Which of the following BEST mitigates the risk associated with inadvertent data leakage by users who work remotely?
Answer(s): D
Providing encrypted access to organizational assets is the best method to mitigate the risk of inadvertent data leakage by remote workers. Encryption ensures that data remains secure, even if accessed over unsecured networks.
Which of the following is the MOST effective way to integrate risk and compliance management?
Answer(s): C
Embedding risk management into processes that are aligned with business drivers is the most effective way to integrate risk and compliance management, as it ensures that the risk management objectives and activities are consistent and supportive of the enterprise's strategic goals and values. It also enables the identification and management of risks and compliance requirements across the enterprise, and the optimization of risk and compliance resources and performance. Embedding risk management into compliance decision-making, designingcorrective actions to improve risk response capabilities, and conducting regular self-assessments to verify compliance are not ways to integrate risk and compliance management, but rather components or outcomes of the risk and compliance management process. References = CRISC Practice Quiz and Exam Prep; CRISC: Certified in Risk & Information Systems Control Sample Questions, question 202.
Which of the following should be the FIRST course of action if the risk associated with a new technology is found to be increasing?
Answer(s): B
A risk action plan is a document that outlines the actions to be taken to mitigate or avoid a risk. A risk action plan should be revised when the risk associated with a new technology is found to be increasing, as this indicates that the current plan is not effective or sufficient. Revising the risk action plan can help identify the root causes of the risk increase, evaluate the effectiveness of current controls, and implement additional or alternative controls as needed. Re-evaluatingcurrent controls, escalating the risk to senior management, and implementing additional controls are possible steps in the revision process, but they are not the first course of action. The first course of action should be to update the risk action plan to reflect the current risk situation and the appropriate risk response.
Senior management is deciding whether to share confidential data with the organization's business partners. The BEST course of action for a risk practitioner would be to submit a report to senior management containing the:
Answer(s): A
The best course of action for a risk practitioner when senior management is deciding whether to share confidential data with the organization's business partners is to submit a report to senior management containing the possible risk and suggested mitigation plans. A risk practitioner is a professional who is responsible for identifying, assessing, and managing the risks that could affect the organization's objectives or operations. A risk practitioner should provide senior management with the information and guidance they need to make informed and effective decisions regarding the sharing of confidential data. A risk practitioner should submit a report that outlines the possible risk scenarios, such as data loss, theft, or compromise, and theirlikelihood and impact. A risk practitioner should also suggest mitigation plans, such as encryption, access control, monitoring, or contractual agreements, that could reduce or transfer the risk. The other options are not as effective as submitting a report containing the possible risk and suggested mitigation plans, although they may be part of or derived from the report. Designing controls to encrypt the data to be shared, developing a project plan for classification of the data, and summarizing the data protection and privacy legislation are all activities or outcomes that could be included or referenced in thereport, but they are not the best course of action for a risk practitioner. References = CISA Review Manual, 27th Edition, Chapter 2, Section 2.3.1, page 2-23
Employees are repeatedly seen holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges. This behavior BEST represents:
A vulnerability is a weakness or flaw that can be exploited by a threat to cause harm or damage to an asset. Employees holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges, is a behavior that best represents a vulnerability, as itbypasses the security control of the ID badge system, and allows unauthorized or unauthenticated access to the premises. This behavior can increase the risk of physical or logical security breaches, such as theft, vandalism, sabotage, or espionage. References = CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 258. Most Asked CRISC Exam Questions and Answers, Question10. ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 258. CRISC by Isaca Actual Free Exam Q&As, Question 9.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.