QUESTION: 21

An enterprise has identified risk events in a project. While responding to these identified risk events, which among the following stakeholders is MOST important for reviewing risk response options to an IT risk.

Information security managers
Internal auditors
Incident response team members
Business managers

Answer(s): D

Explanation:

Business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others.

Incorrect Answers:
A: Information security managers may best understand the technical tactical situation, but business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others, which includes collaboration with, and support from, lT security managers.

C: The incident response team must ensure open communication to management and stakeholders to ensure that business managers understand the associated risk and are provided enough information to make informed risk-based decisions. They are not responsible for reviewing risk response options.

Reveal Solution Next Question

QUESTION: 22

Which of the following is a technique that provides a systematic description of the combination of unwanted occurrences in a system?

Sensitivity analysis
Scenario analysis
Fault tree analysis
Cause and effect analysis

Answer(s): C

Explanation:

Fault tree analysis (FIA) is a technique that provides a systematic description of the combination of possible occurrences in a system, which can result in an undesirable outcome. It combines hardware failures and human failures.

Incorrect Answers:
A: Sensitivity analysis is the quantitative risk analysis technique that:
Assist in determination of risk factors that have the most potential impact Examines the extent to which the uncertainty of each element affects the object under consideration when all other uncertain elements are held at their baseline values

B: This analysis provides ability to see a range of values across several scenarios to identify risk in specific situation. It provides ability to identify those inputs which will provide the greatest level of uncertainty.

D: Cause-and-effect analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes. These tools also help in identifying potential risk.

Reveal Solution Next Question

QUESTION: 23

What is the process for selecting and implementing measures to impact risk called?

Risk Treatment
Control
Risk Assessment
Risk Management

Answer(s): A

Explanation:

The process for selecting and implementing measures for impacting risk in the environment is called risk treatment.

Incorrect Answers:
C: The process of analyzing and evaluating risk is called risk assessment.

D: Risk management is the coordinated activities for directing and controlling the treatment of risk in the organization.

Reveal Solution Next Question

QUESTION: 24

Which section of the Sarbanes-Oxley Act specifies "Periodic financial reports must be certified by CEO and CFO"?

Section 302
Section 404
Section 203
Section 409

Answer(s): A

Explanation:

Section 302 of the Sarbanes-Oxley Act requires corporate responsibility for financial reports to be certified by CEO, CFO, or designated representative.

Incorrect Answers:
B: Section 404 of the Sarbanes-Oxley Act states that annual assessments of internal controls are the responsibility of management.

C: Section 203 of the Sarbanes-Oxley Act requires audit partners and review partners to rotate off an assignment every five years.

D: Section 409 of the Sarbanes-Oxley Act states that the financial reports must be distributed quickly and currently.

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 6)

QUESTION: 21

Explanation:

QUESTION: 22

Explanation:

QUESTION: 23

Explanation:

QUESTION: 24

Explanation: