Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

ISACA CRISC Exam Questions
Certified in Risk and Information Systems Control (Page 6 )

Updated On: 21-Feb-2026
Page 6 of 380
PDF with 1895 Questions

Which type of indicators should be developed to measure the effectiveness of an organization's firewall rule set?

  1. Key risk indicators (KRIs)
  2. Key management indicators (KMIs)
  3. Key performance indicators (KPIs)
  4. Key control indicators (KCIs)

Answer(s): D

Explanation:

The best type of indicators to measure the effectiveness of an organization's firewall rule set are key control indicators (KCIs). A firewall is a device or software that filters the network traffic based on a set of rules or policies. A firewall rule set is the configuration of the firewall that defines the criteria for allowing or blocking the traffic. A key control indicator is a metric that measures the performance and effectiveness of a control in achieving its objectives and mitigating the risks. A key control indicator can help to evaluate the adequacy and efficiency of the firewall rule set, and to identify any gaps, weaknesses, or issues that need to be addressed.Key risk indicators (KRIs), key management indicators (KMIs), and key performance indicators (KPIs) are not as suitable as key control indicators, as they measure different aspects of the risk management process, such as the level and nature of the risk exposure, the alignment and integration of the risk management activities, and the achievement of the risk management goals and targets. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 220.



The MOST effective way to increase the likelihood that risk responses will be implemented is to:

  1. create an action plan
  2. assign ownership
  3. review progress reports
  4. perform regular audits.

Answer(s): B

Explanation:

Risk responses are the actions or strategies that are taken to address the risks that may affect the organization's objectives, performance, or value creation12. The most effective way to increase the likelihood that risk responses will be implemented is to assign ownership, which is the process of identifying and appointing the individuals or groups who are responsible and accountable for the execution and monitoring of the risk responses34.

Assigning ownership is the most effective way because it ensures the clarity and commitment of the roles and responsibilities for the risk responses, and avoids the confusion or ambiguity that may arise from the lack of ownership34.
Assigning ownership is also the most effective way because it enhances the communication and collaboration among the stakeholders involved in the risk responses, and provides the feedback and input that are necessary for the improvement and optimization of the risk responses34.
The other options are not the most effective way, but rather possible steps or tools that may support or complement the assignment of ownership. For example:
Creating an action plan is a step that involves defining and documenting the specific tasks,

resources, timelines, and deliverables for the risk responses34. However, this step is not the most effective way because it does not guarantee the implementation of the risk responses, especially if there is no clear or agreed ownership for the action plan34. Reviewing progress reports is a tool that involves collecting and analyzing the information and data on the status and performance of the risk responses, and identifying the issues or gaps that need to be addressed34. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses, especially if there is no ownership for the progress reports or the corrective actions34. Performing regular audits is a tool that involves conducting an independent and objective assessment of the adequacy and effectiveness of the risk responses, and providing the findings and recommendations for improvement56. However, this tool is not the most effective way because it does not ensure the implementation of the risk responses,especially if there is no ownership for the audit results or the follow-up actions56. References =
1: Risk IT Framework, ISACA, 2009
2: IT Risk Management Framework, University of Toronto, 2017
3: Risk Response Plan in Project Management: Key Strategies & Tips1
4: ProjectManagement.com - How to Implement Risk Responses2
5: IT Audit and Assurance Standards, ISACA, 2014
6: IT Audit and Assurance Guidelines, ISACA, 2014



When an organization's disaster recovery plan (DRP) has a reciprocal agreement, which of the following risk treatment options is being applied?

  1. Acceptance
  2. Mitigation
  3. Transfer
  4. Avoidance

Answer(s): C

Explanation:

A reciprocal agreement is an agreement made by two or more organizations to use each other's resources during a disaster1. For example, two organizations with similar IT infrastructure may agree to provide backup servers or data centers for each other in case of a major disruption. By doing so, they transfer the risk of losing their IT capabilities to the other party, who agrees to share the responsibility and cost of recovery. A reciprocal agreement is a form of risk transfer, which is one of the four risk treatment options according to ISO 270012. Risk transfer means that the organization shifts the potential negative consequences of a risk to another party, such as an insurance company, a vendor, or a partner. This reduces the organization's exposure and liability to the risk, but it does not eliminate the risk completely, as the other party may fail to fulfill their obligations or charge a high price for their services.
References = Reciprocal Agreement - Risky Thinking, ISO 27001 Risk Assessment & Risk Treatment: The Complete Guide - Advisera



Which of the following is the GREATEST risk associated with the misclassification of data?

  1. inadequate resource allocation
  2. Data disruption
  3. Unauthorized access
  4. Inadequate retention schedules

Answer(s): C

Explanation:

According to the CRISC Review Manual, the greatest risk associated with the misclassification of data is unauthorized access, because it can result in the loss of confidentiality, integrity, and availability of the data. Data classification is the process of assigning categories to data based on its sensitivity and value to the organization. Data classification helps to determine the appropriate level of protection and handling for the data. If the data is misclassified, it may not receive the adequate level of security controls, and it may be accessed by unauthorized or inappropriate users. The other options are not the greatest risks associated with the misclassification of data, as they are less likely or less severe than unauthorized access. Inadequate resource allocation is the risk of not allocating sufficient resources to protect the data, which may affect its availability and performance. Data disruption is the risk of losing or corrupting the data, which may affect its integrity and availability. Inadequate retention schedules is the risk of not retaining the data forthe required period of time, which may affect its compliance and usability. References = CRISC Review

Manual, 7th Edition, Chapter 4, Section 4.1.1, page 161.



A new international data privacy regulation requires personal data to be disposed after the specified retention period, which is different from the local regulatory requirement.
Which of the following is the risk practitioner's BEST course of action?

  1. The application code has not been version controlled.
  2. Knowledge of the applications is limited to few employees.
  3. An IT project manager is not assigned to oversee development.
  4. Controls are not applied to the applications.

Answer(s): D






Post your Comments and Discuss ISACA CRISC exam dumps with other Community members:

Join the CRISC Discussion