CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

Free CRISC Exam Braindumps (page: 39)

Page 38 of 451
PDF with 1871 Questions

Which of the following considerations should be taken into account while selecting risk indicators that ensures greater buy-in and ownership?

  1. Lag indicator
  2. Lead indicator
  3. Root cause
  4. Stakeholder

Answer(s): D

Explanation:

To ensure greater buy-in and ownership, risk indicators should be selected with the involvement of relevant stakeholders. Risk indicators should be identified for all stakeholders and should not focus solely on the more operational or strategic side of risk.

Incorrect Answers:
A: Role of lag indicators is to ensure that risk after events have occurred is being indicated.

B: Lead indicators indicate which capabilities are in place to prevent events from occurring. They do not play any role in ensuring greater buy-in and ownership.

C: Root cause is considered while selecting risk indicator but it does not ensure greater buy-in or ownership.



Suppose you are working in Techmart Inc. which sells various products through its website. Due to some recent losses, you are trying to identify the most important risks to the Website. Based on feedback from several experts, you have come up with a list. You now want to prioritize these risks. Now in which category you would put the risk concerning the modification of the Website by unauthorized parties.

  1. Ping Flooding Attack
  2. Web defacing
  3. Denial of service attack
  4. FTP Bounce Attack

Answer(s): B

Explanation:

Website defacing is an attack on a website by unauthorized party that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.

Incorrect Answers:
A: Ping Flooding is the extreme of sending thousands or millions of pings per second. Ping Flooding attack can make system slow or even shut down an entire site.

C: A denial-of-service attack (DoS attack) is an attempt to make a computer or network resource unavailable to its intended users. One common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable.

D: The FTP bounce attack is attack which slips past application-based firewalls. In this hacker uploads a file to the FTP server and then requests this file be sent to an internal server. This file may contain malicious software or a simple script that occupies the internal server and uses up all the memory and CPU resources.



Which of the following is true for risk evaluation?

  1. Risk evaluation is done only when there is significant change.
  2. Risk evaluation is done once a year for every business processes.
  3. Risk evaluation is done annually or when there is significant change.
  4. Risk evaluation is done every four to six months for critical business processes.

Answer(s): C

Explanation:

Due to the reason that risk is constantly changing, it is being evaluated annually or when there is significant change. This gives best alternative as it takes into consideration a reasonable time frame of one year, and meanwhile it also addresses significant changes (if any).

Incorrect Answers:
A: Evaluating risk only when there are significant changes do not take into consideration the effect of time. As the risk is changing constantly, small changes do occur with time that would affect the overall risk. Hence risk evaluation should be done annually too.

B: Evaluating risk once a year is not sufficient in the case when some significant change takes place. This significant change should be taken into account as it affects the overall risk.

D: Risk evaluation need not to be done every four to six months for critical processes, as it does not address important changes in timely manner.



You work as a project manager for Bluewell Inc. You have identified a project risk. You have then implemented the risk action plan and it turn out to be non-effective. What type of plan you should implement in such case?

  1. Risk mitigation
  2. Risk fallback plan
  3. Risk avoidance
  4. Risk response plan

Answer(s): B

Explanation:

A risk fallback plan is a proper plan devised to identify definite action to be taken if the risk action plan (Risk Mitigation Plan) is not helpful. Fallback plan is important in Risk Response Planning. If the contingency plan for a risk is not successful, then the project team implements the fallback plan. Fall-back planning is intended for a known and specific activity that may perhaps fail to produce desired outcome. It is related with technical procedures and with the responsibility of the technical lead.

Incorrect Answers:
A, C, D: These all choices itself comes under risk action plan. As in the described scenario, risk action plan is not turned to be effective, these should not be implemented again.






Post your Comments and Discuss ISACA CRISC exam with other Community members:

CRISC Discussions & Posts