CRISC Certified in Risk and Information Systems Control Material

dumps2022-02-08T03:16:46+08:00

Certified in Risk and Information Systems Control CRISC exam material is available. There are 150 multiple choice questions in real CRISC exam, and you have 4 hours to finish the test. The available languages are English, Spanish and Chinese simplified. All the ISACA certification CRISC exam material are helpful for you to pass the test. Free Certified in Risk and Information Systems Control CRISC exam material is below.

Page 1 of 30

1. The PRIMARY objective for selecting risk response options is to:

reduce risk 10 an acceptable level.

identify compensating controls.

minimize residual risk.

reduce risk factors.

2. An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST.

The risk owner who also owns the business service enabled by this infrastructure

The data center manager who is also employed under the managed hosting services contract

The site manager who is required to provide annual risk assessments under the contract

The chief information officer (CIO) who is responsible for the hosted services

3. IT management has asked for a consolidated view into the organization's risk profile to enable project prioritization and resource allocation .

Which of the following materials would be MOST helpful?

IT risk register

List of key risk indicators

Internal audit reports

List of approved projects

4. Which of the following is the MOST useful indicator to measure the efficiency of an identity and access management process?

Number of tickets for provisioning new accounts

Average time to provision user accounts

Password reset volume per month

Average account lockout time

5. A risk practitioner is assisting with the preparation of a report on the organization s disaster recovery (DR) capabilities .

Which information would have the MOST impact on the overall recovery profile?

The percentage of systems meeting recovery target times has increased.

The number of systems tested in the last year has increased.

The number of systems requiring a recovery plan has increased.

The percentage of systems with long recovery target times has decreased.

6. Which of the following changes would be reflected in an organization's risk profile after the failure of a critical patch implementation?

Risk tolerance is decreased.

Residual risk is increased.

Inherent risk is increased.

Risk appetite is decreased

7. Which of the following would be MOST important for a risk practitioner to provide to the internal audit department during the audit planning process?

Closed management action plans from the previous audit

Annual risk assessment results

An updated vulnerability management report

A list of identified generic risk scenarios

8. The MAIN purpose of conducting a control self-assessment (CSA) is to:

gain a better understanding of the control effectiveness in the organization

gain a better understanding of the risk in the organization

adjust the controls prior to an external audit

reduce the dependency on external audits

9. Which of the following attributes of a key risk indicator (KRI) is MOST important?

Repeatable

Automated

Quantitative

Qualitative

10. A contract associated with a cloud service provider MUST include:

ownership of responsibilities.

a business recovery plan.

provision for source code escrow.

the providers financial statements.

Page 2 of 30

11. Who should be accountable for ensuring effective cybersecurity controls are established?

Risk owner

Security management function

IT management

Enterprise risk function

12. Which of the following is the BEST method to identify unnecessary controls?

Evaluating the impact of removing existing controls

Evaluating existing controls against audit requirements

Reviewing system functionalities associated with business processes

Monitoring existing key risk indicators (KRIs)

13. Which of the following BEST describes the role of the IT risk profile in strategic IT-related decisions?

It compares performance levels of IT assets to value delivered.

It facilitates the alignment of strategic IT objectives to business objectives.

It provides input to business managers when preparing a business case for new IT projects.

It helps assess the effects of IT decisions on risk exposure

14. Which of the following should be the PRIMARY consideration when implementing controls for monitoring user activity logs?

Ensuring availability of resources for log analysis

Implementing log analysis tools to automate controls

Ensuring the control is proportional to the risk

Building correlations between logs collected from different sources

15. Which of the following is the BEST method to ensure a terminated employee's access to IT systems is revoked upon departure from the organization?

A list of terminated employees is generated for reconciliation against current IT access.

A process to remove employee access during the exit interview is implemented.

The human resources (HR) system automatically revokes system access.

