Which of the following is the BEST way to prevent the loss of highly sensitive data when disposing of storage media?
Answer(s): A
When disposing of storage media, the best way to prevent the loss of highly sensitive data is physical destruction. Here's why:Physical Destruction:Physical destruction involves destroying the storage media so that the data it contains cannot be recovered or reconstructed.Methods include shredding, crushing, incinerating, or using industrial-grade degaussers that destroy the magnetic fields on the media.Comparison with Other Methods:Degaussing:This method erases data by disrupting the magnetic fields of the storage media. While effective for some types of media, it may not work on all (e.g., solid-state drives) and does not provide a visual confirmation that the data is irrecoverable. Data Anonymization:This process involves altering data to prevent identification of individuals, but it does not destroy the data itself and is not applicable for disposing of storage media.Data Deletion:Simply deleting data does not remove it permanently. Deleted data can often be recovered using specialized software unless it is overwritten multiple times, which is still less reliable than physical destruction.Security Best Practices:Physical destruction is considered the most secure method because it ensures that the media is rendered completely unusable and the data cannot be retrieved by any means. This method is recommended by various standards and frameworks, including NIST Special Publication 800-88 Guidelines for Media Sanitization.
The CRISC Review Manual highlights the importance of physical destruction for securely disposing of sensitive data (CRISC Review Manual, Chapter 4: Information Technology and Security, Section 4.5.2 Data Loss Prevention).
The BEST metric to monitor the risk associated with changes deployed to production is the percentage of:
Answer(s): B
Changes deployed to production are those that affect the functionality, performance, or security of the system in a way that is visible or accessible to the end users1. These changes can introduce new risks or vulnerabilities, such as errors, bugs, compatibility issues, or unauthorized access2. Therefore, it is important to monitor the risk associated with these changes and measure how often they cause incidents in production.One metric that can be used to monitor this risk is the percentage of changes that cause incidents in production. This metric indicates how effective the change management process is and how well the organization can prevent or mitigate potential problems caused by changes3. A high percentage of incidents indicates a high level of risk and a need for improvement in the change management process.References = IT Change Management for SOC: Process and Best Practices, Determining and Managing Risk when Deploying Code, 6 Deployment Risks and How To Mitigate Them
A cote data center went offline abruptly for several hours affecting many transactions across multiple locations. Which of the to" owing would provide the MOST useful information to determine mitigating controls?
Answer(s): C
The most useful information to determine mitigating controls when a core data center went offline abruptly for several hours affecting many transactions across multiple locations is the root cause analysis. Root cause analysis is a technique that identifies the underlying factors or reasons that caused the problem or incident. Root cause analysis can help to understand the nature, scope,and impact of the problem or incident, and to prevent or reduce the recurrence or severity of the problem or incident in the future. Root cause analysis can also help to identify and prioritize the appropriate mitigating controls that address the root causes of the problem or incident. The other options are not as useful as root cause analysis, as they are related to the investigation, evaluation, or measurement of the problem or incident, not the resolution or prevention of the problem or incident. References = Risk and Information Systems ControlStudy Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.4: Key Control Indicators, page 211.
Which of the following is the GREATEST benefit of updating the risk register to include outcomes from a risk assessment?
Updating the risk register to include outcomes from a risk assessment is the greatest benefit because it enables the organization to prioritize and respond to the most significant risks in a timely manner. The risk register is a tool that records and tracks the current status of risks, their likelihood, impact, and response strategies. By updating the risk register with the results of a risk assessment, the organization can ensure that the risk information is accurate, relevant, and actionable. Maintaining evidence of compliance with risk policy, validating the organization'srisk appetite, and helping to mitigate internal and external risk factors are all possible benefits of updating the risk register, but they are not the greatest benefit, as they do not directly support risk-based decision making. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, page 83
An organization's stakeholders are unable to agree on appropriate risk responses. Which of the following would be the BEST course of action?
Escalating to senior management is the best course of action when an organization's stakeholders are unable to agree on appropriate risk responses. This is because senior management has the authority and responsibility to make strategic decisions and resolve conflicts regarding risk management. Senior management can also provide guidance and direction on the risk appetite, tolerance, and criteria for the organization, as well as allocate resources and assign roles and responsibilities for risk response. According to the CRISC Review Manual 2022, one of the key risk response techniques is to escalate the risk to senior management when the risk exceeds the acceptable level or when there is a disagreement on the risk response1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, escalating to senior management is the correct answer to this question2.Identifying a risk transfer option, reassessing risk scenarios, and benchmarking with similar industries are not the best courses of action when an organization's stakeholders are unable to agree on appropriate risk responses. These are possible actions that can be taken as part of the risk response process, but they do not address the underlying issue of stakeholder disagreement. Identifying a risk transfer option can help reduce or share the risk with a third party, such as an insurance company or a vendor, but it may not be suitable or acceptable for all types of risks or stakeholders. Reassessing risk scenarios can help update the risk analysis and evaluation, but it may not change the risk level or the risk response options. Benchmarking with similar industries can help compare the risk performance and practices of the organization with its peers, but it may not reflect the organization's specific needs or risks.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.