Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?
Answer(s): B
A key control indicator (KCI) is a metric that provides information on the extent to which a given control is meeting its intended objectives in terms of loss prevention, reduction, etc. A KCI should have an explicit relationship to both the specific control and the specific risk against which the control has been implemented. For risk related to IT infrastructure failure, a possible control is to have a recovery plan that can restore the critical IT services and minimize the impact of the failure. A KCI that can measure the effectiveness of this control is the number of successful recovery plan tests, which indicates how well the recovery plan can be executed in a real scenario. The higher the number of successful tests, the lower the risk of IT infrastructure failure. Therefore, this is the best KCI among the given options. References =Integrating KRIs and KPIs for Effective Technology Risk Management Key Control Indicator (KCI) - CIO WikiInfrastructure Issues: Understanding and Mitigating Risks
Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?
Answer(s): A
The software version is the component of a software inventory that best enables the identification and mitigation of known vulnerabilities. The software version is the specific release or update of a software product that has a unique identifier, such as a number or a name. The software version indicates the features, functions, and security patches that are included in the software product. By knowing the software version, the organization can compare it with the latest available version and identify any missing or outdated security fixes. The organization can then mitigate the known vulnerabilities by updating or upgrading the software to the latest version. The other components of a software inventory, such as the assigned software manager, the software support contract expiration, and the software licensing information, are not as directly related tothe identification and mitigation of known vulnerabilities, although they may provide some contextual or administrative information. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.2, page 2-25.
What is senior management's role in the RACI model when tasked with reviewing monthly status reports provided by risk owners?
Senior management's role in the RACI model when tasked with reviewing monthly status reports provided by risk owners is accountable, as it means that they have the ultimate authority and responsibility to approve or reject the risk management decisions and actions, and to oversee the risk management performance and outcomes. The other options are not the correct roles, as they imply different levels or types of involvement or participation in the risk management process, such as being informed, responsible, or consulted, respectively. References = CRISC Review Manual, 7th Edition, page 101.
What would be MOST helpful to ensuring the effective implementation of a new cybersecurity program?
Answer(s): D
The most helpful action to ensure the effective implementation of a new cybersecurity program is assigning clear ownership of the program. Here's why:Clear Ownership:Assigning clear ownership ensures that there is accountability and responsibility for the implementation and success of the program.The program owner will coordinate activities, allocate resources, and monitor progress to ensure that objectives are met.Creating Metrics:While metrics are important for monitoring and reporting, they do not directly ensure the effective implementation of the program.Hiring Subject Matter Experts:Subject matter experts are valuable for providing insights and guidance, but without clear ownership, their efforts may not be effectively coordinated or aligned with program goals.Establishing a Budget:A budget is necessary for securing resources, but it must be managed and directed by a responsible owner to ensure the effective use of those resources.
The CRISC Review Manual discusses the importance of assigning roles and responsibilities, including ownership, to ensure the effective implementation of risk management programs (CRISC Review Manual, Chapter 1: Governance, Section 1.2.1 RACI).
A risk practitioner has identified that the organization's secondary data center does not provide redundancy for a critical application. Who should have the authority to accept the associated risk?
Answer(s): C
The business application owner should have the authority to accept the associated risk, because they are responsible for the performance and outcomes of the critical application, and they understand the business requirements, expectations, and impact of the application. The business application owner can also evaluate the trade-offs between the potential benefits and costs of the application, and the potential risks and consequences of a disruption or failure of the application. The business application owner can also communicate and justify their risk acceptance decision to the senior management and other stakeholders, and ensure that the risk is monitored and reviewed regularly. The other options are less appropriate to have the authority to accept the associated risk. The business continuity director is responsible for overseeing the planning and execution of the business continuity strategy, which includes ensuring the availability andresilience of the critical business processes and applications. However, they are not the owner of the application, and they may not have the full knowledge or authority to accept the risk on behalf of the business. The disaster recovery manager is responsible for managing the recovery and restoration of the IT systems and applications in the event of a disaster or disruption. However, they are not the owner of the application, and they may not have the full knowledge or authority to accept the risk on behalf of the business. The data center manager is responsible for managing the operation and maintenance of the data center infrastructure, which includes providing the physical and environmental security, power, cooling, and network connectivity for the IT systems and applications. However, they are not the owner of the application, and they may not have the full knowledge or authority to accept the risk on behalf of the business. References = Risk IT Framework, ISACA, 2022, p. 181
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.