16. Who is the MOST appropriate owner for newly identified IT risk?

The manager responsible for IT operations that will support the risk mitigation efforts

The individual with authority to commit organizational resources to mitigate the risk

A project manager capable of prioritizing the risk remediation efforts

The individual with the most IT risk-related subject matter knowledge

17. Which of the following is the BEST indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees?

A reduction in the number of help desk calls

An increase in the number of identified system flaws

A reduction in the number of user access resets

An increase in the number of incidents reported

18. Which of the following tools is MOST effective in identifying trends in the IT risk profile?

Risk self-assessment

Risk register

Risk dashboard

Risk map

19. A risk practitioner has determined that a key control does not meet design expectations .

Which of the following should be done NEXT?

Document the finding in the risk register.

Invoke the incident response plan.

Re-evaluate key risk indicators.

Modify the design of the control.

20. Which of the following is the FIRST step in managing the risk associated with the leakage of confidential data?

Maintain and review the classified data inventor.

Implement mandatory encryption on data

Conduct an awareness program for data owners and users.

Define and implement a data classification policy

Page 3 of 30

21. Which of the following is the PRIMARY reason to perform ongoing risk assessments?

Emerging risk must be continuously reported to management.

New system vulnerabilities emerge at frequent intervals.

The risk environment is subject to change.

The information security budget must be justified.

22. Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited .

Which of the following would be the BEST response to this scenario?

Assess the vulnerability management process.

Conduct a control serf-assessment.

Conduct a vulnerability assessment.

Reassess the inherent risk of the target.

23. Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?

Updating multi-factor authentication

Monitoring key access control performance indicators

Analyzing access control logs for suspicious activity

Revising the service level agreement (SLA)

24. A risk assessment has identified that departments have installed their own WiFi access points on the enterprise network .

Which of the following would be MOST important to include in a report to senior management?

The network security policy

Potential business impact

The WiFi access point configuration

Planned remediation actions

25. Which of the following is the MOST important element of a successful risk awareness training program?

Customizing content for the audience

Providing incentives to participants

Mapping to a recognized standard

Providing metrics for measurement

26. The number of tickets to rework application code has significantly exceeded the established threshold .

Which of the following would be the risk practitioner s BEST recommendation?

Perform a root cause analysis

Perform a code review

Implement version control software.

Implement training on coding best practices

27. An effective control environment is BEST indicated by controls that:

minimize senior management's risk tolerance.

manage risk within the organization's risk appetite.

reduce the thresholds of key risk indicators (KRIs).

are cost-effective to implement

28. Which of the following is the PRIMARY reason for a risk practitioner to use global standards related to risk management?

To build an organizational risk-aware culture

To continuously improve risk management processes

To comply with legal and regulatory requirements

To identify gaps in risk management practices

29. Which of the following helps ensure compliance with a nonrepudiation policy requirement for electronic transactions?

Digital signatures

Encrypted passwords

One-time passwords

Digital certificates

30. Establishing and organizational code of conduct is an example of which type of control?

Preventive

Directive

Detective

Compensating

Page 4 of 30

31. Management has noticed storage costs have increased exponentially over the last 10 years because most users do not delete their emails .

Which of the following can BEST alleviate this issue while not sacrificing security?

Implementing record retention tools and techniques

Establishing e-discovery and data loss prevention (DLP)

Sending notifications when near storage quota

Implementing a bring your own device 1BVOD) policy

32. Malware has recently affected an organization.

The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:

a gap analysis

a root cause analysis.

an impact assessment.

a vulnerability assessment.

33. Calculation of the recovery time objective (RTO) is necessary to determine the:

time required to restore files.

point of synchronization

priority of restoration.

annual loss expectancy (ALE).

34. During testing, a risk practitioner finds the IT department's recovery time objective (RTO) for a key system does not align with the enterprise's business continuity plan (BCP) .

Which of the following should be done NEXT?

Report the gap to senior management

Consult with the IT department to update the RTO

Complete a risk exception form.

Consult with the business owner to update the BCP

35. Which of the following is the MOST important key performance indicator (KPI) to establish in the service level agreement (SLA) for an outsourced data center?

