During an IT department reorganization, the manager of a risk mitigation action plan was replaced. The new manager has begun implementing a new control after identifying a more effective option. Which of the following is the risk practitioner's BEST course of action?
Answer(s): A
A risk mitigation action plan is a document that specifies the actions to be taken to address the identified risks, the resources required, the timelines, the owners, and the expected outcomes. The risk owner is the person who has the authority and accountability to manage the risk and its response. The risk practitioner is the person who supports the risk owner in the risk management process. The best course of action for the risk practitioner when the manager of a risk mitigation action plan is replaced and a new control is implemented is to communicate the decision to the risk owner for approval. This will ensure that the risk owner is aware of the change, agrees with the new control, and approves the modification of the action plan. The other options are not the best course of action, as they may not involve the risk owner, who is ultimately responsible for the risk and its response. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1.1, pp. 95- 96.
Quantifying the value of a single asset helps the organization to understand the:
Answer(s): B
Quantifying the value of a single asset helps the organization to understand the consequences of risk materializing, as it indicates how much impact or loss the organization would suffer if the asset is compromised, damaged, or destroyed by a threat. The value of an asset can be determined by various methods, such as the cost of acquisition, replacement, or restoration, the market value, the income or revenue generated, or the impact on the business objectives or reputation. The other options are not the best description of what quantifying the value of a single asset helps the organization to understand, as they are either too broad (overall effectiveness of risk management, necessity of developing a risk strategy) or not directly related to the asset value (organization's risk threshold). References = IT Asset Valuation, Risk Assessment and Control Implementation Model; How to quantify assets?; Asset Valuation - Definition, Methods, and Importance
An organization has experienced a cyber-attack that exposed customer personally identifiable information (Pll) and caused extended outages of network services. Which of the following stakeholders are MOST important to include in the cyber response team to determine response actions?
Answer(s): C
Risk owners based on risk impact are the most important stakeholders to include in the cyber response team, as they are responsible for the business outcomes affected by the cyber attack and can decide on the appropriate response actions. The other options are not the most important stakeholders to include in the cyber response team, although they may be involved in the process.
Accountability for a particular risk is BEST represented in a:
Answer(s): D
A RACI matrix is a tool that assigns the roles and responsibilities for each risk, such as who is responsible, accountable, consulted, and informed. A RACI matrix helps to clarify the expectations and accountabilities for each risk owner and stakeholder, and to ensure that the risk is managed and monitored effectively and efficiently. A risk register is a document that records and tracks the identified risks, their likelihood, impact, and mitigation strategies. A risk register does not assign the accountability for each risk, but rather the ownership and response.A risk catalog is a collection of risks that have been identified and categorized based on common attributes, such as source, type, or impact. A risk catalog does not assign the accountability for each risk, but rather the classification and description. A risk scenario is a technique that simulates the possible outcomes of different risk events and assesses their impact on the enterprise's objectives and operations. A risk scenario does not assign the accountability for each risk, but rather the analysis and evaluation.
CRISC Certified in Risk and Information Systems Control Question216; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 216.
Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?
Key performance indicators (KPIs) are metrics used to measure and evaluate the achievement of the organization's objectives and strategies1. KPIs for critical IT assets are KPIs that focus onthe performance and value of the IT assets that are essential for the organization's operations and functions2. KPIs for critical IT assets may include metrics such as availability, reliability, utilization, cost, and security of the IT assets3. The need to review and update KPIs for critical IT assets may be driven by various factors, such as changes in the business environment, customer expectations, or regulatory requirements. However, the most likely factor that would drive the need to review and update KPIs for critical IT assets is the outcomes of periodic risk assessments. A risk assessment is a process that involves identifying, analyzing, and evaluating the risks and their potential impacts on the organization's objectives and performance4. A periodic risk assessment is a risk assessment that is performed at regular intervals, such as monthly, quarterly, or annually, to capture the changes and updates in the risk environment and the risk profile5. The outcomes of periodic risk assessments would most likely drive the need to review and update KPIs for critical IT assets, as they would provide insights into the current and emerging risks that may affect the performance and value of the critical IT assets, as well as the effectiveness and efficiency of the existingand planned controls and responses. By reviewing and updating the KPIs for critical IT assets based on the outcomes of periodic risk assessments, the organization can ensure that the KPIs are relevant, realistic, and aligned with the organization's risk appetite and tolerance, and that they provide accurate and timely information for decision making and reporting. The outsourcing of related IT processes, changes in service level objectives, and findings from continuous monitoring are not the most likely factors that would drive the need to review and update KPIs for critical IT assets, as they do not provide the same level of information and impact as the outcomes of periodic risk assessments. The outsourcing of related IT processes is a decision that involves transferring some or all of the IT processes that support or enable the critical IT assets to an external service provider. The outsourcing of related IT processes may affect the performance and value of the critical IT assets, but it does not necessarily require a review and update of the KPIs for critical IT assets, as the KPIs may still be valid and applicable for the outsourced IT processes. Changes in service level objectives are changes in the expected or agreed level of quality or performance of the IT services that support or enable the critical IT assets. Changes in service level objectives may affect the performance and value of the critical IT assets, but they do not necessarily require a review and update of theKPIs for critical IT assets, as the KPIs may still be consistent and compatible with the changed service level objectives. Findings from continuous monitoring are the results or outcomes of the ongoing observation and measurement of the performance and compliance of the IT processes and systems that support or enable the critical IT assets. Findings from continuous monitoring may affect the performance and value of the critical IT assets, but they do not necessarily require a review and update of the KPIs for critical IT assets, as the KPIs may still be relevant and reliable for the continuously monitored IT processes and systems. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp.189-191.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.