Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

ISACA CRISC Exam Questions
Certified in Risk and Information Systems Control (Page 32 )

Updated On: 24-Feb-2026
Page 32 of 380
PDF with 1895 Questions

Which of the following provides the BEST assurance of the effectiveness of vendor security controls?

  1. Review vendor control self-assessments (CSA).
  2. Review vendor service level agreement (SLA) metrics.
  3. Require independent control assessments.
  4. Obtain vendor references from existing customers.

Answer(s): C

Explanation:

The best way to provide assurance of the effectiveness of vendor security controls is to require independent control assessments. Independent control assessments are evaluations of thevendor's security controls by a third-party auditor or assessor, such as an external auditor, a certification body, or a testing laboratory. Independent control assessments provide an objective and unbiased opinion on the adequacy and performance of the vendor's security controls, as well as the compliance with relevant standards and regulations. Independent control assessments can also provide evidence and assurance to the customers of the vendor's security posture and capabilities. Reviewing vendor control self-assessments (CSA), vendor service level agreement(SLA) metrics, or vendor references from existing customers are not as reliable or credible as independent control assessments, because they may be biased, incomplete, or outdated.



A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software.
Which of the following should be the risk practitioner's IMMEDIATE concern?

  1. Multiple corporate build images exist.
  2. The process documentation was not updated.
  3. The IT build process was not followed.
  4. Threats are not being detected.

Answer(s): D



Which of the following is the BEST method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system?

  1. Vulnerability scanning
  2. Systems log correlation analysis
  3. Penetration testing
  4. Monitoring of intrusion detection system (IDS) alerts

Answer(s): C

Explanation:

Penetration testing is the best method for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system, as it simulates areal-world attack scenario and evaluates the security posture of the system. Penetration testing is a type of security testing that involves performing authorized and ethical hacking activities on a system to identify and exploit its vulnerabilities and weaknesses. Penetration testing can help to measure and improve the effectiveness and efficiency of the controls implemented to protect the system from unauthorized access, modification, or damage. The other options are not the best methods for assessing control effectiveness against technical vulnerabilities that could be exploited to compromise an information system. Vulnerability scanning is an automated process that uncovers potential vulnerabilities in systems and software, but it does not provide information on the impact and severity of the vulnerability or how they can be exploited using different exploitation techniques1. Systems log correlation analysis is a process of examining and analyzing the records of system activities and events, but it does not directly test the controls or simulate the attack scenarios. Monitoring of intrusion detection system (IDS) alerts is a process of tracking and auditing the system or network for any signs of malicious or anomalous activities, but it does not evaluate the control performance or identify the root causes of the vulnerabilities. References = Vulnerability Assessment Principles | Tenable®, A Complete Guide on Vulnerability Assessment Methodology, Karen Scarfone Scarfone Cybersecurity - NIST Computer Security Resource ...



An organization has four different projects competing for funding to reduce overall IT risk.
Which project should management defer?

  1. Project Charlie
  2. Project Bravo
  3. Project Alpha
  4. Project Delta

Answer(s): D

Explanation:

Project Delta should be deferred by management, as it has the lowest return on investment (ROI) among the four competing projects. ROI is a measure of the profitability or efficiency of a project, calculated by dividing the net benefits by the total costs. Project Delta has a net benefit of $100,000 and a total cost of $200,000, resulting in an ROI of 0.5. The other projects have higher ROIs: Project Alpha has an ROI of 1.0, Project Bravo has an ROI of 0.8, and Project Charlie has an ROI of 0.6. Therefore, Project Delta is the least attractive option for reducingoverall IT risk, and management should prioritize the other projects instead. References = How to Manage Project Risk: A 5-Step Guide; Matching the right projects with the right resources; Risk Types in Project Management



An organization has established workflows in its service desk to support employee reports of security-related concerns.
Which of the following is the MOST efficient approach to analyze these concerns?

  1. Map concerns to organizational assets.
  2. Sort concerns by likelihood.
  3. Alignconcerns to key vendors.
  4. Prioritize concerns based on frequency of reports.

Answer(s): D

Explanation:

Prioritizing concerns based on frequency of reports is the most efficient approach to analyze the security-related concerns reported by employees, because it helps to identify and focus on the most common or recurring issues that may pose the highest risk or impact to the organization. A security-related concern is a potential or actual problem or threat that may affect the confidentiality, integrity, or availability of the organization's IT systems or data. A service desk is a function that provides a single point of contact for users to report and resolve their IT-related issues or requests. A workflow is a sequence of steps or tasks that are performed to achieve a specific goal or outcome. A workflow for supporting employee reports of security-related concerns may include capturing, categorizing, prioritizing, assigning, and resolving the concerns. Prioritizing concerns based on frequency of reports is the most efficient approach, as it helps to optimize the use of resources and time, and to reduce the likelihood and severity of security incidents or breaches. Mapping concerns to organizational assets, sorting concerns by likelihood, and aligning concerns to key vendors are all possible approaches to analyze the security-related concerns, but they are not the most efficient approach, as they may require more data collection, analysis, or coordination, and may not reflect the urgency or importance of the concerns. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.2, page 200






Post your Comments and Discuss ISACA CRISC exam dumps with other Community members:

Join the CRISC Discussion