Which of the following BEST enables effective risk-based decision making?
Answer(s): D
An updatedrisk registerensures that decision-makers have accurate, timely information about current risks, enabling informed, risk-based decisions that align with organizational priorities and changes in the environment.
Which of the following is BEST used to aggregate data from multiple systems to identify abnormal behavior?
Understanding the Questio n:The question asks which tool is best for aggregating data from multiple systems to identify abnormal behavior.Analyzing the Options:A . Cyber threat intelligence:Provides information on potential threats but does not aggregate data from multiple systems for behavior analysis.B . Anti-malware software:Focuses on detecting and removing malware, not aggregating data from multiple sources.C . Endpoint detection and response (EDR):Monitors endpoints for suspicious activity but is more limited in scope compared to SIEM systems.D . SIEM systems:Security Information and Event Management systemscollect, aggregate, and analyze data from various sources to identify and respond to abnormal behavior.SIEM Systems:SIEM systems are designed to aggregate and analyze security data from multiple sources such as network devices, servers, and applications. They provide real-time analysis of security alerts generated by hardware and software. Functionality:SIEM systems use advanced analytics to correlate data from different sources and detect patterns that indicate abnormal behavior. This makes them highly effective in identifying and responding to security incidents.
CRISC Review Manual, Chapter 3: Risk Response and Reporting, mentions the importance of centralized monitoring systems like SIEM for effective risk management .
Which of the following is MOST important for maintaining the effectiveness of an IT risk register?
An IT risk register is a document that records the identified IT risks, their analysis, and their responses. It is a useful tool for managing and communicating the IT risks throughout the project or the organization. The most important factor for maintaining the effectiveness of an IT risk register is to perform regular reviews and updates to the register, meaning that the riskpractitioner should periodically check and revise the riskregister to reflect the changes in the IT risk environment, the project status, or the organization's objectives. Performing regular reviews and updates to the register can help to ensure that the risk register is accurate, complete, and current, and that it provides relevant and reliable information for the risk management decision making and actions. Performing regular reviews and updates to the register can also help to identify any new or emerging IT risks, as well as to monitor and report on the IT risk performance and improvement. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, p. 106-107
To define the risk management strategy which of the following MUST be set by the board of directors?
Answer(s): B
Risk appetite is the broad-based amount of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite reflects the level of risk that the organization is prepared to take to achieve its strategic goals, and provides guidance and boundaries for the risk management activities and decisions. To define the risk management strategy, which is the plan and approach for managing the risks that may affect the achievement of the organization's objectives, the factor that must be set by the board of directors is the risk appetite. The board of directors is the highest governing body of the organization, and has the ultimate responsibility and authority for setting the direction and oversight of the organization. By setting the risk appetite, the board of directors can communicate its expectations and preferences for the risk exposure and performance of the organization, and ensure alignment with the business objectives and strategies. References = 3
Which of the following BEST indicates that an organization has implemented IT performance requirements?
Answer(s): A
Service level agreements (SLA) are contracts that define the expected level of performance and quality of service that an IT service provider will deliver to its customers. SLA are the best indicators that an organization has implemented IT performance requirements, as they specifythe measurable and verifiable criteria that the IT service provider must meet or exceed, such as availability, reliability, security, and responsiveness. SLA also establish the roles and responsibilities of the parties involved, the methods of monitoring and reporting the service performance, and the consequences of non-compliance or breach of the agreement. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 232. CRISC by Isaca Actual Free Exam Q&As, Question 9. CRISC Sample Questions 2024, Question 232. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 232.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.