An organization has been experiencing an increasing number of spear phishing attacks Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?
Answer(s): C
A spear phishing attack is a type of cyberattack that targets a specific individual or organization with a fraudulent email that appears to be from a trusted source, and attempts to trick the recipient into clicking amalicious link, opening a malicious attachment, or providing sensitive information. A spear phishing attack can compromise the security, confidentiality, integrity, or availability of the information systems and data of the individual or organization. The most effective way to mitigate the risk associated with spear phishing attacks is to implement a security awareness program, which is a program that educates and trains the employees and stakeholders of the organization about the security policies, procedures, and best practices, and the potential threats and risks that may affect the organization. A security awareness program can help to prevent or reduce the success of spear phishing attacks, as it can increase the knowledge and skills of the employees and stakeholders to recognize and avoid the fraudulent emails, and to report and respond to any suspicious or malicious activities. References = CRISC Review Manual, 7th Edition, page 181.
An organization's IT infrastructure is running end-of-life software that is not allowed without exception approval. Which of the following would provide the MOST helpful information to justify investing in updated software?
Answer(s): B
A cost-benefit analysis is a tool that compares the costs and benefits of different alternatives, such as updating software or continuing to use end-of-life software. A cost-benefit analysis can provide the mosthelpful information to justify investing in updated software, as it can show the potential savings, benefits, and risks of each option, and help the decision-makers choose the best course of action. A cost-benefit analysis can also include qualitative factors, such as security, compliance, performance, and customer satisfaction, that may be affected by the software update. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 231. CRISC by Isaca Actual Free Exam Q&As, Question 8. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 231. CRISC Certified in Risk and Information Systems Control Question231.
The BEST way to improve a risk register is to ensure the register:
Answer(s): A
A risk register is a tool that records and tracks the identified risks, their causes, impacts, probabilities, responses, and owners. It is a living document that should be updated regularly to reflect the changes in therisk environment and the status of the risk responses12. The best way to improve a risk register is to ensure that it is updated based upon significant events, such as:New risks are identified or existing risks are eliminated Risk probabilities or impacts change due to internal or external factors Risk responses are implemented or modifiedRisk owners or stakeholders changeRisk incidents or issues occurRisk thresholds or appetite changeRisk reporting or communication requirements change Updating the risk register based upon significant events can help to:Maintain the accuracy and relevance of the risk information Enhance the risk awareness and accountability of the risk owners and stakeholders Support the risk monitoring and reporting activities Facilitate the risk evaluation and decision-making processes Improve the risk management performance and maturity References =Risk Register - Project Management KnowledgeHow to Create a Risk Register: A Step-by-Step Guide - ProjectManager.com
Who is accountable for authorizing application access in a cloud Software as a Service (SaaS) solution?
Answer(s): D
The business unit owner is accountable for authorizing application access in a SaaS environment because they are responsible for aligning access controls with business needs.They determine the roles and permissions needed to ensure operational effectiveness while adhering to the principle ofAccess Managementin the CRISC framework.
Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented. Which risk treatment has been selected?
Risk avoidance involves ceasing activities that expose the organization to significant risks, such as shutting down the sales order system. This decision aligns withRisk Treatment Strategiesaimed at eliminating exposure.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.