Percentage of systems included in recovery processes

Number of key systems hosted

Average response time to resolve system incidents

Percentage of system availability

36. Which of the following is the MOST important factor affecting risk management in an organization?

The risk manager's expertise

Regulatory requirements

Board of directors' expertise

The organization's culture

37. A global organization is considering the acquisition of a competitor. Senior management has requested a review of the overall risk profile from the targeted organization .

Which of the following components of this review would provide the MOST useful information?

Risk appetite statement

Enterprise risk management framework

Risk management policies

Risk register

38. Which of the following should be the PRIMARY input when designing IT controls?

Benchmark of industry standards

Internal and external risk reports

Recommendations from IT risk experts

Outcome of control self-assessments

39. A rule-based data loss prevention {DLP) tool has recently been implemented to reduce the risk of sensitive data leakage .

Which of the following is MOST likely to change as a result of this implementation?

Risk likelihood

Risk velocity

Risk appetite

Risk impact

40. The PRIMARY objective of testing the effectiveness of a new control before implementation is to:

ensure that risk is mitigated by the control.

measure efficiency of the control process.

confirm control alignment with business objectives.

comply with the organization's policy.

Page 5 of 30

41. Which of the following is the MOST important benefit of key risk indicators (KRIs)'

Assisting in continually optimizing risk governance

Enabling the documentation and analysis of trends

Ensuring compliance with regulatory requirements

Providing an early warning to take proactive actions

42. Which of the following is the BEST way for a risk practitioner to help management prioritize risk response?

Align business objectives to the risk profile.

Assess risk against business objectives

Implement an organization-specific risk taxonomy.

Explain risk details to management.

43. Which of the following would provide the BEST guidance when selecting an appropriate risk treatment plan?

Risk mitigation budget

Business Impact analysis

Cost-benefit analysis

Return on investment

44. A systems interruption has been traced to a personal USB device plugged into the corporate network by an IT employee who bypassed internal control procedures.

Of the following, who should be accountable?

Business continuity manager (BCM)

Human resources manager (HRM)

Chief risk officer (CRO)

Chief information officer (CIO)

45. A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security .

Which of the following observations would be MOST relevant to escalate to senior management?

An increase in attempted distributed denial of service (DDoS) attacks

An increase in attempted website phishing attacks

A decrease in achievement of service level agreements (SLAs)

A decrease in remediated web security vulnerabilities

46. Which of the following elements of a risk register is MOST likely to change as a result of change in management's risk appetite?

Key risk indicator (KRI) thresholds

Inherent risk

Risk likelihood and impact

Risk velocity

47. Which of the following would be a risk practitioners BEST recommendation for preventing cyber intrusion?

Establish a cyber response plan

Implement data loss prevention (DLP) tools.

Implement network segregation.

Strengthen vulnerability remediation efforts.

48. An organization wants to assess the maturity of its internal control environment.

The FIRST step should be to:

validate control process execution.

determine if controls are effective.

identify key process owners.

conduct a baseline assessment.

49. Which of the following roles would provide the MOST important input when identifying IT risk scenarios?

Information security managers

Internal auditors

Business process owners

Operational risk managers

50. Which of the following risk register updates is MOST important for senior management to review?

Extending the date of a future action plan by two months

Retiring a risk scenario no longer used

Avoiding a risk that was previously accepted

Changing a risk owner

Page 6 of 30

51. Which of the following is the BEST method for assessing control effectiveness?

Ad hoc control reporting

Control self-assessment

Continuous monitoring

Predictive analytics

52. The MOST effective way to increase the likelihood that risk responses will be implemented is to:

create an action plan

assign ownership

review progress reports

perform regular audits.

53. During an IT risk scenario review session, business executives question why they have been assigned ownership of IT-related risk scenarios. They feel IT risk is technical in nature and therefore should be owned by IT .

Which of the following is the BEST way for the risk practitioner to address these concerns?

Describe IT risk scenarios in terms of business risk.

Recommend the formation of an executive risk council to oversee IT risk.

Provide an estimate of IT system downtime if IT risk materializes.

Educate business executives on IT risk concepts.

