QUESTION: 781

Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

Obtain an objective view of process gaps and systemic errors.
Ensure the risk profile is defined and communicated.
Validate the threat management process.
Obtain objective assessment of the control environment.

Answer(s): A

Reveal Solution Next Question

QUESTION: 782

Which of the following activities should be performed FIRST when establishing IT risk management processes?

Conduct a high-level risk assessment based on the nature of business.
Collect data of past incidents and lessons learned.
Identify the risk appetite of the organization.
Assess the goals and culture of the organization.

Answer(s): D

Reveal Solution Next Question

QUESTION: 783

Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management’s action plan?

Survey device owners.
Review awareness training assessment results.
Re-scan the user environment.
Require annual end user policy acceptance.

Answer(s): C

Reveal Solution Next Question

An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?

Analyze data protection methods.
Understand data flows.
Include a right-to-audit clause.
Implement strong access controls.

Answer(s): B

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 196)

QUESTION: 781

QUESTION: 782

QUESTION: 783

QUESTION: 784