CRISC Pre-Exam Practice Tests | (Updated 930 Questions)
Valid CRISC Exam Q&A PDF - One Year Free Update
Career Path
The professionals with the ISACA CRISC certification can take up different job roles in the field of information technology and information security. Some popular positions that these specialists can hold include an IT Security Analyst, a Security Risk Strategist, a Technology Risk Analyst, an Information Security Analyst, and an IT Audit Risk Supervisor. As with remuneration in the industry, the specific salary that a certified individual earns will depend on a couple of factors, including job title, level of experience, and type of organization. However, the average annual salary of the certificate holders is $107,399.
Certification Path
The Certified in Risk and Information Systems Control Certification includes only one CRISC exams.
NEW QUESTION 75
During a routine check, a system administrator identifies unusual activity indicating an intruder within a firewall. Which of the following controls has MOST likely been compromised?
- A. Identification
- B. Data integrity
- C. Data validation
- D. Authentication
Answer: D
NEW QUESTION 76
Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?
- A. The number of newly identified security incidents
- B. The number of security incidents escalated to senior management
- C. The number of resolved security incidents
- D. The number of recurring security incidents
Answer: A
NEW QUESTION 77
David is the project manager of HRC project. He concluded while HRC project is in process that if he adopts e- commerce, his project can be more fruitful. But he did not engage in electronic commerce (e-commerce) so that he would escape from risk associated with that line of business. What type of risk response had he adopted?
- A. Acceptance
- B. Avoidance
- C. Exploit
- D. Enhance
Answer: B
Explanation:
Section: Volume D
Explanation:
As David did not engage in e-commerce in order to avoid risk, hence he is following risk avoidance strategy.
NEW QUESTION 78
Which of the following is the way to verify control effectiveness?
- A. The capability of providing notification of failure.
- B. is incorrect. Reliability is not an indication of control strength; weak controls can be
highly reliable, even if they do not meet the control objective. - C. The test results of intended objectives.
- D. Explanation:
Control effectiveness requires a process to verify that the control process worked as intended and
meets the intended control objectives.
Hence the test result of intended objective helps in verifying effectiveness of control. - E. Whether it is preventive or detective.
- F. is incorrect. The type of control, like preventive or detective, does not help determine
control effectiveness. - G. Its reliability.
Answer: B,C,D,F
Explanation:
is incorrect. Notification of failure does not determine control strength, hence this option
is not correct.
NEW QUESTION 79
Risks to an organization's image are referred to as what kind of risk?
- A. Operational
- B. Financial
- C. Strategic
- D. Information
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Strategic risks are those risks which have potential outcome of not fulfilling on strategic objectives of the organization as planned. Since the strategic objective will shape and impact the entire organization, the risk of not meeting that objective can impose a great threat on the organization.
Strategic risks can be broken down into external and internal risks:
External risks are those circumstances from outside the enterprise which will have a potentially
damaging or helpful impact on the enterprise. These risks include sudden change of economy, industry, or regulatory conditions. Some of the external risks are predictable while others are not. For instance, a recession may be predictable and the enterprise may be able to hedge against the dangers economically; but the total market failure may not as predictable and can be much more devastating.
Internal risks usually focus on the image or reputation of the enterprise. some of the risks that are
involved in this are public communication, trust, and strategic agreement from stakeholders and customers.
NEW QUESTION 80
You are the risk professional in Bluewell Inc. A risk is identified and enterprise wants to quickly implement control by applying technical solution that deviates from the company's policies. What you should do?
- A. Recommend a risk assessment and subsequent implementation only if residual risk is accepted
- B. Recommend revision of the current policy
- C. Conduct a risk assessment and allow or disallow based on the outcome
- D. Recommend against implementation because it violates the company's policies
Answer: A
Explanation:
Section: Volume B
Explanation:
If it is necessary to quickly implement control by applying technical solution that deviates from the company's policies, then risk assessment should be conducted to clarify the risk. It is up to the management to accept the risk or to mitigate it.
Incorrect Answers:
A: As in this case it is important to mitigate the risk, hence risk professional should once recommend a risk assessment. Though the decision for the conduction of risk assessment in case of violation of company's policy, is taken by management.
B: The recommendation to revise the current policy should not be triggered by a single request.
D: Risk professional can only recommend the risk assessment if the company's policies is violating, but it can only be conducted when the management allows.
NEW QUESTION 81
Which of the following is an output of risk assessment process?
- A. Identification of appropriate controls
- B. is incorrect. Risk identification acts as input of the risk assessment process.