54. Which of the following would BEST help to ensure that identified risk is efficiently managed?

Reviewing the maturity of the control environment

Regularly monitoring the project plan

Maintaining a key risk indicator for each asset in the risk register

Periodically reviewing controls per the risk treatment plan

55. Which of the following is the FIRST step in managing the security risk associated with wearable technology in the workplace?

Identify the potential risk.

Monitor employee usage.

Assess the potential risk.

Develop risk awareness training.

56. Which of the following is the BEST way to identify changes to the risk landscape?

Internal audit reports

Access reviews

Threat modeling

Root cause analysis

57. In an organization with a mature risk management program, which of the following would provide the BEST evidence that the IT risk profile is up to date?

Risk questionnaire

Risk register

Management assertion

Compliance manual

58. The PRIMARY benefit of maintaining an up-to-date risk register is that it helps to:

implement uniform controls for common risk scenarios.

ensure business unit risk is uniformly distributed.

build a risk profile for management review.

quantify the organization's risk appetite.

59. Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?

The number of security incidents escalated to senior management

The number of resolved security incidents

The number of newly identified security incidents

The number of recurring security incidents

60. Which of the following should be the risk practitioner s PRIMARY focus when determining whether controls are adequate to mitigate risk?

Sensitivity analysis

Level of residual risk

Cost-benefit analysis

Risk appetite

Page 7 of 30

61. From a business perspective, which of the following is the MOST important objective of a disaster recovery test?

The organization gains assurance it can recover from a disaster

Errors are discovered in the disaster recovery process.

All business critical systems are successfully tested.

All critical data is recovered within recovery time objectives (RTOs).

62. Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?

Cost of offsite backup premises

Cost of downtime due to a disaster

Cost of testing the business continuity plan

Response time of the emergency action plan

63. A risk assessment has identified that an organization may not be in compliance with industry regulations.

The BEST course of action would be to:

conduct a gap analysis against compliance criteria.

identify necessary controls to ensure compliance.

modify internal assurance activities to include control validation.

collaborate with management to meet compliance requirements.

64. A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management.

The BEST way to support risk-based decisions by senior management would be to:

map findings to objectives.

provide a quantified detailed analysts.

recommend risk tolerance thresholds.

quantify key risk indicators (KRls).

65. Which of the following is the BEST way to determine the ongoing efficiency of control processes?

Perform annual risk assessments.

Interview process owners.

Review the risk register.

Analyze key performance indicators (KPIs).

66. An application owner has specified the acceptable downtime in the event of an incident to be much lower than the actual time required for the response team to recover the application .

Which of the following should be the NEXT course of action?

Invoke the disaster recovery plan during an incident.

Prepare a cost-benefit analysis of alternatives available

Implement redundant infrastructure for the application.

Reduce the recovery time by strengthening the response team.

67. Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Using an aggregated view of organizational risk

Ensuring relevance to organizational goals

Relying on key risk indicator (KRI) data Including

Trend analysis of risk metrics

68. Which of the following activities would BEST contribute to promoting an organization-wide risk-aware culture?

Performing a benchmark analysis and evaluating gaps

Conducting risk assessments and implementing controls

Communicating components of risk and their acceptable levels

Participating in peer reviews and implementing best practices

69. Which of the following would be MOST helpful when estimating the likelihood of negative events?

Business impact analysis

Threat analysis

Risk response analysis

Cost-benefit analysis

70. A risk practitioner is organizing risk awareness training for senior management .

Which of the following is the MOST important topic to cover in the training session?

The organization's strategic risk management projects

Senior management roles and responsibilities

The organizations risk appetite and tolerance

Senior management allocation of risk management resources

Page 8 of 30

71. An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system.

The risk practitioner is documenting the risk in the risk register. The risk should be owned by the:

chief risk officer.

project manager.

chief information officer.

business process owner.

72. When using a third party to perform penetration testing, which of the following is the MOST important control to minimize operational impact?

Perform a background check on the vendor.

Require the vendor to sign a nondisclosure agreement.

Require the vendor to have liability insurance.

Clearly define the project scope

73. Which of the following would MOST effectively enable a business operations manager to identify events exceeding risk thresholds?

