The patch management process is MOST effectively monitored through which of the following key control indicators (KCIs)?
Answer(s): B
Monitoring the percentage of patches deployed within the target time frame is a critical key control indicator for the patch management process. It reflects the organization's ability to apply necessary updates promptly, reducing exposure to known vulnerabilities. Timely patch deployment is essential for maintaining system security and compliance with organizational policies.
ISACA CRISC Review Manual, 7th Edition, Chapter 4: Information Technology and Security, Section: IT Risk Monitoring and Reporting.
The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:
Answer(s): D
The primary reason for periodic penetration testing of Internet-facing applications is to identify vulnerabilities in the system, because this will help to improve the security and resilience of the applications and the data they process. A penetration test is a simulated cyberattack that aims to exploit the weaknesses and gaps in the security of an application or a system. A penetration test can reveal the vulnerabilities that may not be detected by other methods, such as automated scanning or code review. A penetration test can also measure the impact and severity of the vulnerabilities, as well as the effectiveness of the existing controls and defenses. A penetration test can also provide recommendations and solutions to remediate the vulnerabilities and prevent future attacks. Internet-facing applications are programs and services that are accessible from the internet, such as web applications, APIs, cloud services, or VPN gateways. Internet-facing applications are exposed to a variety of cyber threats, such as denial-of-service attacks, SQL injection attacks, cross-site scripting attacks, or credential stuffing attacks. These threats can compromise the confidentiality, integrity, and availability of the applications and the data they handle. Therefore, periodic penetration testing of Internet-facing applications is essential to identify vulnerabilities in the system and to protect the applications and the data from cyberattacks. References = Web Application Penetration Testing: A Practical Guide - BrightSecurity1, The Basics of WebApplication Penetration Testing | Turing2, Periodic Penetration Testing: What is the best pentesting frequency ...
An IT risk practitioner has determined that mitigation activities differ from an approved risk action plan. Which of the following is the risk practitioner's BEST course of action?
This can help to:Ensure that the implemented measures are effective and efficient in reducing the risk level to an acceptable level, and that they are aligned with the risk appetite and tolerance of the organization2.Identify and address any gaps, issues, or challenges that may arise from the deviation from the approved risk action plan, and recommend and implement appropriate improvement actions or contingency plans3.Communicate and report the results and outcomes of the validation to the relevant stakeholders, such as the risk owner, the risk committee, or the chief risk officer, and obtain their feedback and approval4.The other options are not the best course of action, because:Reporting the observation to the chief risk officer (CRO) is not the best course of action, as it may not provide sufficient information or evidence to support the deviation from the approved risk action plan. The CRO may not be able to evaluate or approve the implemented risk mitigation measures without knowing their adequacy or impact on the risk level5.Updating the risk register with the implemented risk mitigation actions is not the best course of action, as it may not reflect the current or accurate risk status or performance. The risk register is a document that records and summarizes the key information and data about the identified risks and the risk responses6. Updating the risk register without validating the adequacy of the implemented risk mitigation measures may create inconsistencies or inaccuracies in the risk register.Reverting the implemented mitigation measures until approval is obtained is not the best course of action, as it may expose the organization to higher or unacceptable levels of risk. Reverting the implemented mitigation measures may undo or negate the benefits or outcomes of the risk mitigation, and may increase the likelihood or impact of the risk events7.References =ISACA Risk Starter Kit provides risk management templates and policies Risk Appetite and Tolerance - CIO WikiRisk Monitoring and Review - The National Academies Press Risk Reporting - CIO WikiChief Risk Officer - CIO WikiRisk Register - CIO WikiRisk Mitigation - CIO Wiki
An organization has completed a project to implement encryption on all databases that host customer data. Which of the following elements of the risk register should be updated the reflect this change?
Answer(s): A
The risk likelihood is the element of the risk register that should be updated to reflect the change of implementing encryption on all databases that host customer data. The risk likelihood is the probability or frequency of a risk event occurring, and it is one of the factors that determine the risk level and priority. By implementing encryption, the organization reduces the risk likelihood of unauthorized access, disclosure, or breach of the customer data, as encryption protects the data from being read or modified by anyone who does not have the decryption key. Therefore, the risk likelihood should be updated to reflect the lower probability of the risk event after applying the encryption control. The other options are not the elements that should be updated, as they are either not affected by or not related to the change of implementing encryption. The inherent risk is the level of risk before applying any controls or mitigation measures, and it does not change after implementing encryption. The risk appetite is the amount of risk that the organization is willing to accept in pursuit of its objectives, and it is not influenced by the change ofimplementing encryption. The risk tolerance is the acceptable variation between the risk thresholds and thebusiness objectives, and it is not determined by the change of implementing encryption. References = Risk Register: A Project Manager's Guide with Examples [2023] · Asana; Risk Assessment in Project Management | PMI; Risk Assessment Process: Definition, Steps, and Examples; RiskAssessment - an overview | ScienceDirect Topics
To minimize the risk of a potential acquisition being exposed externally, an organization has selected a few key employees to be engaged in the due diligence process. A member of the due diligence team realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired. What is the BEST course of action for this team member?
A conflict of interest is a situation where a person's personal or professional interests may interfere with their ability to act in the best interest of the organization or the project1. A conflict of interest can compromise the integrity, objectivity, and impartiality of the person, and create ethical or legal issues for the organization or the project2. In the context of due diligence, a conflict of interest can affect the quality and reliability of the information and analysis, and jeopardize the success and confidentiality of the acquisition3. The best course of action for a member of the due diligence team who realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired is to disclose potential conflicts of interest. This means that the team member should inform the due diligence leader and the organization's management about the relationship with the acquaintance, and explain how it may affect their role or responsibility in the due diligence process. By disclosing potential conflicts of interest, the team member can:Demonstrate honesty and transparency, and uphold the ethical standards and values of the organization and the project4.Enable the due diligence leader and the organization's management to assess the situation and decide the appropriate course of action, such as reassigning the team member, implementing additional controls or safeguards, or obtaining consent or approval from the relevant parties5.Avoid or minimize the negative consequences or risks that may arise from the conflict of interest, such as legal liability, reputational damage, or loss of trust and credibility6.References =Conflict of Interest - CIO WikiWhat is a Conflict of Interest? Give Me Some Examples - The Balance Careers How to Avoid Conflicts of Interest in M&A Transactions - DealRoom How to Handle Conflicts of Interest - Harvard Business Review Conflict of Interest Policy - ISACAManaging Conflicts of Interest in the Public Sector Toolkit - OECD
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.