Which of the following is a PRIMARY objective of privacy impact assessments (PIAs)?
Answer(s): D
Which of the following should a risk practitioner review FIRST when evaluating risk events associated with the organization's data flow model?
Answer(s): A
What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner's business impact analysis (BIA)?
Answer(s): B
Determining the business purpose of the application is the first thing that a risk practitioner should do when a shadow IT application is identified in a business owner's business impactanalysis (BIA), because it helps to understand the rationale and value of the application, and the potential risks and issues that it may introduce or affect. A shadow IT application is an IT system or application that is used by the business units or employees without the knowledge or approval of the IT department or management. A shadow IT application may offer benefits such as convenience, efficiency, or innovation, but it may also pose risks such as security breaches, data loss, compatibility issues, or regulatory non- compliance. A BIA is a process of analyzing the potential impact of disruption to the critical business functions or processes, and identifying the recovery priorities and requirements. A BIA may reveal the existence of ashadow IT application, as it may be used to support or enable a critical business function or process. Determining the business purpose of the application is the first thing to do, as it helps to evaluate the necessity and suitability of the application, and to plan the appropriate actions to address the shadow IT application. Including the application in the business continuity plan (BCP), segregating the application from the network, and reporting the finding to management are all possible things to do after determining the business purpose of the application, but they are not the first thing to do, as they depend on the results of the evaluation of the application. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 143
Which of the following is the MOST important objective of an enterprise risk management (ERM) program?
The most important objective of an enterprise risk management (ERM) program is to create a comprehensive view of critical risk to the organization, as it enables the organization to identify, assess, and prioritize the key risks that may affect its objectives and strategy, and to implement appropriate risk responses and controls. A comprehensive view of critical risk also helps the organization to align its risk appetite and tolerance with its business goals and value creation, and to enhance its risk culture and governance. A comprehensive view of critical risk can be achieved by integrating risk management across all levels and functions of the organization, and by using consistent and reliable risk information and reporting. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 242. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 242. CRISC Sample Questions 2024, Question 242.
A risk practitioner identifies a database application that has been developed and implemented by the business independently of IT. Which of the following is the BEST course of action?
Answer(s): C
The best course of action when a risk practitioner identifies a database application that has been developed and implemented by the business independently of IT is to include the application in IT risk assessments. IT risk assessments are the process of identifying,analyzing, and evaluating the IT-related risks that could affect the achievement of the enterprise's objectives. By including the application in IT risk assessments, the risk practitioner can identify the potential threats, vulnerabilities, and impacts associated with the application, and recommend the appropriatecontrols and mitigation strategies to reduce the risk to an acceptable level. Escalating the concern to senior management, documenting the reasons for the exception, and proposing that the application be transferred to IT are not the best courses of action, as they do not address the risk exposure and impact of the application, and may not be feasible or desirable for the business. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 47.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.