Continuous monitoring

A control self-assessment

Transaction logging

Benchmarking against peers

74. The MOST important characteristic of an organization s policies is to reflect the organization's:

risk assessment methodology.

risk appetite.

capabilities

asset value.

75. A risk heat map is MOST commonly used as part of an IT risk analysis to facilitate risk:

communication

identification.

treatment.

assessment.

76. A trusted third party service provider has determined that the risk of a client's systems being hacked is low .

Which of the following would be the client's BEST course of action?

Perform their own risk assessment

Implement additional controls to address the risk.

Accept the risk based on the third party's risk assessment

Perform an independent audit of the third party.

77. Which of the following is the BEST course of action to reduce risk impact?

Create an IT security policy.

Implement corrective measures.

Implement detective controls.

Leverage existing technology

78. Improvements in the design and implementation of a control will MOST likely result in an update to:

inherent risk.

residual risk.

risk appetite

risk tolerance

79. A risk practitioner observes that hardware failure incidents have been increasing over the last few months. However, due to built-in redundancy and fault-tolerant architecture, there have been no interruptions to business operations. The risk practitioner should conclude that:

a root cause analysis is required

controls are effective for ensuring continuity

hardware needs to be upgraded

no action is required as there was no impact

80. A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet .

What should be the risk practitioner's FIRST course of action?

invoke the established incident response plan.

Inform internal audit.

Perform a root cause analysis

Conduct an immediate risk assessment

Page 9 of 30

81. During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards.

The overall control environment may still be effective if:

compensating controls are in place.

a control mitigation plan is in place.

risk management is effective.

residual risk is accepted.

82. After a risk has been identified, who is in the BEST position to select the appropriate risk treatment option?

The risk practitioner

The business process owner

The risk owner

The control owner

83. A data processing center operates in a jurisdiction where new regulations have significantly increased penalties for data breaches .

Which of the following elements of the risk register is MOST important to update to reflect this change?

Risk impact

Risk trend

Risk appetite

Risk likelihood

84. Which of the following would BEST provide early warning of a high-risk condition?

Risk register

Risk assessment

Key risk indicator (KRI)

Key performance indicator (KPI)

85. What is the BEST information to present to business control owners when justifying costs related to controls?

Loss event frequency and magnitude

The previous year's budget and actuals

Industry benchmarks and standards

Return on IT security-related investments

86. Which of the following should be the PRIMARY consideration when assessing the automation of control monitoring?

impact due to failure of control

Frequency of failure of control

Contingency plan for residual risk

Cost-benefit analysis of automation

87. An organization has determined a risk scenario is outside the defined risk tolerance level .

What should be the NEXT course of action?

Develop a compensating control.

Allocate remediation resources.

Perform a cost-benefit analysis.

Identify risk responses

88. A risk practitioner is organizing a training session lo communicate risk assessment methodologies to ensure a consistent risk view within the organization.

Which of the following i< the MOST important topic to cover in this training?

Applying risk appetite

Applying risk factors

Referencing risk event data

Understanding risk culture

89. Which of the following will BEST help mitigate the risk associated with malicious functionality in outsourced application development?

Perform an m-depth code review with an expert

Validate functionality by running in a test environment

Implement a service level agreement.

Utilize the change management process.

90. Which of the following would be MOST useful when measuring the progress of a risk response action plan?

Percentage of mitigated risk scenarios

Annual loss expectancy (ALE) changes

Resource expenditure against budget

An up-to-date risk register

Page 10 of 30

91. An unauthorized individual has socially engineered entry into an organization's secured physical premises .

Which of the following is the BEST way to prevent future occurrences?

Employ security guards.

Conduct security awareness training.

Install security cameras.

Require security access badges.

92. The analysis of which of the following will BEST help validate whether suspicious network activity is malicious?

Logs and system events

Intrusion detection system (IDS) rules

Vulnerability assessment reports

Penetration test reports

93. Which of the following is the MOST important outcome of reviewing the risk management process?

Assuring the risk profile supports the IT objectives

Improving the competencies of employees who performed the review

Determining what changes should be nude to IS policies to reduce risk

Determining that procedures used in risk assessment are appropriate

94. Which of the following is the BEST metric to demonstrate the effectiveness of an organization's change management process?

