Which of the following BEST helps to identify significant events that could impact an organization?Vulnerability analysis
Answer(s): B
A legacy application used for a critical business function relies on software that has reached the end of extended support Which of the following is the MOST effective control to manage this application?
Answer(s): C
Segmenting the application within the existing network is the most effective control to manage a legacy application that relies on software that has reached the end of extended support, as it isolates the application from the rest of the network and reduces the attack surface and the potential impact of a compromise. Subscribing to threat intelligence, applying patches for a newer version of the application, and increasing the frequency of regular system and data backups are not the most effective controls, as theymay not address the root cause of the risk, or may introduce additional costs or complexities,respectively. References = CRISC Review Manual, 7th Edition, page 153.
The MOST important characteristic of an organization s policies is to reflect the organization's:
An organization's policies are the set of rules and guidelines that define the organization's objectives, expectations, and responsibilities for its activities and operations. They provide the direction and framework for the organization's governance, risk management, and compliance functions.The most important characteristic of an organization's policies is to reflect the organization's risk appetite, which is the amount and type of risk that the organization is willing to accept in pursuit of its goals. The risk appetite is usually expressed as a range or a threshold, and it is aligned with the organization's strategy and culture. Reflecting the organization's risk appetite in its policies ensures that the policies are consistent, appropriate, and proportional to the level and nature of the risks that the organization faces, and that they support the organization's objectives and values. It also helps to optimize the balance between risk and return, and to create and protect value for the organization and its stakeholders.The other options are not the most important characteristic of an organization's policies, because they do not address the fundamental question of whether the policies are suitable and acceptable for the organization.The risk assessment methodology is the process of identifying, analyzing, and evaluating the risks that may affect the organization's objectives and operations. It involves determining the likelihood and impact of various risk scenarios, and prioritizing them based on their significance and urgency. The risk assessment methodology is important to inform and support the organization's policies, but it is not the most important characteristic of the policies, because it does not indicate whether the policies are aligned with the organization's risk appetite.The capabilities are the resources and abilities that the organization has or can acquire to achieve its objectives and manage its risks. They include the people, processes, technologies,and assets that the organization uses or relies on. The capabilities are important to enable and implement theorganization's policies, but they are not the most important characteristic of the policies, because they do not indicate whether the policies are aligned with the organization's risk appetite.The asset value is the worth or importance of the assets that the organization owns or controls, and that may be affected by the risks that the organization faces. The assets include the tangible and intangible resources that the organization uses or relies on, such as data, information, systems, infrastructure, reputation, etc. The asset value is important to measure and monitor the organization's policies, but it is not the most important characteristic of the policies, because itdoes not indicate whether the policies are aligned with the organization's risk appetite. References =ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 29-30, 34-35, 38-39, 44-45, 50-51, 54-55ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 148 CRISC Practice Quiz and Exam Prep
Which of the following is MOST helpful in providing a high-level overview of current IT risk severity*?
A heat map is a graphical tool that displays the level of risk severity for various risk scenarios or categories using different colors, shapes, or sizes. A heat map is most helpful in providing a high-level overview of current IT risk severity, as it can show the relative importance and urgency of the risks, and highlight the areas that require attention or action. A heat map can also help to communicate the risk information to the stakeholders, and facilitate the risk prioritization and decision making. References = 5
The PRIMARY benefit of classifying information assets is that it helps to:
Answer(s): D
Classifying information assets is a process of identifying and categorizing the data and information resources that are owned, controlled, or used by an organization, based on their value, sensitivity, and criticality.Classifying information assets helps to determine the appropriate level of control that is needed to protect them from unauthorized access, use, disclosure, modification, or destruction. Control level refers to the degree of protection or assurance that a control provides against a risk.Classifying information assets also helps to communicate risk to senior management, assign risk ownership, and facilitate internal audit. These are other benefits of risk management that are not directly related to determining the appropriate level of control.The references for this answer are:Risk IT Framework, page 11Information Technology & Security, page 5Risk Scenarios Starter Pack, page 3
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.