Which of the following should be management's PRIMARY focus when key risk indicators (KRIs) begin to rapidly approach defined thresholds?
Answer(s): D
The primary focus of management when key risk indicators (KRIs) begin to rapidly approach defined thresholds is to determine what has changed in the environment. KRIs are metrics that provide information and insight on the current level and trend of the risk exposure, and help to monitor and report the risk status and performance. Defined thresholds are the values or rangesof the KRIs that indicate the acceptable or unacceptable level of the risk exposure,and trigger the risk response actions. When KRIs begin to rapidly approach defined thresholds, it means that the risk exposure is increasing or decreasing significantly, and that the risk situation and status may have changed. Therefore, the primary focus of management is to determine what has changed in the environment, which is the internal or external context that influences or affects the risk exposure and impact. Determining what has changed in the environment helps to identify and analyze the causes, drivers, or factors of the risk change, and to evaluate the implications and consequences of the risk change. Determining what has changed in the environment also helps to update and adjust the risk assessment and response, and to communicate and escalate the risk change to the relevant stakeholders. Designing compensating controls, determining if KRIs have been updated recently, and assessing the effectiveness of the incident response plan are not the primary focus of management, as they are either the outputs or the inputs of the risk change analysis, and they do not address the primary need of understanding the risk change. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 50.
A new regulator/ requirement imposes severe fines for data leakage involving customers' personally identifiable information (Pll). The risk practitioner has recommended avoiding the risk. Which of the following actions would BEST align with this recommendation?
Answer(s): C
Avoiding the risk means eliminating the source of the risk or changing the likelihood or impact to zero. In this case, the source of the risk is the collection of customers' personally identifiable information (Pll), which could be exposed to unauthorized parties and result in severe fines. Therefore, the best action to avoid the risk is to modify the business processes to stop collecting Pll, as this would eliminate the possibility of data leakage and the associated consequences. The other options are not as effective as modifying the business processes, because they do not avoid the risk, but rather mitigate or transfer the risk, as explained below:A . Reduce retention periods for Pll data is a mitigation action, as it reduces the impact of the risk by minimizing the amount of data that could be leaked and the duration of exposure. B . Move Pll to a highly-secured outsourced site is a transfer action, as it shifts the responsibility of protecting the data to a third party, but does not eliminate the risk of data leakage.D . Implement strong encryption for Pll is a mitigation action, as it reduces the likelihood of the risk by making the data unreadable to unauthorized parties, but does noteliminate the risk of data leakage. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, page 40.
Which of the following is MOST important to determine as a result of a risk assessment?
Risk response options are the most important factor to determine as a result of a risk assessment, as they involve selecting the optimal strategy and actions to address the identified and assessed risks, and align them with the risk tolerance and appetite of the organization. Process ownership, risk appetite statement, and risk tolerance levels are not the most important factors, as they are more related to the governance, definition, or communication of the risk, respectively, rather than the response to the risk. References = CRISC Review Manual, 7th Edition, page 108.
Which of the following BEST mitigates the risk of sensitive personal data leakage from a software development environment?
Anonymizing personal data in non-production environments means replacing the real data with fictitious but realistic data that does not allow identification of the individuals. This is a good way to mitigate the risk of sensitive personal data leakage from a software development environment, as it reduces the exposure of the data to unauthorized access or misuse. Tokenizing personal data only in test environments is not sufficient, as the data may still be exposed in other non-production environments, such as development or staging. Data loss prevention tools (DLP) installed in passive mode may detect and report data leakage incidents, but they do not prevent them from happening. Multi-factor authentication for access to non-production environments may enhance the security of the access, but it does not protect the data from being leaked by authorized users or compromised by other means. References = CRISC Review Manual (Digital Version), page 226; CRISC ReviewQuestions, Answers & Explanations Database, question 195.
To help ensure the success of a major IT project, it is MOST important to:
Answer(s): A
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.