Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

ISACA CRISC Exam Questions
Certified in Risk and Information Systems Control (Page 49 )

Updated On: 24-Feb-2026
Page 49 of 380
PDF with 1895 Questions

Which of the following changes would be reflected in an organization's risk profile after the failure of a critical patch implementation?

  1. Risk appetite is decreased.
  2. Inherent risk is increased.
  3. Risk tolerance is decreased.
  4. Residual risk is increased.

Answer(s): D

Explanation:

Residual risk is the level of risk that remains after applying controls or other risk treatments. A critical patch is a type of control that aims to reduce the risk of a known vulnerability being exploited by attackers. If the patch implementation fails, the control is ineffective and the risk is not reduced. Therefore, the residual risk is increased, as the organization is still exposed to the potential negative consequences of the vulnerability.


Reference:

·ISACA, Risk and Information Systems Control Review Manual, 7th Edition, 2020, p. 2111 ·ISACA, Practical Patch Management and Mitigation2



An organization is making significant changes to an application. At what point should the application risk profile be updated?

  1. After user acceptance testing (UAT)
  2. Upon release to production
  3. During backlog scheduling
  4. When reviewing functional requirements

Answer(s): D

Explanation:

The application risk profile should be updated when reviewing functional requirements. This will help to identify and assess the potential risks that may arise from the changes to the application, and to plan and implement appropriate risk responses. Updating the application risk profile at this stage will also help to ensure that the changes are aligned with the organization's objectives, policies, and standards, and that they meet the stakeholders' expectations and needs. Updating the application risk profile after user acceptance testing, upon release to production, or during backlog scheduling are not the best points to update the risk profile, as they may be too late or too early to capture the relevant risks and their impacts. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.1, page 511
1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 655.



Which of the following should be the GREATEST concern to a risk practitioner when process documentation is incomplete?

  1. Inability to allocate resources efficiently
  2. Inability to identify the risk owner
  3. Inability to complete the risk register
  4. Inability to identify process experts

Answer(s): B

Explanation:

The greatest concern for a risk practitioner when process documentation is incomplete is the inability to identify the risk owner. The risk owner is the person or entity that has the authority and responsibility to manage a specific risk or a group of related risks. The risk owner helps to identify, assess, and respond to the risks, and to monitor and report on the risk performance and improvement. The risk owner also helps to communicate and coordinate the risk management activities with the relevant stakeholders, such as the board, management, business units, and IT functions. The risk owner is usually identified in the process documentation, which describes the roles, responsibilities, procedures, and resources for each process. The inability to identify the risk owner is a major concern for the risk practitioner, because it may affect the accountability, transparency, and effectiveness of the risk management process, and may lead to confusion, conflicts, or gaps in the risk management activities. The other options are not as concerning as the inability to identify the risk owner, although they may also pose some difficulties or limitations for the risk management process. Inability to allocate resources efficiently, inability to complete the risk register, and inability to identify process experts are all factors that could affect the quality and timeliness of the risk management process, but they do not necessarily affect the authority and responsibility of the risk management process. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 2-11.



Which of the following is a risk practitioner's MOST important responsibility in managing risk acceptance that exceeds risk tolerance?

  1. Verify authorization by senior management.
  2. Increase the risk appetite to align with the current risk level
  3. Ensure the acceptance is set to expire over lime
  4. Update the risk response in the riskregister.

Answer(s): A

Explanation:

The risk practitioner's most important responsibility in managing risk acceptance that exceeds risk tolerance is to verify authorization by senior management. Risk acceptance is a risk response strategy that involves acknowledging and agreeing to bear the risk and its potential consequences. Risk tolerance is the acceptable or allowable level of variation or deviation from the expected or desired outcomes or objectives.
When the risk acceptance exceeds the risk tolerance, it means that the organization is taking on more risk than it can handle or afford. Therefore, the risk practitioner should verify that the risk acceptance is authorized by senior management, who have the authority and accountability for making risk management decisions and ensuring that they are aligned with the organizational strategy and objectives. The other options are not as important as verifying authorization by senior management, as they are related to the adjustments, conditions, or documentation of the risk acceptance, not the approval or validation of the risk acceptance. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.2: IT Risk Response Options, page 133.



Which of the following would provide the MOST comprehensive information for updating an organization's risk register?

  1. Results of the latest risk assessment
  2. Results of a risk forecasting analysis
  3. A review of compliance regulations
  4. Findings of the most recent audit

Answer(s): A

Explanation:

A risk register is a document that is used as a risk management tool to identify and track risks that may affect a project or an organization1. A risk register should be updated regularly to reflect the current status and changes of the risks, as well as the actions taken to mitigate or resolve them2. The most comprehensive information for updating a risk register would come from the results of the latest risk assessment, which is a process that involves identifying, analyzing, and evaluating the risks and their potential impacts3. A risk assessment provides a detailed and systematic overview of the risks, theirsources, causes, likelihood, severity, and consequences, as well as the existing and planned controls andresponses4. A risk assessment also helps to prioritize the risks based on their level of exposure and urgency, and to align them with the organization's risk appetite and tolerance5. Therefore, the results of the latest risk assessment would provide the most relevant and complete information for updating a risk register and ensuring that it reflects the current risk profile and situation of the project or the organization. Results of a risk forecasting analysis are not the most comprehensive information for updating a risk register, as they do not provide a complete picture of the risks and their impacts. A risk forecasting analysis is a technique that uses historical data, trends, and scenarios to estimate the potential outcomes and impacts of future events that may affect the organization's objectives and performance6. A risk forecasting analysis can help to anticipate and prepare for the risks, but it does not provide specific information on the sources, causes, likelihood, severity, and consequences of the risks, nor the existing and planned controls and responses. A review ofcompliance regulations is not the most comprehensive information for updating a risk register, as it does not cover all the aspects and dimensions of risk management. A review of compliance regulations is a process that involves checking and verifying that the organization's activities, processes, and systems are in accordance with the applicable laws, rules, and standards7. A review of compliance regulations can help to identify and mitigate the risks related to legal or regulatory violations, but it does not provide specific information on the other types and sources of risks, such as operational, strategic, financial, or reputational risks, nor the existing and planned controls and responses. Findings of the most recent audit are not the most comprehensive information for updating a risk register, as they do not provide a current and holistic view of the risks and their impacts. An audit is an independent examination and evaluation of the organization's activities, processes, and systems, to provide assurance and advice on their adequacy and effectiveness. An audit can help to identify and report the issues or gaps in the organization's risk management, but it does not provide specific information on the current status and changes of the risks, nor the existing and planned controls and responses. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.






Post your Comments and Discuss ISACA CRISC exam dumps with other Community members:

Join the CRISC Discussion