QUESTION: 61

Which of the following is the BEST way to ensure that outsourced service providers comply with the enterprise's information security policy?

Penetration testing
Service level monitoring
Security awareness training
Periodic audits

Answer(s): D

Explanation:

As regular audits can spot gaps in information security compliance, periodic audits can ensure that outsourced service provider comply with the enterprise's information security policy.

Incorrect Answers:
A: Penetration testing can identify security vulnerability, but cannot ensure information compliance.

B: Service level monitoring can only identify operational issues in the enterprise's operational environment. It does not play any role in ensuring that outsourced service provider complies with the enterprise's information security policy.

C: Training can increase user awareness of the information security policy, but is less effective than periodic auditing.

Reveal Solution Next Question

QUESTION: 62

You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk, the response adopted is re- architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?

Deferrals
Quick win
Business case to be made
Contagious risk

Answer(s): C

Explanation:

This is categorized as a Business case to be made because the project cost is very large. The response to be implemented requires quite large investment. Therefore it comes under business case to be made.

Incorrect Answers:
A: It addresses costly risk response to a low risk. But here the response is less costly than that of business case to be made.

B: Quick win is very effective and efficient response that addresses medium to high risk. But in this the response does not require large investments.

D: This is not risk response prioritization option, instead it is a type of risk that happen with the several of the enterprise's business partners within a very short time frame.

Reveal Solution Next Question

QUESTION: 63

Which of the following BEST ensures that a firewall is configured in compliance with an enterprise's security policy?

Interview the firewall administrator.
Review the actual procedures.
Review the device's log file for recent attacks.
Review the parameter settings.

Answer(s): D

Explanation:

A review of the parameter settings will provide a good basis for comparison of the actual configuration to the security policy and will provide reliable audit evidence documentation.

Incorrect Answers:
A: While interviewing the firewall administrator may provide a good process overview, it does not reliably confirm that the firewall configuration complies with the enterprise's security policy.

B: While procedures may provide a good understanding of how the firewall is supposed to be managed, they do not reliably confirm that the firewall configuration complies with the enterprise's security policy.

C: While reviewing the device's log file for recent attacks may provide indirect evidence about the fact that logging is enabled, it does not reliably confirm that the firewall configuration complies with the enterprise's security policy.

Reveal Solution Next Question

QUESTION: 64

Which of following is NOT used for measurement of Critical Success Factors of the project?

Productivity
Quality
Quantity
Customer service

Answer(s): C

Explanation:

Incorrect Answers:
A, B, D: Productivity, quality and customer service are used for evaluating critical service factor of any particular project.

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 17)

QUESTION: 61

Explanation:

QUESTION: 62

Explanation:

QUESTION: 63

Explanation:

QUESTION: 64

Explanation:

CRISC Discussions & Posts