Clear your concepts with CRISC Questions Before Attempting Real exam [Q209-Q225]

September 9, 2024 admin 0

Categories : CRISC , ISACA

4/5 - (1 vote)

Clear your concepts with CRISC Questions Before Attempting Real exam

Get professional help from our CRISC Dumps PDF

NO.209 Which of the following is the BEST defense against successful phishing attacks?

Intrusion detection system

Application hardening

End-user awareness

Spam filters

Explanation:
Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Phishing attacks are a type of to social engineering attack and are best defended by end-user awareness training.

is incorrect. Application hardening does not protect against phishing attacks since phishing attacks generally use e-mail as the attack vector, with the end-user as the vulnerable point, not the application. Answer:D is incorrect. Certain highly specialized spam filters can reduce the number of phishing e-mails that reach the inboxes of user, but they are not as effective in addressing phishing attack as end-user awareness. Answer:A is incorrect. An intrusion detection system does not protect against phishing attacks since phishing attacks usually do not have a particular pattern or unique signature.

NO.210 Which of the following will BEST help to ensure key risk indicators (KRIs) provide value to risk owners?

Ongoing training

Timely notification

Return on investment (ROI)

Cost minimization

The best way to ensure key risk indicators (KRIs) provide value to risk owners is to provide timely notification of the changes in the risk exposure. KRIs are metrics that provide an early warning of increasing risk exposure in various areas of the organization. By providing timely notification of the KRI values, the risk owners can be alerted of the risk situation and take appropriate actions to manage the risk. Ongoing training, return on investment (ROI), and cost minimization are other possible ways to ensure KRIs provide value, but they are not as effective as timely notification. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 10; CRISC Review Manual, 6th Edition, page
140.

NO.211 Which of the following process ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule?

Risk management

Risk response integration

Risk response implementation

Risk response tracking

Explanation:
Risk response tracking tracks the ongoing status of risk mitigation processes as part of risk response process. This tracking ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule. When an enterprise is conscious of a risk, but does not have an appropriate risk response strategy, then it lead to the increase of the liability of the organization to adverse publicity or even civil or criminal penalties.

is incorrect. Implementation of risk response ensures that the risks analyzed in risk analysis process are being lowered to level that the enterprise can accept, by applying appropriate controls. Answer: B is incorrect. Integrating risk response options to address more than one risk together, help in achieving greater efficiency. The use of techniques that are versatile and enterprise-wide, rather than individual solutions provides better justification for risk response strategies and related costs. Answer: A is incorrect. Risk management provides an approach for individuals and groups to make a decision on how to deal with potentially harmful situations

NO.212 The PRIMARY purpose of a maturity model is to compare the:

current state of key processes to their desired state.

organization to peers.

organization to industry best practices.

actual KPIs with target KPIs.

Section: Volume D

NO.213 Due to a change in business processes, an identified risk scenario no longer requires mitigation. Which of the following is the MOST important reason the risk should remain in the risk register?

To support regulatory requirements

To prevent the risk scenario in the current environment

To monitor for potential changes to the risk scenario

To track historical risk assessment results

A risk register is a document that records and tracks the identified risks, their causes, impacts, likelihood, responses, and status. A risk register can help manage and communicate risks throughout the risk management process. A risk register should be updated regularly to reflect the current state of risks and their responses. Due to a change in business processes, an identified risk scenario may no longer require mitigation, as the risk level may have decreased or the risk may have been eliminated. However, the risk should remain in the risk register, as the most important reason is to monitor for potential changes to the risk scenario. This means keeping track of the internal and external factors that may affect the risk scenario, such as new threats, vulnerabilities, opportunities, or controls. Monitoring for potential changes to the risk scenario can help identify and respond to any emerging or reoccurring risks, and ensure that the risk register is accurate and complete. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.3: Risk Register, p. 41-43.

NO.214 Which of the following is a risk practitioner’s BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?

Redesign key risk indicators (KRIs).

Update risk responses.

Conduct a SWOT analysis.

Perform a threat assessment.

Performing a threat assessment is the best course of action for a risk practitioner upon learning that regulatory authorities have concerns with an emerging technology that the organization is considering, because it helps to identify and analyze the sources and types of threats that may exploit the vulnerabilities or weaknesses of the technology, and to estimate their likelihood and impact. A threat is a potential event or action that may cause harm or damage to the organization or its objectives, such as a natural disaster, a cyberattack, or a human error. A threat assessment is a process of systematically identifying and assessing the threats that an organization faces, and estimating their probability and severity. An emerging technology is a new or innovative technology that has the potential to disrupt or transform the existing markets, industries, or practices, such as artificial intelligence, blockchain, or biotechnology. An emerging technology may offer benefits such as competitive advantage, efficiency, or creativity, but it may also pose risks such as technical complexity, interoperability issues, regulatory uncertainty, or ethical dilemmas. Therefore, performing a threat assessment is the best course of action, as it helps to understand and evaluate the threats and their consequences, and to determine the appropriate controls or mitigating factors to reduce or eliminate them.
Redesigning key risk indicators (KRIs), updating risk responses, and conducting a SWOT analysis are all possible courses of action to perform after performing a threat assessment, but they are not the best course of action, as they depend on the results and recommendations of the threat assessment. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87

NO.215 When defining thresholds for control key performance indicators (KPIs), it is MOST helpful to align:

key risk indicators (KRIs) with risk appetite of the business

the control key performance indicators (KPIs) with audit findings

control performance with risk tolerance of business owners

information risk assessments with enterprise risk assessments

Section: Volume D

NO.216 Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

Obtain objective assessment of the control environment.

Ensure the risk profile is defined and communicated.

Validate the threat management process.

