Which types of controls are BEST used to minimize the risk associated with a vulnerability?
Answer(s): B
Preventive controls are the best types of controls to minimize the risk associated with a vulnerability, because they aim to avoid or reduce the occurrence of a threat or an exploit. Preventive controls can include physical, technical, or administrative measures, such as locks, firewalls, encryption, policies, training, or backup. Preventive controls can also involve eliminating or substituting the source of the vulnerability, such as outdated software or hardware.References·ISACA CRISC Review Manual, 7th Edition, Domain 3: Risk Response, Section 3.2.1:Control Types·Hazard Controls - Princeton University·Risk Control | Techniques and Importance of Risk Control - EDUCBA
When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?
Answer(s): C
A risk register is a document that records and tracks the information about the risks that may affect the organization's objectives, such as the risk description, category, source, cause, impact, probability, status, owner, response, etc. When developing a new risk register, a risk practitioner should focus on risk identification. This is the process of finding, recognizing, and describing the risks that may affect the organization's objectives, using various techniques, such as brainstorming, interviews, checklists, surveys, etc.Risk identification helps to create a comprehensive and accurate list of the risks that need to be managed, and to provide the basis for the subsequent risk analysis and evaluation, risk response planning, and risk monitoring and control. The other options are not the risk management activities that a risk practitioner should focus on when developing a new risk register. They are either subsequent or parallel to risk identification.The references for this answer are:Risk IT Framework, page 29Information Technology & Security, page 23Risk Scenarios Starter Pack, page 21
Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?
Answer(s): D
A security incident handling process is a set of procedures and activities that aim to identify, analyze, contain, eradicate, recover from, and learn from security incidents that affect the confidentiality, integrity, or availability of information assets12. The maturity of a security incident handling process is the degree to which the process is defined, managed, measured, controlled, and improved, and the extent to which it meets the organization's objectives and expectations34.The best key performance indicator (KPI) to measure the maturity of a security incident handling process is the number of recurring security incidents, which is the frequency or rate of security incidents that are repeated or reoccur after being resolved or closed56. The number of recurring security incidents is the best KPI because it reflects the effectiveness and efficiency of the security incident handling process, and the ability of the process to prevent or reduce the recurrence of security incidents through root cause analysis, corrective actions, and continuous improvement56.The number of recurring security incidents is also the best KPI because it is directly related to the organization's objectives and expectations, such as minimizing the impact and cost of security incidents, enhancing the security posture and resilience of the organization, and complying with the relevant standards and regulations56.The other options are not the best KPIs, but rather possible metrics that may support or complement the measurement of the maturity of the security incident handling process. For example:The number of security incidents escalated to senior management is a metric that indicates the severity or complexity of security incidents, and the involvement or awareness of the seniormanagement in the security incident handling process56. However, this metric doesnot measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56.The number of resolved security incidents is a metric that indicates the output or outcome of the security incident handling process, and the performance or productivity of the security incident handling team56. However, this metric does not measure the quality or sustainability of the resolution, or the ability of the process to prevent or reduce security incidents56. The number of newly identified security incidents is a metric that indicates the input or demand of the security incident handling process, and the capability or capacity of the security incident detection and identification mechanisms56. However, this metric does not measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56. References =1: Computer Security Incident Handling Guide, NIST Special Publication 800-61, Revision 2, August 20122: ISO/IEC 27035:2016 Information technology -- Security techniques -- Information security incident management3: Capability Maturity Model Integration (CMMI) for Services, Version 1.3, November 20104: COBIT 2019 Framework: Introduction and Methodology, ISACA, 20185: KPIs for Security Operations & Incident Response, SecurityScorecard Blog, June 7, 20216: Key Performance Indicators (KPIs) for Security Operations and Incident Response, DFLabs White Paper, 2018
Which of the following is the GREATEST risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider?
The greatest risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider is inadequate data encryption. Data encryption is a keysecurity measure that protects the confidentiality and integrity of data, especially when it is stored or transmitted over a network. If the data encryption is inadequate, the data backup solution may be vulnerable to unauthorized access, modification, or disclosure by malicious actors or third parties. This could result in data breaches, regulatory fines, reputational damage, or legal liabilities for the enterprise. More complex test restores, inadequate service level agreement (SLA) with the provider, and more complex incident response procedures are also potential risks associated with the transition, but they are not as great as inadequate data encryption. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.1.1, page 245.
Which of the following is the BEST approach for determining whether a risk action plan is effective?
According to the CRISC Review Manual (Digital Version), assessing changes in residual risk is the best approach for determining whether a risk action plan is effective, as it measures the impact and value of the risk response actions and controls on the risk level. Residual risk is the risk that remains after the risk response actions and controls have been implemented.Assessing changes in residual risk helps to:Evaluate the extent to which the risk response actions and controls have reduced the likelihood and/or impact of the risk to an acceptable level Identify and report any deviations, errors, or weaknesses in the risk response actions and controls and their performanceRecommend and implement corrective actions or improvement measures to address any issues or deficiencies in the risk response actions and controls Monitor and measure the effectiveness and efficiency of the risk response actions and controls and their alignment with the organization's risk appetite and risk tolerance Update the risk register and the risk treatment plan to reflect the current risk status and the residual risk levelsReferences = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.2: Risk Response Process, pp. 161-1621
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.