Based on Official Syllabus Topics of Actual ISACA CRISC Exam [Q549-Q571]

Rate this post

Based on Official Syllabus Topics of Actual ISACA CRISC Exam

Free CRISC Dumps are Available for Instant Access

ISACA CRISC Exam Syllabus Topics:

Section	Weight	Objectives
IT Risk Assessment	20%	– Risk Identification 1. Asset identification 2. Threat and vulnerability analysis – Risk Analysis and Evaluation 1. Likelihood and impact assessment 2. Risk prioritization
Monitoring and Control	22%	– Control Assurance 1. Control effectiveness evaluation 2. Audit and compliance support – Risk Monitoring 1. Continuous monitoring processes 2. Key risk indicators (KRIs)
Risk Response and Reporting	32%	– Risk Reporting 1. Stakeholder reporting mechanisms 2. Communication of risk status – Risk Treatment Options 1. Risk mitigation strategies 2. Risk transfer and avoidance
Governance	26%	– Enterprise Risk Management Framework 1. Risk appetite and tolerance 2. Risk governance structure – Risk Strategy Alignment 1. Business objectives alignment 2. Stakeholder engagement

NO.549 An organization has decided to commit to a business activity with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner’s MOST important action related to this decision?

Recommend risk remediation

Change the level of risk appetite

Document formal acceptance of the risk

Reject the business initiative

NO.550 A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site is a hot site with equipment ready to resume processing immediately.

The alternative site does not reside on the same fault no matter how far the distance apart.

NO.551 Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

KRIs assist in the preparation of the organization’s risk profile.

KRIs signal that a change in the control environment has occurred.

KRIs provide a basis to set the risk appetite for an organization

KRIs provide an early warning that a risk threshold is about to be reached.

NO.552 Which of the following would BEST help to ensure that suspicious network activity is identified?

Analyzing server logs

Coordinating events with appropriate agencies

Analyzing intrusion detection system (IDS) logs

Using a third-party monitoring provider

NO.553 A company has located its computer center on a moderate earthquake fault. Which of the following is the
MOST important consideration when establishing a contingency plan and an alternate processing site?

The alternative site is a hot site with equipment ready to resume processing immediately.

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site does not reside on the same fault to matter how the distance apart.

NO.554 You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. Choose three.

It helps in determination of the cost of protecting what is important

It helps in taking risk response decisions

It helps in providing a monetary impact view of risk

It helps making smart choices based on potential risk mitigation costs and losses

NO.555 Which of the following would BEST help secure online financial transactions from improper users?

Multi-factor authentication

Periodic review of audit trails

Multi-level authorization

Review of log-in attempts

NO.556 Following a business continuity planning exercise, an organization decides to accept an identified risk associated with a critical business system. Which of the following should be done next?

Document the decision-making process and considerations used

Perform a business impact analysis (BIA) to assess the impact of the risk

Develop a disaster recovery plan (DRP) and business continuity plan (BCP) to ensure resiliency

Develop a control to reduce the level of the risk

NO.557 Which of the following is the MOST important consideration when developing risk strategies?

Organization’s industry sector

Long-term organizational goals

Concerns of the business process owners

History of risk events

NO.558 To minimize risk in a software development project, when is the BEST time to conduct a risk analysis?

During the business requirement definitions phase

Before periodic steering committee meetings

At each stage of the development life cycle

During the business case development

NO.559 Which of the following should be a risk practitioner’s GREATEST concern upon learning of failures in a data
migration activity?

Availability of test data

Integrity of data

Cost overruns

System performance

NO.560 Which of the following is the BEST evidence that a user account has been properly authorized?

An email from the user accepting the account

Notification from human resources that the account is active

User privileges matching the request form

Formal approval of the account by the user’s manager

NO.561 You are the project manager for GHT project. You need to perform the Qualitative risk analysis process.
When you have completed this process, you will produce all of the following as part of the risk register update output except which one?

Probability of achieving time and cost estimates

Priority list of risks

Watch list of low-priority risks

Risks grouped by categories

NO.562 Which of the following is a PRIMARY benefit to an organization that is using threat intelligence?

Timely insight into potential threats

Automated vulnerability management

Accurate threat information

Verification of threat information

NO.563 Mapping open risk issues to an enterprise risk heat map BEST facilitates:

risk response.

control monitoring.

risk identification.

risk ownership.

NO.564 An organization’s HR department has implemented a policy requiring staff members to take a minimum of five consecutive days leave per year to mitigate the risk of malicious insider activities. Which of the following is the BEST key performance indicator (KPI) of the effectiveness of this policy?

Number of malicious activities occurring during staff members leave

Percentage of staff members seeking exception to the policy

Percentage of staff members taking leave according to the policy

Financial loss incurred due to malicious activities during staff members’ leave

NO.565 Mapping open risk issues to an enterprise risk heat map BEST facilitates:

risk response.

control monitoring.

risk identification.

risk ownership.

NO.566 A risk practitioner is preparing a report to communicate changes in the risk and control environment. The BEST way to engage stakeholder attention is to:

include a roadmap to achieve operational excellence

include a summary linking information to stakeholder needs

publish the report on-demand for stakeholders

include detailed deviations from industry benchmarks

NO.567 You are the project manager of GHT project. You have identified a risk event on your project that could save
$100,000 in project costs if it occurs. Which of the following statements BEST describes this risk event?

This risk event should be mitigated to take advantage of the savings.

This is a risk event that should be accepted because the rewards outweigh the threat to the project.

This risk event should be avoided to take full advantage of the potential savings.

This risk event is an opportunity to the project and should be exploited.

NO.568 Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?

Single loss expectancy (SLE)

Cost of the information system

Availability of additional compensating controls

Potential business impacts are within acceptable levels

The BEST information when determining whether to accept residual risk of a critical system to be implemented is the potential business impacts are within acceptable levels, because it indicates that the residual risk, which is the risk that remains after the risk response actions, does not exceed the risk tolerance and appetite of the organization, and that it does not pose a significant threat or disruption to the business objectives and processes. The potential business impacts are the consequences or outcomes of the residual risk on the organization’s performance, reputation, and value. The other options are not as informative as the potential business impacts, because:
* Option A: Single loss expectancy (SLE) is a measure of the monetary loss that is expected from a single occurrence of a risk event, but it does not provide the best information when determining whether to accept residual risk, because it does not consider the frequency or probability of the risk event, or the qualitative aspects of the risk impact, such as customer satisfaction, employee morale, or regulatory compliance.
* Option B: Cost of the information system is a measure of the total expenditure that is required to acquire, develop, operate, and maintain the information system, but it does not provide the best
* information when determining whether to accept residual risk, because it does not reflect the value or benefit of the information system, or the risk exposure or variation that the information system may introduce or encounter.
* Option C: Availability of additional compensating controls is a measure of the alternative or supplementary controls that can be implemented to reduce the residual risk, but it does not provide the best information when determining whether to accept residual risk, because it does not indicate the effectiveness or efficiency of the compensating controls, or the cost-benefit analysis of implementing them. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p.
122.

NO.569 Which of the following is the MOST important responsibility of a risk owner?

Testing control design

Accepting residual risk

Establishing business information criteria

Establishing the risk register

NO.570 Which of me following is MOST helpful to mitigate the risk associated with an application under development not meeting business objectives?

Identifying tweets that may compromise enterprise architecture (EA)

Including diverse Business scenarios in user acceptance testing (UAT)

Performing risk assessments during the business case development stage

Including key stakeholders in review of user requirements

NO.571 After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor’s control environment?