Increase in the frequency of changes

Percent of unauthorized changes

Increase in the number of emergency changes

Average time to complete changes

95. The PRIMARY advantage of implementing an IT risk management framework is the:

establishment of a reliable basis for risk-aware decision making.

compliance with relevant legal and regulatory requirements.

improvement of controls within the organization and minimized losses.

alignment of business goals with IT objectives.

96. During a routine check, a system administrator identifies unusual activity indicating an intruder within a firewall .

Which of the following controls has MOST likely been compromised?

Data validation

Identification

Authentication

Data integrity

97. Which of the following will BEST mitigate the risk associated with IT and business misalignment?

Establishing business key performance indicators (KPIs)

Introducing an established framework for IT architecture

Establishing key risk indicators (KRIs)

Involving the business process owner in IT strategy

98. Which of the following is the GREATEST benefit of incorporating IT risk scenarios into the corporate risk register?

Corporate incident escalation protocols are established.

Exposure is integrated into the organization's risk profile.

Risk appetite cascades to business unit management

The organization-wide control budget is expanded.

99. An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program.

The PRIMARY goal of this program should be to:

reduce the risk to an acceptable level.

communicate the consequences for violations.

implement industry best practices.

reduce the organization's risk appetite

100. Which of the following is the MOST important consideration when multiple risk practitioners capture risk scenarios in a single risk register?

Aligning risk ownership and control ownership

Developing risk escalation and reporting procedures

Maintaining up-to-date risk treatment plans

Using a consistent method for risk assessment

Page 11 of 30

101. A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption .

Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?

Implement a tool to create and distribute violation reports

Raise awareness of encryption requirements for sensitive data.

Block unencrypted outgoing emails which contain sensitive data.

Implement a progressive disciplinary process for email violations.

102. An organization delegates its data processing to the internal IT team to manage information through its applications .

Which of the following is the role of the internal IT team in this situation?

Data controllers

Data processors

Data custodians

Data owners

103. A key risk indicator (KRI) is reported to senior management on a periodic basis as exceeding thresholds, but each time senior management has decided to take no action to reduce the risk .

Which of the following is the MOST likely reason for senior management's response?

The underlying data source for the KRI is using inaccurate data and needs to be corrected.

The KRI is not providing useful information and should be removed from the KRI inventory.

The KRI threshold needs to be revised to better align with the organization s risk appetite

Senior management does not understand the KRI and should undergo risk training.

104. Which of the following is MOST effective against external threats to an organizations confidential information?

Single sign-on

Data integrity checking

Strong authentication

Intrusion detection system

105. Which of the following will BEST quantify the risk associated with malicious users in an organization?

Business impact analysis

Risk analysis

Threat risk assessment

Vulnerability assessment

106. Which of the following is MOST helpful in identifying new risk exposures due to changes in the business environment?

Standard operating procedures

SWOT analysis

Industry benchmarking

Control gap analysis

107. Which of the following would be- MOST helpful to understand the impact of a new technology system on an organization's current risk profile?

Hire consultants specializing m the new technology.

Review existing risk mitigation controls.

Conduct a gap analysis.

Perform a risk assessment.

108. Which of the following is the MOST cost-effective way to test a business continuity plan?

Conduct interviews with key stakeholders.

Conduct a tabletop exercise.

Conduct a disaster recovery exercise.

Conduct a full functional exercise.

109. When determining which control deficiencies are most significant, which of the following would provide the MOST useful information?

Risk analysis results

Exception handling policy

Vulnerability assessment results

Benchmarking assessments

110. Which of the following is the MOST effective key performance indicator (KPI) for change management?

Percentage of changes with a fallback plan

Number of changes implemented

Percentage of successful changes

Average time required to implement a change

Page 12 of 30

111. A review of an organization s controls has determined its data loss prevention {DLP) system is currently failing to detect outgoing emails containing credit card data .

Which of the following would be MOST impacted?

