Best Preparations of CRISC Exam 2021 Isaca Certificaton Unlimited 897 Questions
Focus on CRISC All-in-One Exam Guide For Quick Preparation.
NEW QUESTION 40
Which of the following would be an IT business owner's BEST course of action following an unexpected increase in emergency changes?
- A. Evaluating the impact to control objectives
- B. Reconfiguring the IT infrastructure
- C. Conducting a root-cause analysis
- D. Validating the adequacy of current processes
Answer: C
NEW QUESTION 41
Which of the following is the FIRST step in managing the risk associated with the leakage of confidential data?
- A. Conduct an awareness program for data owners and users
- B. Maintain and review the classified data inventory
- C. Define and implement a data classification policy
- D. Implement mandatory encryption on data
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 42
Which of the following components ensures that risks are examined for all new proposed change requests in the change control system?
- A. Integrated change control
- B. Risk monitoring and control
- C. Scope change control
- D. Configuration management
Answer: A
Explanation:
Section: Volume C
Explanation:
Integrated change control is the component that is responsible for reviewing all aspects of a change's impact on a project - including risks that may be introduced by the new change.
Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.
Incorrect Answers:
A: Configuration management controls and documents changes to the features and functions of the product scope.
B: Scope change control focuses on the processes to allow changes to enter the project scope.
C: Risk monitoring and control is not part of the change control system, so this choice is not valid.
NEW QUESTION 43
In which of the following risk management capability maturity levels does the enterprise takes major business decisions considering the probability of loss and the probability of reward? Each correct answer represents a complete solution. Choose two.
- A. Level 2
- B. Level 5
- C. Level 4
- D. Level 0
Answer: B,C
Explanation:
Explanation/Reference:
Explanation:
Enterprise having risk management capability maturity level 4 and 5 takes business decisions considering the probability of loss and the probability of reward, i.e., considering all the aspects of risk.
Incorrect Answers:
A: Enterprise having risk management capability maturity level 0 takes business decisions without considering risk credential information.
B: At this low level of risk management capability the enterprise take decisions considering specific risk issues within functional and business silos (e.g., security, business continuity, operations).
NEW QUESTION 44
Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?
- A. An increase in residual risk
- B. A decrease in the number of key controls
- C. Changes in control ownership
- D. Changes in control design
Answer: A
NEW QUESTION 45
An organization has raised the risk appetite for technology risk. The MOST likely result would be:
- A. lower risk management cost.
- B. increased inherent risk.
- C. higher risk management cost
- D. decreased residual risk.
Answer: A
NEW QUESTION 46
Which of the following aspect of monitoring tool ensures that the monitoring tool has the ability to keep up with the growth of an enterprise?
- A. Scalability
- B. Explanation:
Monitoring tools have to be able to keep up with the growth of an enterprise and meet anticipated growth in process, complexity or transaction volumes; this is ensured by the scalability criteria of the monitoring tool. - C. Sustainability
- D. Customizability
- E. Impact on performance
Answer: A
Explanation:
is incorrect. It ensures that monitoring software is able to change at the same speed as technology applications and infrastructure to be effective over time. Answer: B is incorrect. For software to be effective, it must be customizable to the specific needs of an enterprise. Hence customizability ensures that end users can adapt the software. Answer: D is incorrect. The impact on performance has nothing related to the ability of monitoring tool to keep up with the growth of enterprise.
NEW QUESTION 47
Which of the following should be the GREATEST concern for an organization that uses open source software applications?
- A. Lack of professional support for open source software
- B. Lack of organizational policy regarding open source software
- C. Lack of monitoring over installation of open source software in the organization
- D. Lack of reliability associated with the use of open source software
Answer: B
NEW QUESTION 48
Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?
- A. Business impact analysis (B1A)
- B. Control catalog
- C. Risk policy review
- D. Risk register
Answer: D
NEW QUESTION 49
To communicate the risk associated with IT in business terms, which of the following MUST be defined?
- A. Risk appetite of the organization
- B. Inherent and residual risk
- C. Organizational objectives
- D. Compliance objectives
Answer: B
NEW QUESTION 50
An organization operates in a jurisdiction where heavy fines are imposed for leakage of customer data. Which of the following provides the BEST input to assess the inherent risk impact?
- A. Number of customer records held
- B. Number of encrypted customer databases
- C. Number of staff members having access to customer data
- D. Number of databases that host customer data
Answer: D
NEW QUESTION 51
When reviewing a risk response strategy, senior management's PRIMARY focus should be placed on the:
- A. alignment with risk appetite.
- B. cost-benefit analysis.
- C. key performance indicators (KPIs).
- D. investment portfolio.
Answer: B
NEW QUESTION 52
Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?
- A. Interview control owners.
- B. Inspect external audit documentation.
- C. Observe the control enhancements in operation.
- D. Review management's detailed action plans.
Answer: C
NEW QUESTION 53
To minimize the risk of a potential acquisition being exposed externally, an organization has selected a few key employees to be engaged in the due diligence process. A member of the due diligence team realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired. What is the BEST course of action for this team member?
