Which of the following is the GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs?
Answer(s): B
The GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs is:B . Controls are not applied to the applications.When end users create their own applications, there is often a lack of formal controls that would typically be applied in a structured development environment. This can lead to issues with data integrity, security vulnerabilities, and non-compliance with organizational policies and standards.
Which of the following BEST protects an organization against breaches when using a software as a service (SaaS) application?
Answer(s): D
Software as a service (SaaS) is a cloud computing model that provides software applications over the internet, without requiring the customer to install or maintain them on their own devices1. SaaS applicationscan offer many benefits, such as scalability, accessibility, and cost-efficiency, but they also pose security risks, such as data breaches, unauthorized access,and compliance violations2.One of the best ways to protect an organization against breaches when using a SaaS application is to use data loss prevention (DLP) tools. DLP tools are software solutions that monitor, detect,and prevent the unauthorized transmission or leakage of sensitive data from an organization's network or devices3. DLP tools can help an organization to:Identify and classify sensitive data, such as personal information, intellectual property, or financial records, and apply appropriate policies and controls to protect them Encrypt data in transit and at rest, and use secure protocols and encryption keys to ensure data confidentiality and integrityBlock or alert on suspicious or malicious data transfers, such as unauthorized uploads,downloads, or sharing of data to external sources or devices Audit and report on data activities and incidents, and provide evidence for compliance with data protection regulations and standards, such as GDPR, HIPAA, or PCI-DSS4 References = What is SaaS?, Top 7 SaaS Security Risks (and How to Fix Them), What is Data Loss Prevention (DLP)?, Data Loss Prevention (DLP) for SaaS Applications
The risk appetite for an organization could be derived from which of the following?
Answer(s): A
According to the CRISC Review Manual1, cost of controls is the amount of money or resources that an organization is willing to spend to implement and maintain risk responses. Cost of controls is one of the factors that influences the risk appetite of an organization, as it reflects thetrade-off between the benefits and costs of risk responses. Cost of controls helps to determine the optimal level of risk that an organization can accept in pursuit of its objectives, and to align the risk responses with the organization's strategy, goals, and culture. References = CRISC Review Manual1, page 193.
When an organization's business continuity plan (BCP) states that it cannot afford to lose more than three hours of a critical application's data, the three hours is considered the application's:
TheRecovery Point Objective (RPO)specifies the maximum tolerable period in which data might be lost due to an incident. In this case, the organization is indicating that it cannot afford to lose more than three hours of data, defining its RPO.
An organization has recently hired a large number of part-time employees. During the annual audit, it was discovered that many user IDs and passwords were documented in procedure manuals for use by the part-time employees. Which of the following BEST describes this situation?
Answer(s): C
Documenting user IDs and passwords in procedure manuals is a vulnerability that exposes the organization to unauthorized access, data breaches, and other security risks. A vulnerability is a weakness or flaw in a system, process, or control that can be exploited by a threat. A threat is a potential cause of an unwanted incident that may harm the system or organization. A risk is the combination of the likelihood and impact of a threat exploiting a vulnerability. A policy violation is an act of non-compliance with a rule or standard that is established by the organization. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 67.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.