During a post-implementation review for a new system, users voiced concerns about missing functionality. Which of the following is the BEST way for the organization to avoid this situation in the future?
Answer(s): C
Conducting User Acceptance Testing (UAT) is the best way for an organization to avoid situations where users voice concerns about missing functionality after a system implementation.User Acceptance Testing (UAT):Definition:UAT involves testing the system with actual users to ensure it meets their needs and requirements. It verifies that the system performs in real-world scenarios as expected by the users.Involvement of Users:UAT includes the end-users in the testing process, ensuring that their feedback is incorporated and that the system functionalities align with their expectations.Benefits:Identifying Gaps:UAT helps in identifying gaps between the delivered system and user expectations. This early detection allows for adjustments before the system goes live. Improved Satisfaction:By involving users in the testing process, the likelihood of the system meeting their needs increases, leading to higher user satisfaction and reduced post- implementation issues.
The CRISC Review Manual and best practices in project management emphasize the importance of UAT in ensuring that the system meets user requirements and avoids post- implementation functionality concerns .
A risk assessment has identified increased losses associated with an IT risk scenario. It is MOST important for the risk practitioner to:
Answer(s): A
The most important action for the risk practitioner to take when a risk assessment has identified increased losses associated with an IT risk scenario is to update the risk rating. A risk rating is a measure of the overall level of risk, based on the combination of the probability and impact of the risk scenario. A risk rating helps to prioritize the risks, communicate the risk exposure, and monitor the risk response. Updating the risk rating is the most important action, because it reflects the current state and magnitude of the risk, and it triggers the review and revision of the risk response plan, if needed. Updating the risk rating also ensures that the risk register and the risk profile are accurate and complete, and that the risk management process is consistent and effective. The other options are not the most important action, although they may be related or subsequent steps in the risk management process. Reevaluating inherent risk is a part of the risk analysis process, which estimates the probability and impact of the risk scenario before considering the existing controls. Reevaluating inherent risk can help to identify the root causes and drivers of the risk, and to assess the effectiveness and efficiency of the controls, but it does not change the overall level of risk or the risk response plan. Developing new risk scenarios is a part of the risk identification process, which identifies and describes the potential events or situations that could affect the achievement of the objectives. Developing new risk scenarios can help to expand the scope and coverage of the risk management process, and to address the emerging or changing risks, but it does not update the existing risk scenarios or the risk response plan. Implementing additional controls is a part of the risk response process, which selects and executes the appropriate actions to reduce, avoid, share, or exploit the risk. Implementing additional controls can help to mitigate the risk and achieve the desired risk level, but it is not the first or the only option, as it depends on the risk appetite, tolerance, and capacity of the organization, and the cost-benefit analysis of the controls. References = Risk Register Template and Examples | Prioritize and Manage Risk, How to Write Strong Risk Scenarios and Statements - ISACA, IT Risk Resources | ISACA
During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:
An intrusion detection system (IDS) is a network security tool that monitors network traffic and devices for known malicious activity, suspicious activity or security policy violations1. An IDS can generate alerts when it detects any potential threats, but not all alerts are accurate or relevant. There are two types of errors that can affect the performance and reliability of an IDS: false positives and false negatives2.A false positive is when an IDS incorrectly flags a benign or normal activity as malicious or suspicious. For example, an IDS may alert on a legitimate network scan or a harmless software update. False positives can reduce the credibility and efficiency of an IDS, as they can overwhelm the security team with unnecessary alerts, distract them from the real threats, and cause them to ignore or disable the IDS3.A false negative is when an IDS fails to flag a malicious or suspicious activity as such. For example, an IDS may miss a stealthy or novel attack that does not match any known signatures or patterns. False negatives can compromise the security and integrity of the network, as they can allow attackers to bypass the IDS and cause damage or steal