Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

Free ISACA CRISC Exam Questions (page: 24)

Page 24 of 238
PDF with 1895 Questions

The risk associated with a high-risk vulnerability in an application is owned by the:

  1. security department.
  2. business unit
  3. vendor.
  4. IT department.

Answer(s): B

Explanation:

A high-risk vulnerability in an application is a system flaw or weakness in the application's code that can be exploited by a malicious actor, potentially leading to a security breach. The risk associated with a high-risk vulnerability in an application is the possibility and impact of such a breach occurring. The risk owner of a high-risk vulnerability in an application is the person or entity who has the authority and responsibility for managing the risk. The risk owner should be able to define the risk appetite, assess the risk level, select and implement the risk response, monitor and report the risk status, and ensure the risk alignment with the business objectives and strategy. The risk owner of a high-risk vulnerability in an application is the business unit, which is the organizational unit that operates the application and derives value from it. The businessunit understands the business needs and expectations of the application, and the potential consequences of a security breach. The business unit also has the resources and incentives to address the risk effectively and efficiently. Therefore, the business unit is the most appropriate risk owner of a high-risk vulnerability in an application. References = Why Assigning a Risk Owner is Important and How to Do It Right, CRISC 351-400 topic3, Foundations of Project Management : Week 2.



Which of the following is the GREATEST benefit when enterprise risk management (ERM) provides oversight of IT risk management?

  1. Aligning IT with short-term and long-term goals of the organization
  2. Ensuring the IT budget and resources focuson risk management
  3. Ensuring senior management's primary focus is on the impact of identified risk
  4. Prioritizing internal departments that provide service to customers

Answer(s): A

Explanation:

Enterprise risk management (ERM) is a holistic and strategic approach to managing the risks that an organization faces across its various functions, processes, and activities. ERM aims to align the organization's risk appetite and tolerance with its objectives and vision, and to optimize the value and performance of the organization1. IT risk management is a subset of ERM that focuses on identifying, assessing, and mitigating the risks related to the use of information technology (IT) in the organization. IT risk management aims to ensure the confidentiality, integrity, and availability of IT resources and information, and to support the IT governance and strategy of the organization2. The greatest benefit when ERM provides oversight of IT risk management is aligning IT with short-term and long-term goals of the organization, because it can help to:
Integrate IT risk management with the overall business strategy and risk management, and ensure that IT risks are considered and addressed at the enterprise level Align IT risk appetite and tolerance with the business risk appetite and tolerance, and ensure that IT risks are balanced with the expected benefits and opportunities Enhance IT risk awareness and communication among the stakeholders, and ensure that IT risks are reported and escalated appropriately
Optimize IT risk response and control, and ensure that IT risks are managed efficiently and effectively
Demonstrate IT risk value and impact, and ensure that IT risks are measured and monitored against the business objectives and performance34
The other options are not the greatest benefit when ERM provides oversight of IT risk management, but rather some of the outcomes or consequences of it. Ensuring the IT budget and resources focus on risk management is a benefit that can help to allocate and prioritize the IT resources and funds according to the IT risk level and the business needs. Ensuring senior management's primary focus is on the impact of identified risk is a benefit that can help to increase the senior management's involvement and accountability in IT risk management, and to support the IT risk decision making and reporting. Prioritizing internal departments that provide service to customers is a benefit that can help to improve the quality and efficiency of the IT service delivery and customer satisfaction. References = Enterprise Risk Management - ISACA
IT Risk Management - ISACA
Aligning IT risks with Enterprise Risk Management (ERM) Five Benefits of Enterprise Risk Management : Articles : Resources ...
[CRISC Review Manual, 7th Edition]



Which of the following would be MOST important for a risk practitioner to provide to the internal audit department during the audit planning process?

  1. Closed management action plans from the previous audit
  2. Annual risk assessment results
  3. An updated vulnerability management report
  4. A list of identified generic risk scenarios

Answer(s): B

Explanation:

The audit planning process is the process of defining and describing the scope, objectives, and approach of the internal audit that is performed to assess and evaluate the adequacy and effectiveness of the organization's governance, risk management, and control functions. The audit planning process involves identifying and prioritizing the audit areas, topics, or issues, and allocating the audit resources, time, and budget. The most important information for a risk practitioner to provide to the internal audit department during the audit planning process is the annual risk assessment results, which are the outcomes or outputs of the risk assessment process that measures and compares the likelihood and impact of various risk scenarios, and prioritizes them based on their significance and urgency. The annual risk assessment results can help the internal audit department to plan the audit by providing the following information:
The level and priority of the risks that may affect the organization's objectives and operations, and the potential consequences or impacts that they may cause for the organization if they materialize.
The gap or difference between the current and desired level of risk, and the extent or degree to which the risk responses or controls contribute to or affect the gap or difference. The cost-benefit or feasibility analysis of the possible actions or plans to address or correct the risks and their responses, and the expected or desired outcomes or benefits that they may provide for the organization.
The other options are not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because they do not provide the same level of detail and insight that the annual risk assessment results provide, and they may not be relevant or actionable for the internal audit department. Closed management action plans from the previous audit are the actions or plans that have been implemented or completed by the management to address or correct the findings or recommendations from the previous internal audit that was performed. Closed management action plans from the previous audit can provide useful information on the progress and performance of the management in improving and optimizing the organization's governance, risk management, and control functions, but they are not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because they do not indicate the current or accurate state and performance of the organization's risk profile, and they may not cover all the relevant or emerging risks that may exist or arise.
An updated vulnerability management report is a report that provides the information and status of the vulnerabilities or weaknesses in the organization's assets, processes, or systems that can be exploited or compromised by the threats or sources of harm that may affect the organization's objectives or operations. An updated vulnerability management report can provide useful information on the existence and severity of the vulnerabilities, and the actions or plans to mitigate or prevent them, but it is not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because it does not indicate the likelihood and impact of the risk scenarios that are associated with the vulnerabilities, and the potential consequences or impacts that they may cause for the organization.
A list of identified generic risk scenarios is a list that contains the descriptions or representations of the possible or hypothetical situations or events that may cause or result in a risk for the organization, without specifying the details or characteristics of the risk source, event, cause, orimpact. A list of identified generic risk scenarios can provide useful information on the types or categories of the risks that may affect the organization, but it is not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because it does not indicate the level and priority of the risks, and the potential consequences or impacts that they may cause for the organization. References =
ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63
ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 188 CRISC Practice Quiz and Exam Prep



Which of the following is the MOST important objective of establishing an enterprise risk management (ERM) function within an organization?

  1. To have a unified approach to risk management across the organization
  2. To have a standard risk management process for complying with regulations
  3. To optimize risk management resources acrossthe organization
  4. To ensure risk profiles are presented in a consistent format within the organization

Answer(s): A

Explanation:

The most important objective of establishing an enterprise risk management (ERM) function within an organization is to have a unified approach to risk management across the organization. An ERM function is a centralized and coordinated function that oversees and supports the risk management activities of the organization, such as risk identification, assessment, response, monitoring, and reporting. An ERM function helps to ensure that the risk management process is consistent, comprehensive, and integrated with the organization's strategy, objectives, and culture. An ERM function also helps to align the risk management activities with the organization's risk appetite and tolerance, and to provide a holistic view of the organization's risk profile and exposure. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.1.1, page 131



A bank recently incorporated Blockchain technology with the potential to impact known risk within the organization.
Which of the following is the risk practitioner's BEST course of action?

  1. Determine whether riskresponses are still adequate.
  2. Analyze and update control assessments with the new processes.
  3. Analyze the risk and update the risk register as needed.
  4. Conduct testing of the control that mitigate the existing risk.

Answer(s): C



Which of the following should be the PRIMARY input when designing IT controls?

  1. Benchmark of industry standards
  2. Internal and external risk reports
  3. Recommendations from IT risk experts
  4. Outcome of control self-assessments

Answer(s): B

Explanation:

