Free ISACA CRISC Practice Exams - Page 9 of 73

Question #81

A deficient control has been identified which could result in great harm to an organization should a low frequency threat event occur.

When communicating the associated risk to senior management the risk practitioner should explain:

A . mitigation plans for threat events should be prepared in the current planning period.
B . this risk scenario is equivalent to more frequent but lower impact risk scenarios.
C . the current level of risk is within tolerance.
D . an increase in threat events could cause a loss sooner than anticipated.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The risk practitioner should explain to senior management that mitigation plans for threat events should be prepared in the current planning period, as this would demonstrate a proactive and responsible approach to risk management. Mitigation plans are documents that outline the actions and resources needed to reduce the likelihood and/or impact of a specific risk scenario.

Mitigation plans should include the following elements:

Risk scenario description and risk ID

Risk owner and other stakeholders

Risk response strategy and objectives

Risk response actions and tasks

Resources, costs, and benefits

Roles and responsibilities

Timeline and milestones

Performance indicators and monitoring mechanisms

Contingency plans and triggers

Mitigation plans help to address the gap between the current and desired risk levels and align the risk response with the organizational risk appetite and objectives. Mitigation plans also facilitate the communication, coordination, and collaboration among the risk owners and other stakeholders involved in the risk response process. Mitigation plans should be prepared in the current planning period, as this would allow the organization to act timely and effectively in the event of a low frequency threat event. Preparing mitigation plans in advance would also help to avoid or minimize the potential harm to the organization and its reputation.

The other options are not the best ways to communicate the associated risk to senior management. Explaining that this risk scenario is equivalent to more frequent but lower impact risk scenarios may not accurately reflect the true nature and severity of the risk. Explaining that the current level of risk is within tolerance may not convey the urgency and importance of addressing the risk. Explaining that an increase in threat events could cause a loss sooner than anticipated may not provide a clear and actionable solution for the risk.

Reference: = Four steps for managing risk at the CEO level, IT Risk Resources | ISACA, How to Communicate Risk to Stakeholders | Anitian

Question #82

Which of the following is the BEST way to determine the ongoing efficiency of control processes?

A . Perform annual risk assessments.
B . Interview process owners.
C . Review the risk register.
D . Analyze key performance indicators (KPIs).

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Control processes are the procedures and activities that aim to ensure the effectiveness and efficiency of the organization’s operations, the reliability of its information, and the compliance with its policies and regulations12.

The ongoing efficiency of control processes is the degree to which the control processes achieve their intended results with minimum resources, costs, or waste34.

The best way to determine the ongoing efficiency of control processes is to analyze key performance indicators (KPIs), which are quantifiable measures of progress toward an intended result, such as a strategic objective or a desired outcome56.

Analyzing KPIs is the best way because it provides a systematic and consistent method of evaluating the performance of the control processes, and identifying the areas of improvement or optimization56.

Analyzing KPIs is also the best way because it enables the organization to monitor and report the efficiency of the control processes to the relevant stakeholders, and to take corrective or preventive actions when necessary56.

The other options are not the best way, but rather possible sources of information or inputs that may support or complement the analysis of KPIs.

For example:

Performing annual risk assessments is a way to identify and evaluate the risks that may affect the

organization’s objectives, and to determine the adequacy and effectiveness of the control processes

in mitigating those risks12. However, this way is not the best because it is periodic rather than

continuous, and may not capture the changes or trends in the efficiency of the control processes12.

Interviewing process owners is a way to collect and verify the information and feedback from the

people who are responsible for designing, implementing, and operating the control

processes12. However, this way is not the best because it is subjective and qualitative, and may not

provide reliable or comparable data on the efficiency of the control processes12.

Reviewing the risk register is a way to examine and update the documentation and status of the risks

and the control processes that are associated with them12. However, this way is not the best

because it is descriptive rather than analytical, and may not measure or evaluate the efficiency of the

control processes12.

Reference: =

1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017

3: The Control Process | Principles of Management4

4: Control Management: What it is + Why It’s Essential | Adobe Workfront5

5: What is a Key Performance Indicator (KPI)? Guide & Examples – Qlik1

6: What is a Key Performance Indicator (KPI)? – KPI.org2

Question #83

Which of the following roles would be MOST helpful in providing a high-level view of risk related to customer data loss?

A . Customer database manager
B . Customer data custodian
C . Data privacy officer
D . Audit committee

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

A data privacy officer is a role that is responsible for ensuring that the organization complies with the applicable laws, regulations, and standards regarding the collection, processing, storage, and disclosure of customer data1. A data privacy officer is also responsible for developing and implementing policies, procedures, and controls to protect the privacy and security of customer data, and to prevent or mitigate the risk of customer data loss2. A data privacy officer is the most helpful role in providing a high-level view of risk related to customer data loss, because:

A data privacy officer has the knowledge and expertise of the legal and ethical requirements and best practices for customer data protection, and can identify and assess the potential threats and vulnerabilities that may compromise customer data3.

A data privacy officer has the authority and accountability to oversee and monitor the customer data

lifecycle, and to ensure that the organization follows the principles of data minimization, purpose limitation, accuracy, integrity, confidentiality, and accountability4.

A data privacy officer has the visibility and communication skills to report and advise the management and other stakeholders on the customer data risk profile, and to recommend and implement appropriate risk responses and improvement actions5.