Obtain an objective view of process gaps and systemic errors.

NO.217 Which of the following should a risk practitioner do FIRST when an organization decides to use a cloud service?

Review the vendor selection process and vetting criteria.

Assess whether use of service falls within risk tolerance thresholds.

Establish service level agreements (SLAs) with the vendor.

Check the contract for appropriate security risk and control provisions.

NO.218 Which of the following is MOST important information to review when developing plans for using emerging technologies?

Existing IT environment

IT strategic plan

Risk register

Organizational strategic plan

NO.219 A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site is a hot site with equipment ready to resume processing immediately.

The alternative site does not reside on the same fault no matter how far the distance apart.

The most important consideration when establishing a contingency plan and an alternate processing site for a company that has located its computer center on a moderate earthquake fault is that the alternative site does not reside on the same fault no matter how far the distance apart, as it ensures that the alternative site is not affected by the same earthquake event that may disrupt the primary site, and that the business continuity and recovery objectives can be met. The other options are not the most important considerations, as they are more related to the backup, priority, or readiness of the alternative site, respectively, rather than the location of the alternative site. References = CRISC Review Manual, 7th Edition, page 111.

NO.220 Which of the following is the MOST important outcome of a business impact analysis (BIA)?

Understanding and prioritization of critical processes

Completion of the business continuity plan (BCP)

Identification of regulatory consequences

Reduction of security and business continuity threats

The most important outcome of a business impact analysis (BIA) is understanding and prioritization of critical processes. A BIA is a process that identifies and evaluates the potential effects of disruptions or disasters on the organization’s business functions and processes. A BIA helps to understand the dependencies, interrelationships, and impacts of the business processes, and to prioritize them based on their importance and urgency. A BIA also helps to determine the recovery objectives, strategies, and resources for the business processes, such as the recovery time objective (RTO), the recovery point objective (RPO), and the minimum operating requirements (MOR). The other options are not as important as understanding and prioritization of critical processes, although they may be part of or derived from the BIA. Completion of the business continuity plan (BCP), identification of regulatory consequences, and reduction of security and business continuity threats are all activities or outcomes that can be supported or facilitated by the BIA, but they are not the primary purpose or result of the BIA. References = CISA Review Manual, 27th Edition, Chapter 5, Section
5.2.1, page 5-9.

NO.221 Which of the following activities would BEST contribute to promoting an organization-wide risk-aware culture?

Communicating components of risk and their acceptable levels

Performing a benchmark analysis and evaluating gaps

Participating in peer reviews and implementing best practices

Conducting risk assessments and implementing controls

Section: Volume D
Explanation/Reference:
Reference: https://m.isaca.org/Certification/CRISC-Certified-in-Risk-and-Information-Systems-Control/ Documents/CRISC-Additional-Verification-Form-2015-Later-frm_Eng_0818.pdf

NO.222 What should be the PRIMARY objective for a risk practitioner performing a post-implementation review of an IT risk mitigation project?

Documenting project lessons learned

Validating the risk mitigation project has been completed

Confirming that the project budget was not exceeded

Verifying that the risk level has been lowered

NO.223 Which of the following role carriers has to account for collecting data on risk and articulating risk?

Enterprise risk committee

Business process owner

Chief information officer (CIO)

Chief risk officer (CRO)

Explanation:
CRO is the individual who oversees all aspects of risk management across the enterprise. Chief risk officer has the main accountability for collecting data and articulating risk. If there is any fault in these processes then CRO should be answerable.

is incorrect. Enterprise risk committee are the executives who are accountable for the enterprise level collaboration and consensus required to support enterprise risk management (ERM). They are to some extent responsible for articulating risk but are not accounted for it. They are neither responsible nor accounted for collecting data on risk. Answer:C is incorrect. CIO is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources. CIO has some responsibility towards collecting data and articulating risk but is not accounted for them. Answer:B is incorrect. Business process owner is an individual responsible for identifying process requirements, approving process design and managing process performance. He/she is responsible for collecting data and articulating risk but is not accounted for them.

NO.224 Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an antivirus program?

Percentage of IT assets with current malware definitions

Number of false positives defected over a period of time

Number of alerts generated by the anti-virus software

Frequency of anti-vinjs software updates

NO.225 An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system. The risk practitioner is documenting the risk in the risk register. The risk should be owned by the:

chief risk officer.

project manager.

chief information officer.

business process owner.

The business process owner should be the risk owner for the risk exposure due to weak technical controls in a newly implemented HR system, because they are responsible for the performance and outcomes of the HR business process, and they understand the business requirements, expectations, and impact of the HR system.
The business process owner can also evaluate the trade-offs between the potential benefits and costs of the HR system, and the potential risks and consequences of a failure or breach of the system. The business process owner can also communicate and justify their risk acceptance or mitigation decision to the senior management and other stakeholders, and ensure that the risk is monitored and reviewed regularly. The other options are less appropriate to be the risk owner for this risk exposure. The chief risk officer is responsible for overseeing the enterprise-wide risk management framework and process, which includes ensuring the identification, assessment, and reporting of risks. However, they are not the owner of the HR system or the HR business process, and they may not have the full knowledge or authority to accept or mitigate the risk on behalf of the business. The project manager is responsible for managing the implementation of the HR system, which includes ensuring the delivery of the system within the scope, time, and budget constraints. However, they are not the owner of the HR system or the HR business process, and they may not have the full knowledge or authority to accept or mitigate the risk on behalf of the business. The chief information officer is responsible for managing the IT function and resources, which includes providing the technical support and security for the HR system. However, they are not the owner of the HR system or the HR business process, and they may not have the full knowledge or authority to accept or mitigate the risk on behalf of the business. References = Getting risk ownership right 1

Loading …