Key risk indicators (KRls)

Inherent risk

Residual risk

Risk appetite

112. The risk associated with an asset before controls are applied can be expressed as:

a function of the likelihood and impact

the magnitude of an impact

a function of the cost and effectiveness of control.

the likelihood of a given threat

113. Risk management strategies are PRIMARILY adopted to:

take necessary precautions for claims and losses.

achieve acceptable residual risk levels.

avoid risk for business and IT assets.

achieve compliance with legal requirements.

114. After undertaking a risk assessment of a production system, the MOST appropriate action is for the risk manager to:

recommend a program that minimizes the concerns of that production system.

inform the development team of the concerns, and together formulate risk reduction measures.

inform the process owner of the concerns and propose measures to reduce them

inform the IT manager of the concerns and propose measures to reduce them.

115. The head of a business operations department asks to review the entire IT risk register .

Which of the following would be the risk manager s BEST approach to this request before sharing the register?

Escalate to senior management

Require a nondisclosure agreement.

Sanitize portions of the register

Determine the purpose of the request

116. Periodically reviewing and updating a risk register with details on identified risk factors PRIMARILY helps to:

minimize the number of risk scenarios for risk assessment.

aggregate risk scenarios identified across different business units.

build a threat profile of the organization for management review.

provide a current reference to stakeholders for risk-based decisions.

117. The acceptance of control costs that exceed risk exposure is MOST likely an example of:

low risk tolerance.

corporate culture misalignment.

corporate culture alignment.

high risk tolerance

118. Which of the following is the MOST important requirement for monitoring key risk indicators (KRls) using log analysis?

Obtaining logs m an easily readable format

Providing accurate logs m a timely manner

Collecting logs from the entire set of IT systems

implementing an automated log analysis tool

119. Which of the following is the MOST important consideration when developing an organization's risk taxonomy?

Leading industry frameworks

Business context

Regulatory requirements

IT strategy

120. Which of the following is the MAIN reason to continuously monitor IT-related risk?

To redefine the risk appetite and risk tolerance levels based on changes in risk factors

To update the risk register to reflect changes in levels of identified and new IT-related risk

To ensure risk levels are within acceptable limits of the organization's risk appetite and risk tolerance

To help identify root causes of incidents and recommend suitable long-term solutions

Page 13 of 30

121. Which of the following should be the HIGHEST priority when developing a risk response?

The risk response addresses the risk with a holistic view.

The risk response is based on a cost-benefit analysis.

The risk response is accounted for in the budget.

The risk response aligns with the organization's risk appetite.

122. Which of the following would BEST help an enterprise prioritize risk scenarios?

Industry best practices

Placement on the risk map

Degree of variances in the risk

Cost of risk mitigation

123. Which of the following would BEST help minimize the risk associated with social engineering threats?

Enforcing employees sanctions

Conducting phishing exercises

Enforcing segregation of dunes

Reviewing the organization's risk appetite

124. Which of the following is the MOST important foundational element of an effective three lines of defense model for an organization?

A robust risk aggregation tool set

Clearly defined roles and responsibilities

A well-established risk management committee

Well-documented and communicated escalation procedures

125. Which of the following would BEST help to ensure that suspicious network activity is identified?

Analyzing intrusion detection system (IDS) logs

Analyzing server logs

Using a third-party monitoring provider

Coordinating events with appropriate agencies

126. Which of the following is the MOST important consideration for a risk practitioner when making a system implementation go-live recommendation?

Completeness of system documentation

Results of end user acceptance testing

Variances between planned and actual cost

availability of in-house resources

127. IT risk assessments can BEST be used by management:

for compliance with laws and regulations

as a basis for cost-benefit analysis.

as input foe decision-making

to measure organizational success.

128. When reviewing management's IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios .

What should be the NEXT course of action?

Assess management's risk tolerance.

Recommend management accept the low risk scenarios.

Propose mitigating controls

Re-evaluate the risk scenarios associated with the control

129. Which of the following is the BEST way to validate the results of a vulnerability assessment?

Perform a penetration test.

Review security logs.

Conduct a threat analysis.

Perform a root cause analysis.

130. Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?

