Which of the following would BEST prevent an unscheduled application of a patch?
Answer(s): D
Change management is the best way to prevent an unscheduled application of a patch, because it ensures that any changes to the IT environment are planned, approved, tested, and documented. Change management is a process that controls the implementation of changes to IT systems, applications, infrastructure, or processes. It aims to minimize the risk of disruption, errors, or failures caused by changes. Applying a patch is a type of change that may affect the security, functionality, or performance of an IT system or application. Therefore, applying a patch shouldfollow the change management process and schedule, and avoid any unscheduled or unauthorized patching. Network-based access controls, compensating controls, and segregation of duties are all useful controls to protect the IT environment from unauthorized or malicious access, but they do not prevent an unscheduled application of a patch, as they do not address the change management process. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.4.2, page 211
Which of the following is MOST important to determine when assessing the potential risk exposure of a loss event involving personal data?
Answer(s): B
When assessing the potential risk exposure of a loss event involving personal data, the most important factor to determine is the composition and number of records in the information asset. The composition refers to the type and sensitivity of the personal data, such as name, address, phone number, email, social security number, health information, financial information, etc. The number of records refers to the quantity and scope of the personal data that is affected by the loss event. The composition and number of records in the information asset determine the severity and impact of the loss event, as they indicate the extent of the harm and damage that can be caused to the data subjects, the organization, and other stakeholders.The composition and number of records in the information asset also influence the cost of the incident responseactivities, the level of the regulatory fines, and the duration of the incident containment and recovery. References = CRISC Review Manual, 7th Edition, page 159.
Senior leadership has set guidelines for the integration of a new acquisition. The guidelines allow for a variation in the level of risk-taking. The variation indicates which of the following risk management concepts?
Answer(s): A
Risk tolerance refers to the acceptable level of variation in outcomes related to specific risks that an organization is willing to withstand. It defines the boundaries within which the organization can operate safely and is often set by senior leadership to guide decision-making processes. In the context of integrating a new acquisition, allowing for variation in the level of risk-taking directly pertains to the organization's risk tolerance.
ISACA CRISC Review Manual, 7th Edition, Chapter 1: Governance, Section:Risk Governance.
Which of the following should a risk practitioner do FIRST to support the implementation of governance around organizational assets within an enterprise risk management (ERM) program?
Enterprise Risk Management (ERM):ERM involves a comprehensive approach to identifying, assessing, managing, and monitoring risks across an organization. Effective governance of organizational assets is a key component.Importance of a Risk Profile:Developing a detailed risk profile is the first step in supporting ERM implementation. It provides a clear understanding of the organization's risk landscape, including the types of risks, their potential impact, and likelihood.A risk profile helps in prioritizing risks, allocating resources, and establishing appropriate risk management strategies.Steps to Develop a Risk Profile:Identify all organizational assets and their importance to business operations. Assess the vulnerabilities and threats associated with each asset. Determine the potential impact and likelihood of risk events. Document the findings to create a comprehensive risk profile.Supporting Implementation:A detailed risk profile informs decision-makers and supports the development of policies, controls, and procedures to mitigate identified risks. It serves as a foundation for continuous monitoring and improvement of the risk management program.Other Options:Hiring experienced resources, scheduling internal audits, and conducting risk assessments are essential actions but come after establishing a detailed risk profile. The risk profile provides the necessary information to guide these activities effectively.
The CRISC Review Manual emphasizes the importance of developing a detailed risk profile as a foundational step in the ERM process (CRISC Review Manual, Chapter 1: Governance, Section 1.6.5 Asset Valuation) .
Which of the following is the PRIMARY reason to conduct risk assessments at periodic intervals?
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.