The primary input when designing IT controls should be internal and external risk reports. IT controls are specific activities performed by persons or systems to ensure that business objectives are met, and thatthe confidentiality, integrity, and availability of data and the overall management of the IT function are ensured1. Designing IT controls means creating and implementing the appropriate measures or actions to reduce the likelihood or impact of the IT risks that may affect the organization2. Internal and external risk reports are documents that provide information and analysis on the current and potential IT risks that the organization faces, as well as their sources, drivers, consequences, and responses3. Internal risk reports are generated by the organization itself, such as by the IT risk management function, the internal audit function, or the business units. External risk reports are obtained from external sources, such as regulators, industry associations, or third-party service providers. Internal and external risk reports are the primary input when designing IT controls, because they help to:
Identify and prioritize the IT risks that need to be addressed by the IT controls; Evaluate the likelihood and impact of the IT risks, and compare them against the organization's risk appetite and tolerance;
Determine the most suitable and effective IT control objectives and activities to mitigate the IT risks;
Align the IT control design and implementation with the organization's objectives, strategies, and values;
Monitor and measure the performance and effectiveness of the IT controls in reducing the IT risks. The other options are not the primary input when designing IT controls, as they are either less relevant or less specific than internal and external risk reports. Benchmark of industry standards is a comparison of the organization's IT control practices and performance with those of other organizations in the same industry or sector4. Benchmark of industry standards can help to improve the quality and consistency of the IT control design and implementation, as well as to identify the best practices and gaps. However, benchmark of industry standards is not the primary input when designing IT controls, as it does not address the specific IT risks that the organization faces, or the IT control objectives and activities that are appropriate and effective for the organization. Recommendations from IT risk experts are the suggestions or advice from the professionals or specialists who have the knowledge and experience in IT risk management and IT control design and implementation5. Recommendations from IT risk experts can help to enhance the IT control design and implementation, as well as to provide guidance and support to the organization. However, recommendations from IT risk experts are not the primary inputwhen designing IT controls, as they are based on the opinions and perceptions of the experts, and may not reflect the actual or objective level and nature of the IT risks, or the IT control objectives and activities that are suitable and efficient for the organization. Outcome of control self-assessments is the result or conclusion of the evaluation and testing of the design and operation of the existingIT controls by the organization itself, such as by the IT control owners, the IT risk management function, or the business units6. Outcome of control self-assessments can help to improve the IT control design and implementation, as well as to detect and correct any issues or deficiencies. However, outcome of control self-assessments is not the primary input when designing IT controls, as it does not cover the new or emerging IT risks that the organization may face, or the IT control objectives and activities that are relevant and necessary for the organization. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1, Page 189.



An organization has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data.
What should be The FIRST course of action?

  1. Invoke the incident response plan.
  2. Determine the business impact.
  3. Conduct a forensic investigation.
  4. Invoke the business continuity plan (BCP).

Answer(s): A

Explanation:

The first course of action for an organization that has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data is to invoke the incident response plan. An incident response plan is a set of procedures and guidelines that defines the roles and responsibilities of the incident response team, the communication and escalation channels, the incident identification and classification criteria, the incident containment and eradication strategies, the incident recovery and restoration activities, and the incident documentation and reporting requirements. Invoking the incident response plan as soon as possible is crucial to minimize the damage and disruption caused by the cybercrime, to preserve the evidence and facilitate the investigation, and to comply with the legal andregulatory obligations. The other options are not the first course of action, although they may be subsequent or concurrent steps in the incident response process. Determining the business impact is a part of the incident assessment and prioritization phase, which helps to evaluate the severity and scope of the incident and to allocate the appropriate resources and actions. Conducting a forensic investigation is a part of the incident analysis and evidence collection phase, which helps to identify the source and cause of the incident and to support the legal and disciplinary actions. Invoking the business continuity plan (BCP)

is a part of the incident recovery and restoration phase, which helps to resume the normal operations and services and to mitigate the adverse effects of the incident. References = The National Cyber Incident Response Plan (NCIRP), Cyber Incident Response Plan | Cyber.gov.au, [Cyber Incident Response: A Framework for Preparation and Success], [Cyber Incident Response Plan: How to Create One for Your Business]



As pan of business continuity planning, which of the following is MOST important to include m a business impact analysis (BlA)?

  1. An assessment of threats to the organization
  2. An assessment of recovery scenarios
  3. industry standard framework
  4. Documentation of testing procedures

Answer(s): C

Explanation:

As part of business continuity planning, the most important thing to include in a business impact analysis (BIA) is an industry standard framework. A BIA is a process of identifying and analyzing the potential effects of disruptions to the critical business functions and processes. An industry standard framework is a set of best practices, guidelines, and methodologies that provide a consistent and comprehensive approach to conducting a BIA. An industry standard framework can help to ensure that the BIA is complete, accurate, and reliable, and that it covers all the relevant aspects, such as the scope, objectives, criteria, methods, data sources, and reporting. An industry standard framework can also help to benchmark the BIA results against the industry norms and expectations, and to align the BIA with the business continuity strategy and plan. The other options are not as important as an industry standard framework, as they are related to the specific steps, activities, or outputs of the BIA, not the overall structure and quality of the BIA. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.4: Key Control Indicators, page 211.



Viewing page 24 of 238
Viewing questions 185 - 192 out of 1895 questions



Post your Comments and Discuss ISACA CRISC exam prep with other Community members:

CRISC Exam Discussions & Posts