CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

Free CRISC Exam Braindumps (page: 59)

Page 58 of 451
PDF with 1871 Questions

Which of the following is the BEST defense against successful phishing attacks?

  1. Intrusion detection system
  2. Application hardening
  3. End-user awareness
  4. Spam filters

Answer(s): C

Explanation:

Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Phishing attacks are a type of to social engineering attack and are best defended by end-user awareness training.

Incorrect Answers:
A: An intrusion detection system does not protect against phishing attacks since phishing attacks usually do not have a particular pattern or unique signature.

B: Application hardening does not protect against phishing attacks since phishing attacks generally use e-mail as the attack vector, with the end-user as the vulnerable point, not the application.

D: Certain highly specialized spam filters can reduce the number of phishing e-mails that reach the inboxes of user, but they are not as effective in addressing phishing attack as end-user awareness.



Which of the following laws applies to organizations handling health care information?

  1. GLBA
  2. HIPAA
  3. SOX
  4. FISMA

Answer(s): B

Explanation:

HIPAA handles health care information of an organization.

The Health Insurance Portability and Accountability Act (HIPAA) were introduced in 1996. It ensures that health information data is protected. Before HIPAA, personal medical information was often available to anyone.
Security to protect the data was lax, and the data was often misused.

If your organization handles health information, HIPAA applies. HIPAA defines health information as any data that is created or received by health care providers, health plans, public health authorities, employers, life insurers, schools or universities, and health care clearinghouses.

HIPAA defines any data that is related to the health of an individual, including past/present/future health, physical/mental health, and past/present/future payments for health care.

Creating a HIPAA compliance plan involves following phases:
Assessment: An assessment helps in identifying whether organization is covered by HIPAA. If it is, then further requirement is to identify what data is needed to protect.
Risk analysis: A risk analysis helps to identify the risks. In this phase, analyzing method of handling data of organization is done.
Plan creation: After identifying the risks, plan is created. This plan includes methods to reduce the risk. Plan implementation: In this plan is being implemented.
Continuous monitoring: Security in depth requires continuous monitoring. Monitor regulations for changes. Monitor risks for changes. Monitor the plan to ensure it is still used.
Assessment: Regular reviews are conducted to ensure that the organization remains in compliance.

Incorrect Answers:
A: GLBA is not used for handling health care information.

C: SOX designed to hold executives and board members personally responsible for financial data. D: FISMA ensures protection of data of federal agencies.



Mike is the project manager of the NNP Project for his organization. He is working with his project team to plan the risk responses for the NNP Project. Mike would like the project team to work together on establishing risk thresholds in the project. What is the purpose of establishing risk threshold?

  1. It is a study of the organization's risk tolerance.
  2. It is a warning sign that a risk event is going to happen.
  3. It is a limit of the funds that can be assigned to risk events.
  4. It helps to identify those risks for which specific responses are needed.

Answer(s): D

Explanation:

Risk threshold helps to identify those risks for which specific responses are needed.



What should be considered while developing obscure risk scenarios? Each correct answer represents a part of the solution. Choose two.

  1. Visibility
  2. Controls
  3. Assessment methods
  4. Recognition

Answer(s): A,D

Explanation:

The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things: Visibility
Recognition

For the fulfillment of this task enterprise must:
Be in a position that it can observe anything going wrong
Have the capability to recognize an observed event as something wrong






Post your Comments and Discuss ISACA CRISC exam with other Community members:

CRISC Discussions & Posts