- C. is incorrect. Residual risk is the latter output after appropriate control.
- D. Explanation:
The output of the risk assessment process is identification of appropriate controls for reducing or eliminating risk during the risk mitigation process. To determine the likelihood of a future adverse
event, threats to an IT system must be analyzed in conjunction with the potential vulnerabilities
and the controls in place for the IT system.
Once risk factors have been identified, existing or new controls are designed and measured for
their strength and likelihood of effectiveness. Controls are preventive, detective or corrective;
manual or programmed; and formal or ad hoc. - E. Mitigated risk
- F. Identification of risk
- G. Enterprise left with residual risk
Answer: A
Explanation:
is incorrect. This is an output of risk mitigation process,that is, after applying several
risk responses.
NEW QUESTION 82
Which of the following is MOST important when considering risk in an enterprise risk management (ERM) process?
- A. Financial risk is given a higher priority.
- B. Security strategy is given a higher priority.
- C. Risk identified by industry benchmarking is included.
- D. Risk with strategic impact is included.
Answer: D
NEW QUESTION 83
Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?
- A. Percentage of high-risk vulnerabilities addressed
- B. Defined thresholds for high-risk vulnerabilities
- C. Percentage of high-risk vulnerabilities missed
- D. Number of high-risk vulnerabilities outstanding
Answer: A
NEW QUESTION 84
A control for mitigating risk in a key business area cannot be implemented immediately. Which of the following is the risk practitioner's BEST course of action when a compensating control needs to be applied?
- A. Inform senior management.
- B. update the risk response plan.
- C. Record the risk as accepted in the risk register.
- D. Obtain the risk owner's approval.
Answer: D
NEW QUESTION 85
The maturity of an IT risk management program is MOST influenced by:
- A. expertise available within the IT department
- B. industry-specific regulatory requirements
- C. the organization's risk culture
- D. benchmarking results against similar organizations
Answer: C
NEW QUESTION 86
Which of the following is the GREATEST risk associated with an environment that lacks documentation of the architecture?
- A. Unknown vulnerabilities
- B. Network isolation
- C. Legacy technology systems
- D. Overlapping threats
Answer: D
NEW QUESTION 87
Which of the following BEST measures the efficiency of an incident response process?
- A. Number of incidents escalated to management
- B. Average gap between actual and agreed response times
- C. Number of incidents lacking responses
- D. Average time between changes and updating of escalation matrix
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 88
Which of the following should be considered to ensure that risk responses that are adopted are cost- effective and are aligned with business objectives?
Each correct answer represents a part of the solution. Choose three.
- A. Identify the risk in business terms
- B. Recognize the business risk appetite
- C. Follow an integrated approach in business
- D. Adopt only pre-defined risk responses of business
Answer: A,B,C
Explanation:
Explanation/Reference:
Explanation:
Risk responses require a formal approach to issues, opportunities and events to ensure that solutions are cost-effective and are aligned with business objectives. The following should be considered:
While preparing the risk response, identify the risk in business terms like loss of productivity, disclosure
of confidential information, lost opportunity costs, etc.
Recognize the business risk appetite.
Follow an integrated approach in business.
Risk responses requiring an investment should be supported by a carefully planned business case that justifies the expenditure outlines alternatives and describes the justification for the alternative selected.
Incorrect Answers:
C: There is no such requirement to follow the pre-defined risk responses. If some new risk responses are discovered during the risk management of a particular project, they should be noted down in lesson leaned document so that project manager working on some other project could also utilize them.
NEW QUESTION 89
The PRIMARY objective of testing the effectiveness of a new control before implementation is to:
- A. comply with the organization's policy.
- B. measure efficiency of the control process.
- C. confirm control alignment with business objectives.
- D. ensure that risk is mitigated by the control.
Answer: C
NEW QUESTION 90
......
An A-list certification exam like the ISACA CRISC has a lot in store for its brave challengers. If you identify yourself as part of this daring crowd, you should pursue this certification by preparing diligently. It’s the first rule to keep in mind when beginning your venture as an ISACA candidate. So, in this post, you’ll learn the process of elimination when dealing with CRISC exam prep resources.
Certified in Risk and Information Systems Control Free Update Certification Sample Questions: https://www.newpassleader.com/ISACA/CRISC-exam-preparation-materials.html
Trend for ISACA CRISC pdf dumps before actual exam: https://drive.google.com/open?id=1XX9nhi1msjwBalilogr__ezxJatzFw4W