- A. Delegate responsibilities involving the acquaintance.
- B. Disclose potential conflicts of interest.
- C. Notify the subsidiary's legal team.
- D. Enforce segregation of duties.
Answer: B
NEW QUESTION 54
Which of The following will BEST communicate the importance of risk mitigation initiatives to senior management?
- A. Balanced scorecard
- B. Heat map
- C. Industry standards
- D. Business case
Answer: D
NEW QUESTION 55
You are the project manager of project for a client. The client has promised your company a bonus, if the project is completed early. After studying the project work, you elect to crash the project in order to realize the early end date. This is an example of what type of risk response?
- A. Negative risk response, because crashing will add risks.
- B. Negative risk response, because crashing will add costs.
- C. Explanation:
This is a positive risk response, as crashing is an example of enhancing. You are enhancing the probability of finishing the project early to realize the reward of bonus. Enhancing doesn't ensure positive risks, but it does increase the likelihood of the event. - D. Positive risk response, as crashing is an example of exploiting.
- E. Positive risk response, as crashing is an example of enhancing.
Answer: E
Explanation:
is incorrect. Crashing does add costs, but in this instance, crashing is an example of the positive risk response of enhancing. Answer:A is incorrect. Crashing is a positive risk response. Generally, crashing doesn't add risks and is often confused with other predominant schedule compression techniques of fast tracking which does add risks. Answer:C is incorrect. This isn't an example of exploiting. Exploiting is an action to take advantage of a positive risk response that will happen.
NEW QUESTION 56
Which of the following would BEST help identify the owner for each risk scenario in a risk register?
- A. Determining resource dependency of assets
- B. Determining which departments contribute most to risk
- C. Mapping identified risk factors to specific business processes
- D. Allocating responsibility for risk factors equally to asset owners
Answer: C
NEW QUESTION 57
Which of the following would be a risk practitioner's BEST course of action when a project team has accepted a risk outside the established risk appetite?
- A. Reject the risk acceptance and require mitigating controls.
- B. Escalate the risk decision to the project sponsor for review.
- C. Document the risk decision in the project risk register.
- D. Monitor the residual risk level of the accepted risk.
Answer: D
NEW QUESTION 58
The BEST reason to classify IT assets during a risk assessment is to determine the:
- A. priority in the risk register
- B. enterprise risk profile
- C. business process owner
- D. appropriate level of protection
Answer: D
NEW QUESTION 59
Which of the following is the BEST way to ensure that outsourced service providers comply with the enterprise's information security policy?
- A. Penetration testing
- B. Security awareness training
- C. Periodic audits
- D. Service level monitoring
Answer: C
Explanation:
Section: Volume C
Explanation:
As regular audits can spot gaps in information security compliance, periodic audits can ensure that outsourced service provider comply with the enterprise's information security policy.
Incorrect Answers:
A: Penetration testing can identify security vulnerability, but cannot ensure information compliance.
B: Service level monitoring can only identify operational issues in the enterprise's operational environment. It does not play any role in ensuring that outsourced service provider complies with the enterprise's information security policy.
C: Training can increase user awareness of the information security policy, but is less effective than periodic auditing.
NEW QUESTION 60
An organization operates in a jurisdiction where heavy fines are imposed for leakage of customer data. Which of the following provides the BEST input to assess the inherent risk impact?
- A. Number of customer records held
- B. Number of encrypted customer databases
- C. Number of databases that host customer data
- D. Number of staff members having access to customer data
Answer: D
Explanation:
Section: Volume D
Explanation
NEW QUESTION 61
Which of the following is the PRIMARY objective of providing an aggregated view of IT risk to business management?
- A. To identify dependencies for reporting risk
- B. To allow for proper review of risk tolerance
- C. To provide consistent and clear terminology
- D. To enable consistent data on risk to be obtained
Answer: D
NEW QUESTION 62
You are using Information system. You have chosen a poor password and also sometimes transmits data over unprotected communication lines. What is this poor quality of password and unsafe transmission refers to?
- A. Vulnerabilities
- B. Impacts
- C. is incorrect. Probabilities represent the likelihood of the occurrence of a threat, and this
scenario does not describe a probability. - D. Explanation:
Vulnerabilities represent characteristics of information resources that may be exploited by a threat.
The given scenario describes such a situation, hence it is a vulnerability. - E. is incorrect. Threats are circumstances or events with the potential to cause harm to
information resources. This scenario does not describe a threat. - F. Probabilities
- G. Threats
Answer: A
Explanation:
is incorrect. Impacts represent the outcome or result of a threat exploiting a
vulnerability. The stem does not describe an impact.
NEW QUESTION 63
......
Guaranteed Success with CRISC Dumps: https://www.newpassleader.com/ISACA/CRISC-exam-preparation-materials.html
Pass ISACA CRISC Exam – Experts Are Here To Help You: https://drive.google.com/open?id=1XX9nhi1msjwBalilogr__ezxJatzFw4W