In addition to the risk exposure, which of the following is MOST important for senior management to understand prior to approving the use of artificial intelligence (Al) solutions?
Answer(s): A
Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?
The primary reason for sharing risk assessment reports with senior stakeholders is to support decision-making for risk response. Risk assessment reports are documents that summarize the results of the risk assessment process, such as the risk sources, causes, impacts, likelihood, and levels. Risk assessment reports also provide recommendations for risk response options, such as avoiding, reducing, transferring, or accepting the risk. Sharing risk assessment reports with senior stakeholders helps to inform them of the current risk situation, and to solicit their input, feedback, or approval for the risk response actions. The other options are not the primary reason for sharing risk assessment reports, although they may be secondary reasons or outcomes. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 4-13.
An organization's senior management is considering whether to acquire cyber insurance. Which of the following is the BEST way for the risk practitioner to enable management's decision?
Acost-benefit analysisevaluates the financial implications of acquiring cyber insurance versus the potential loss exposure. This approach enables informed decision-making by comparing the insurance cost with the potential savings from covered risks.
Which of the following is the GREATEST risk of relying on artificial intelligence (Al) within heuristic security systems?
Answer(s): B
AI in Heuristic Security Systems:Heuristic security systems use artificial intelligence (AI) to identify and respond to potential threats by learning from data patterns and behaviors.Risk of Misclassification:During the baselining process, AI systems establish what is considered normal behavior. If malicious activity is present during this period, it may be incorrectly classified as normal. This misclassification can lead to undetected security breaches, as the system will not recognize these activities as threats in the future.Impact of Misclassification:Misclassified malicious activities can lead to significant security risks, allowing attackers to operate undetected within the system.It undermines the effectiveness of the heuristic system, reducing its ability to protect the organization from real threats.Comparing Other Risks:Less Reliance on Human Intervention:This is a general concern but does not directly impact the accuracy of threat detection.Difficulty in Risk Assessments:While a challenge, it is not the greatest risk compared to misclassification of malicious activity.Outdated Patterns:While a concern, the primary risk lies in initial misclassification during baselining.
The CRISC Review Manual discusses the challenges of AI in security systems, particularly the risk of misclassification during the learning phase (CRISC Review Manual, Chapter 4:Information Technology and Security, Section 4.7.4 Artificial Intelligence) .
A risk practitioner has determined that a key control does not meet design expectations.Which of the following should be done NEXT?
The next step after determining that a key control does not meet design expectations is to document the finding in the risk register, because this helps to record and track the information about the identified risk, such as its description, likelihood, impact, response, and status. A key control is a control that addresses a significant risk or supports a critical business process or objective. A control design expectation is a criterion or requirement that defines how the control should operate or perform to achieve its objective. If a key control does not meet its design expectation, it means that there is a gap, weakness, or deficiency in the control that may compromise its effectiveness or efficiency, and increase the risk exposure or impact. By documenting the finding in the risk register, the risk practitioner can communicate and report the risk issue to the relevant stakeholders, such as the risk owner, the management, or the auditor, and initiate the appropriate risk response actions, such as modifying the design of the control, implementing a compensating control, or accepting the risk. The other options are not the best next steps after determining that a key control does not meet design expectations. Invoking the incident response plan is a reactive measure that is triggered when a risk event occurs or is imminent, and requires immediate action to contain, mitigate, or recover from the incident. However, in this case, the risk event has not occurred yet, and there may be time to prevent or reduce it by improving the control design. Re-evaluating key risk indicators is a monitoring activity that measures and evaluates the level and impact of risks, and provides timely signals that something may be going wrong or needs urgent attention. However, in this case, the risk practitioner has already identified the risk issue, and needs to document and address it, rather than re-evaluate it. Modifying the design of the control is a possible risk response action that may be taken to improve the control and reduce the risk, but it is not the next step after determining that the key control does not meet design expectations. The next step is to document the finding in the risk register, and then decide on the best risk response action, which may or may not be modifying the design of the control, depending on the cost-benefit analysis, the risk assessment, and the risk response strategy. References = Risk IT Framework, ISACA, 2022, p. 13
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.