The other options are not the most helpful roles in providing a high-level view of risk related to customer data loss, because:

A customer database manager is a role that is responsible for designing, developing, maintaining, and optimizing the database systems that store and manage customer data6. A customer database manager may have some technical skills and knowledge to protect the customer data from unauthorized access, modification, or deletion, but may not have the comprehensive or holistic view of the customer data risk, as they may focus only on the database level, and not on the organizational or regulatory level.

A customer data custodian is a role that is responsible for handling, processing, and storing customer data according to the instructions and permissions of the data owner7. A customer data custodian may have some operational duties and responsibilities to safeguard the customer data from accidental or intentional loss, damage, or disclosure, but may not have the strategic or analytical view of the customer data risk, as they may follow only the predefined rules and procedures, and not the risk management principles and practices.

An audit committee is a group of independent directors or members that is responsible for overseeing and evaluating the organization’s financial reporting, internal control, and audit functions. An audit committee may have some oversight and assurance roles and responsibilities to review and verify the organization’s compliance and performance regarding customer data protection, but may not have the direct or proactive view of the customer data risk, as they may rely only on the audit reports and findings, and not on the risk assessment and analysis.

Reference: =

Data Privacy Officer – CIO Wiki

What is a Data Protection Officer (DPO)? – Definition from Techopedia Data Privacy Officer: Roles and Responsibilities – ISACA Data Protection Principles – CIO Wiki

Data Privacy Officer: How to Be One and Why You Need One – ISACA

Database Manager – CIO Wiki

Data Custodian – CIO Wiki

[Audit Committee – CIO Wiki]

Question #84

When reviewing the business continuity plan (BCP) of an online sales order system, a risk practitioner notices that the recovery time objective (RTO) has a shorter lime than what is defined in the disaster recovery plan (DRP).

Which of the following is the BEST way for the risk practitioner to address this concern?

A . Adopt the RTO defined in the BCR
B . Update the risk register to reflect the discrepancy.
C . Adopt the RTO defined in the DRP.
D . Communicate the discrepancy to the DR manager for follow-up.

Reveal Solution Hide Solution

Question #85

What should be the PRIMARY driver for periodically reviewing and adjusting key risk indicators (KRIs)?

A . Risk impact
B . Risk likelihood
C . Risk appropriate
D . Control self-assessments (CSAs)

Reveal Solution Hide Solution

Question #86

Which of the following is the FIRST step when developing a business case to drive the adoption of a risk remediation project by senior management?

A . Calculating the cost
B . Analyzing cost-effectiveness
C . Determining the stakeholders
D . Identifying the objectives

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The first step when developing a business case to drive the adoption of a risk remediation project by senior management is to identify the objectives of the project. The objectives are the specific, measurable, achievable, relevant, and time-bound (SMART) goals that the project aims to accomplish. The objectives should be aligned with the organization’s vision, mission, and strategy, as well as the identified business problem or opportunity. The objectives should also reflect the expected benefits and outcomes of the project, such as reducing the risk exposure, enhancing the security posture, or improving the business performance. Identifying the objectives is the first step because it provides the direction, scope, and justification for the project, and it serves as the basis for evaluating the alternative solutions, estimating the costs and benefits, and communicating the value proposition to the senior management and other stakeholders. The other options are not the first step, although they may be subsequent or concurrent steps in the business case development process. Calculating the cost is a part of the financial analysis, which estimates the total expenditure and funding sources of the project, but it does not define the purpose or the scope of the project. Analyzing cost-effectiveness is a part of the economic analysis, which compares the costs and benefits of the alternative solutions and recommends the optimal one, but it does not specify the goals or the criteria of the project. Determining the stakeholders is a part of the stakeholder analysis, which identifies and assesses the interests, expectations, and influence of the parties involved in or affected by the project, but it does not establish the objectives or the rationale of the project.

Reference: = Business case: 7 key steps to build it and use it – Twproject: project …, Guide to developing the Project Business Case – GOV.UK, How to Write a Business Case: Template & Examples | Adobe Workfront

Question #87

Which of the following is MOST important to update following a change in organizational risk appetite and tolerance?

A . Business impact assessment (BIA)
B . Key performance indicators (KPIs)
C . Risk profile
D . Industry benchmark analysis

Reveal Solution Hide Solution

Question #88

A risk practitioner learns that the organization s industry is experiencing a trend of rising security incidents.

Which of the following is the BEST course of action?

A . Evaluate the relevance of the evolving threats.
B . Review past internal audit results.
C . Respond to organizational security threats.
D . Research industry published studies.

Reveal Solution Hide Solution

Question #89

Which of the following potential scenarios associated with the implementation of a new database technology presents the GREATEST risk to an organization?

A . The organization may not have a sufficient number of skilled resources.
B . Application and data migration cost for backups may exceed budget.
C . Data may not be recoverable due to system failures.
D . The database system may not be scalable in the future.

Reveal Solution Hide Solution

Question #90

Due to a change in business processes, an identified risk scenario no longer requires mitigation.

Which of the following is the MOST important reason the risk should remain in the risk register?

A . To support regulatory requirements
B . To prevent the risk scenario in the current environment
C . To monitor for potential changes to the risk scenario
D . To track historical risk assessment results

Reveal Solution Hide Solution