Exam (elaborations)
CRISC EXAM – QUESTIONS WITH CORRECT SOLUTIONS
- Course
- Institution
CRISC EXAM – QUESTIONS WITH CORRECT SOLUTIONS
[Show more]
Content preview
CRISC EXAM – QUESTIONS WITH CORRECT SOLUTIONSQuestion #:6
A risk practitioner is assisting with the preparation of a report on the
organization s disaster recovery (DR) capabilities. Which information would
have the MOST impact on the overall recovery profile?
A. The percentage of systems meeting recovery target times has increased.
B. The number of systems tested in the last year has increased.
C. The number of systems requiring a recovery plan has increased.
D. The percentage of systems with long recovery target times has decreased.
Right Ans - D. The percentage of systems with long recovery target times has
decreased.
Question #:7
An organization has identified a risk exposure due to weak technical controls
in a newly implemented HR system. The risk practitioner is documenting the
risk in the risk register. The risk should be owned by the:
A. chief risk officer.
B. project manager.
C. chief information officer.
D. business process owner. Right Ans - D. business process owner.
Question #:10
A risk practitioner observes that hardware failure incidents have been
increasing over the last few months. However, due to built-in redundancy and
fault-tolerant architecture, there have been no interruptions to business
operations. The risk practitioner should conclude that:
A. a root cause analysis is required
B. controls are effective for ensuring continuity
C. hardware needs to be upgraded
D. no action is required as there was no impact Right Ans - A. a root cause
analysis is required.
Question #:13
,A risk practitioner is summarizing the results of a high-profile risk assessment
sponsored by senior management. The BEST way to support risk-based
decisions by senior management would be to:
A. map findings to objectives.
B. provide a quantified detailed analyst.
C. recommend risk tolerance thresholds.
D. quantify key risk indicators (KRls). Right Ans - A. map findings to
objectives.
Question #:14
A web-based service provider with a low-risk appetite for system outages is
reviewing its current risk profile for online security. Which of the following
observations would be MOST relevant to escalate to senior management?
A. An increase in attempted distributed denial of service (DDoS) attacks
B. An increase in attempted website phishing attacks
C. A decrease in achievement of service level agreements (SLAs)
D. A decrease in remediated web security vulnerabilities Right Ans - A. An
increase in attempted distributed denial of service (DDoS) attacks.
Question #:22
A risk practitioner discovers several key documents detailing the design of a
product currently in development have been posted on the Internet. What
should be the risk practitioner's FIRST course of action?
A. invoke the established incident response plan.
B. Inform internal audit.
C. Perform a root cause analysis
D. Conduct an immediate risk assessment Right Ans - A. invoke the
established incident response plan.
Question #:34
IT management has asked for a consolidated view into the organization's risk
profile to enable project prioritization and resource allocation. Which of the
following materials would be MOST helpful?
A. IT risk register
B. List of key risk indicators
,C. Internal audit reports
D. List of approved projects Right Ans - A. IT risk register.
Question #:35
During an IT risk scenario review session, business executives question why
they have been assigned ownership of IT-related risk scenarios. They feel IT
risk is technical in nature and therefore should be owned by IT. Which of the
following is the BEST way for the risk practitioner to address these concerns?
A. Describe IT risk scenarios in terms of business risk.
B. Recommend the formation of an executive risk council to oversee IT risk.
C. Provide an estimate of IT system downtime if IT risk materializes.
D. Educate business executives on IT risk concepts. Right Ans - A. Describe
IT risk scenarios in terms of business risk.
Question #:40
An organization that has been the subject of multiple social engineering
attacks is developing a risk awareness program. The PRIMARY goal of this
program should be to:
A. reduce the risk to an acceptable level.
B. communicate the consequences for violations.
C. implement industry best practices.
D. reduce the organization's risk appetite Right Ans - B. communicate the
consequences for violations.
Question #:44
A business unit is updating a risk register with assessment results for a key
project. Which of the following is MOST important to capture in the register?
A. The team that performed the risk assessment
B. An assigned risk manager to provide oversight
C. Action plans to address risk scenarios requiring treatment
D. The methodology used to perform the risk assessment Right Ans - C.
Action plans to address risk scenarios requiring treatment.
Question #:46
, During testing, a risk practitioner finds the IT department's recovery time
objective (RTO) for a key system does not align with the enterprise's business
continuity plan (BCP). Which of the following should be done NEXT?
A. Report the gap to senior management
B. Consult with the IT department to update the RTO
C. Complete a risk exception form.
D. Consult with the business owner to update the BCP Right Ans - A. Report
the gap to senior management.
Question #:52
Which of the following would be the BEST recommendation if the level of risk
in the IT risk profile has decreased and is now below management's risk
appetite?
A. Optimize the control environment.
B. Realign risk appetite to the current risk level.
C. Decrease the number of related risk scenarios.
D. Reduce the risk management budget. Right Ans - A. Optimize the control
environment.
Question #:54
A systems interruption has been traced to a personal USB device plugged into
the corporate network by an IT employee who bypassed internal control
procedures. Of the following, who should be accountable?
A. Business continuity manager (BCM)
B. Human resources manager (HRM)
C. Chief risk officer (CRO)
D. Chief information officer (CIO) Right Ans - D. Chief information officer
(CIO)
Question #:58
Which of the following BEST provides an early warning that network access of
terminated employees is not being revoked in accordance with the service
level agreement (SLA)?
A. Updating multi-factor authentication
B. Monitoring key access control performance indicators
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Studyhall. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $29.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
75057 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now