QUESTION: 273

Which of the following is the MOST critical security consideration when an enterprise outsource is major part of IT department to a third party whose servers are in foreign company?

A security breach notification may get delayed due to time difference
The enterprise could not be able to monitor the compliance with its internal security and privacy guidelines
Laws and regulations of the country of origin may not be enforceable in foreign country
Additional network intrusion detection sensors should be installed, resulting in additional cost

Answer(s): C

Explanation:

Laws and regulations of the country of origin may not be enforceable in foreign country and conversely, it is also true that laws and regulations of the foreign outsourcer may also impact the enterprise. Hence violation of applicable laws may not be recognized or rectified due to lack of knowledge of the local laws.

Incorrect Answers:
A: Security breach notification is not a problem and also time difference does not play any role in 24/7 environment. Pagers, cellular phones, telephones, etc. are there to communicate the notifications.

B: Outsourcing does not remove the enterprise's responsibility regarding internal requirements. Hence monitoring the compliance with its internal security and privacy guidelines is not a problem.

D: The need for additional network intrusion detection sensors is not a major problem as it can be easily managed. It only requires addition funding, but can be addressed.

Reveal Solution Next Question

QUESTION: 274

You are the Risk Official in Bluewell Inc. You have detected much vulnerability during risk assessment process. What you should do next?

Prioritize vulnerabilities for remediation solely based on impact.
Handle vulnerabilities as a risk, even though there is no threat.
Analyze the effectiveness of control on the vulnerabilities' basis.
Evaluate vulnerabilities for threat, impact, and cost of mitigation.

Answer(s): D

Explanation:

Vulnerabilities detected during assessment should be first evaluated for threat, impact and cost of mitigation. It should be evaluated and prioritized on the basis whether they impose credible threat or not.

Incorrect Answers:
A, C: These are the further steps that are taken after evaluating vulnerabilities. So, these are not immediate action after detecting vulnerabilities.

B: If detected vulnerabilities impose no/negligible threat on an enterprise then it is not cost effective to address it as risk.

Reveal Solution Next Question

QUESTION: 275

Assessing the probability and consequences of identified risks to the project objectives, assigning a risk score to each risk, and creating a list of prioritized risks describes which of the following processes?

Qualitative Risk Analysis
Plan Risk Management
Identify Risks
Quantitative Risk Analysis

Answer(s): A

Explanation:

The purpose of qualitative risk analysis is to determine what impact the identified risk events will have on the project and the probability they'll occur. It also puts risks in priority order according to their effects on the project objectives and assigns a risk score for the project.

Incorrect Answers:
B: Risk Management is used to identify, assess, and control risks. It includes analyzing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats. Assessing the probability and consequences of identified risks is only the part of risk management.

C: It involves listing of all the possible risks so as to cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.

D: This process does not involve assessing the probability and consequences of identified risks. Quantitative analysis is the use of numerical and statistical techniques rather than the analysis of verbal material for analyzing risks. Some of the quantitative methods of risk analysis are:
Internal loss method External data analysis
Business process modeling (BPM) and simulation Statistical process control (SPC)

Reveal Solution Next Question

QUESTION: 276

You and your project team have identified a few risk events in the project and recorded the events in the risk register. Part of the recording of the events includes the identification of a risk owner. Who is a risk owner?

A risk owner is the party that will monitor the risk events.
A risk owner is the party that will pay for the cost of the risk event if it becomes an issue.
A risk owner is the party that has caused the risk event.
A risk owner is the party authorized to respond to the risk event.

Answer(s): D

Explanation:

Risk owner for each risk should be the person who has the most influence over its outcome. Selecting the risk owner thus usually involves considering the source of risk and identifying the person who is best placed to understand and implement what needs to be done. They are also responsible for responding to the event and reporting on the risk status.

Incorrect Answers:
A: A risk owner will monitor the identified risks for status changes, but all project stakeholders should be iteratively looking to identify the risks.

B: Risk owners do not pay for the cost of the risk event.

C: Risk owners are not the people who cause the risk event.

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 69)

QUESTION: 273

Explanation:

QUESTION: 274

Explanation:

QUESTION: 275

Explanation:

QUESTION: 276

Explanation: