizational success.

Reveal Solution Hide Solution

Question #77

Who should be PRIMARILY responsible for establishing an organization’s IT risk culture?

A . Business process owner
B . Executive management
C . Risk management
D . IT management

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Executive management should be primarily responsible for establishing an organization’s IT risk culture, as they have the authority and accountability to define and communicate the vision, mission, values, and objectives of the organization, and to set the tone and direction for the IT risk management and control processes. Executive management is the highest level of management in an organization, and it consists of the board of directors, the chief executive officer (CEO), and other senior executives. Executive management is responsible for the strategic planning and decision making of the organization, and for ensuring the alignment of the organizational strategy and objectives with the stakeholder expectations and requirements.

Executive management should be primarily responsible for establishing an organization’s IT risk

culture by providing the following benefits:

It demonstrates the leadership and commitment of the executive management to the IT risk management and control processes, and to the achievement of the organizational strategy and objectives.

It influences and motivates the behavior and attitude of the staff and managers towards IT risk management and control, and fosters a culture of risk awareness, ownership, and accountability across the organization.

It defines and communicates the IT risk appetite and tolerance of the organization, and guides and supports the development and implementation of the IT risk policies, standards, and procedures. It allocates and monitors the resources and performance of the IT risk management and control processes, and ensures the effectiveness and efficiency of the IT risk governance and oversight. The other options are not the primary choices for establishing an organization’s IT risk culture. Business process owner is the person who has the responsibility and authority over the design, execution, and performance of a specific business process, and they are accountable for the risks and controls associated with their process, but they do not have the overall or strategic responsibility for the IT risk culture. Risk management is the function or department that is responsible for managing and monitoring the IT risk management and control processes, and for providing advice and guidance to the executive management and the business units, but they do not have the ultimate or final responsibility for the IT risk culture. IT management is the function or department that is responsible for managing and maintaining the IT operations and security, and for supporting the IT risk management and control processes, but they do not have the highest or broadest responsibility for the IT risk culture.

Reference: = Risk Culture – Open Risk Manual, IT Risk Resources | ISACA, The 6 key elements to creating and maintaining a good risk culture

Question #78

Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization’s data disposal policy?

A . Compliance manager
B . Data architect
C . Data owner
D . Chief information officer (CIO)

Reveal Solution Hide Solution

Question #79

An organization’s IT team has proposed the adoption of cloud computing as a cost-saving measure for the business.

Which of the following should be of GREATEST concern to the risk practitioner?

A . Due diligence for the recommended cloud vendor has not been performed.
B . The business can introduce new Software as a Service (SaaS) solutions without IT approval.
C . The maintenance of IT infrastructure has been outsourced to an Infrastructure as a Service (laaS) provider.
D . Architecture responsibilities may not be clearly defined.

Reveal Solution Hide Solution

Question #80

Which of the following is the BEST approach for selecting controls to minimize risk?

A . Industry best practice review
B . Risk assessment
C . Cost-benefit analysis
D . Control-effectiveness evaluation

Reveal Solution Hide Solution