data without being detected4.The risk practitioner should recommend to analyze the alerts to minimize the false positives, because this is the best way to improve the accuracy and usefulness of the IDS. By analyzing the alerts, the risk practitioner can:Identify the sources and causes of the false positives, such as misconfigured or outdated IDS rules, network anomalies, or legitimate traffic that resembles malicious traffic5. Adjust or fine-tune the IDS settings, such as the alert threshold, the sensitivity level, the detection method, or the rule base, to reduce the number of false positives without increasing the risk of false negatives.Validate or verify the alerts with other sources of information, such as logs, network traffic analysis, or threat intelligence, to confirm or dismiss the alerts as true or false positives. Prioritize or classify the alerts based on their severity, impact, or likelihood, to focus on the most critical or relevant alerts and avoid alert fatigue.The other options are not the best course of action, because:Resetting the alert threshold based on peak traffic is not a reliable or effective way to minimize the false positives, as it may also increase the risk of false negatives. The alert threshold is the level of activity or deviation that triggers an alert from the IDS. If the threshold is set too high, the IDS may miss some malicious or suspicious activity that occurs below the threshold. If the threshold is set too low, the IDS may generate too many alerts for normal or benign activity that exceeds the threshold. The optimal threshold depends on various factors, such as the network size, topology, traffic volume, and baseline. Peak traffic is not a good indicator of the optimal threshold, as it may vary depending on the time, day, or season, and it may not reflect the normal or expected network behavior.Analyzing the traffic to minimize the false negatives is not the main issue or goal in this scenario, as the problem is the high number of alerts, not the low number of alerts. Analyzing thetraffic can help to identify the malicious or suspicious activity that the IDS may have missed, but it does not address the root cause of the false positives or improve the IDS performance. Moreover, analyzing the traffic can be time-consuming and resource-intensive, especially for large or complex networks, and it may require specialized tools or skills that the risk practitioner may not have.Sniffing the traffic using a network analyzer is not a suitable or feasible option in this scenario, as it may violate the privacy or security policies of the network or the organization. Sniffing the traffic means capturing and inspecting the network packets that are transmitted or received by the devices on the network. A network analyzer is a tool that can perform this function and display the packet data in a readable format. However, sniffing the traffic can also expose sensitive or confidential information, such as passwords, usernames, or credit card numbers, that may be contained in the packets. Therefore, sniffing the traffic may require authorization or consent from the network owners or users, and it may be restricted or prohibited by law or regulation.References =What is an intrusion detection system (IDS)? - IBM Intrusion detection system - WikipediaWhat Are Intrusion Detection Systems? - MUO12 Best Intrusion Detection System (IDS) Software 2024 - Comparitech What is an Intrusion Detection System (IDS)? - Fortinet [False Positive and False Negative in Intrusion Detection System] [False Positives and False Negatives in Intrusion Detection Systems] [How to Reduce False Positives for Your IDS/IPS][How to Set the Right Alert Thresholds for Your IDS/IPS] [Network Traffic Analysis: What It Is and How It Works] [What is a Network Analyzer? - Definition from Techopedia]
An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?
Answer(s): B
The process owner is the stakeholder who is responsible for the business process that will be supported by the new IT solution. The process owner has the best knowledge of the businessrequirements, objectives, and risks associated with the process. The process owner can provide the most relevant information for analyzing the risk associated with the new IT solution, such as the expected benefits, costs, performance, functionality, security, and compliance of the solution. The process owner can also help to identify and evaluate the potential impact and likelihood of the risk scenarios related to the new IT solution. The other stakeholders may have some information or insights, but they are not as directly involved or affected by the new IT solution as the process owner. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.1.1, pp. 58-59.
Which of the following is the GREATEST concern related to the monitoring of key risk indicators (KRIs)?
Answer(s): D
Log modification undermines data integrity, which is critical for accurate risk monitoring. Ensuring log integrity supports reliable KRI assessments, a key focus within theRisk Monitoring and Reportingframework.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.