Changes in control design

A decrease in the number of key controls

Changes in control ownership

An increase in residual risk

Page 14 of 30

131. It is MOST appropriate for changes to be promoted to production after they are;

communicated to business management

tested by business owners.

approved by the business owner.

initiated by business users.

132. A business unit is updating a risk register with assessment results for a key project .

Which of the following is MOST important to capture in the register?

The team that performed the risk assessment

An assigned risk manager to provide oversight

Action plans to address risk scenarios requiring treatment

The methodology used to perform the risk assessment

133. A risk practitioner has identified that the organization's secondary data center does not provide redundancy for a critical application.

Who should have the authority to accept the associated risk?

Business continuity director

Disaster recovery manager

Business application owner

Data center manager

134. Which of the following would BEST ensure that identified risk scenarios are addressed?

Reviewing the implementation of the risk response

Creating a separate risk register for key business units

Performing real-time monitoring of threats

Performing regular risk control self-assessments

135. Which of the following is MOST important when developing key performance indicators (KPIs)?

Alignment to risk responses

Alignment to management reports

Alerts when risk thresholds are reached

Identification of trends

136. Which of the following is the BEST indication of an effective risk management program?

Risk action plans are approved by senior management.

Residual risk is within the organizational risk appetite

Mitigating controls are designed and implemented.

Risk is recorded and tracked in the risk register

137. A risk heat map is MOST commonly used as part of an IT risk analysis to facilitate risk:

identification.

treatment.

communication.

assessment

138. Which of the following IT controls is MOST useful in mitigating the risk associated with inaccurate data?

Encrypted storage of data

Links to source data

Audit trails for updates and deletions

Check totals on data records and data fields

139. Reviewing results from which of the following is the BEST way to identify information systems control deficiencies?

Vulnerability and threat analysis

Control remediation planning

User acceptance testing (UAT)

Control self-assessment (CSA)

140. An organization is planning to engage a cloud-based service provider for some of its data-intensive business processes .

Which of the following is MOST important to help define the IT risk associated with this outsourcing activity?

Service level agreement

Customer service reviews

Scope of services provided

Right to audit the provider

Page 15 of 30

141. Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an organization?

Better understanding of the risk appetite

Improving audit results

Enabling risk-based decision making

Increasing process control efficiencies

142. Which of the following is the MOST important characteristic of an effective risk management program?

Risk response plans are documented

Controls are mapped to key risk scenarios.

Key risk indicators are defined.

Risk ownership is assigned

143. Which of the following provides the BEST evidence of the effectiveness of an organization's account provisioning process?

User provisioning

Role-based access controls

Security log monitoring

Entitlement reviews

144. The PRIMARY reason a risk practitioner would be interested in an internal audit report is to:

plan awareness programs for business managers.

evaluate maturity of the risk management process.

assist in the development of a risk profile.

maintain a risk register based on noncompliances.

145. Which of the following is MOST important to understand when determining an appropriate risk assessment approach?

Complexity of the IT infrastructure

Value of information assets

Management culture

Threats and vulnerabilities

146. Which of the following is a PRIMARY benefit of engaging the risk owner during the risk assessment process?

Identification of controls gaps that may lead to noncompliance

Prioritization of risk action plans across departments

Early detection of emerging threats

Accurate measurement of loss impact

147. Which of the following is the MAIN reason for documenting the performance of controls?

Obtaining management sign-off

Demonstrating effective risk mitigation

Justifying return on investment

Providing accurate risk reporting

148. Which of the following would be considered a vulnerability?

Delayed removal of employee access

Authorized administrative access to HR files

Corruption of files due to malware

Server downtime due to a denial of service (DoS) attack

149. An audit reveals that several terminated employee accounts maintain access .

Which of the following should be the FIRST step to address the risk?

Perform a risk assessment

Disable user access.

Develop an access control policy.

Perform root cause analysis.

150. Which of the following would be the BEST way to help ensure the effectiveness of a data loss prevention (DLP) control that has been implemented to prevent the loss of credit card data?

Testing the transmission of credit card numbers

Reviewing logs for unauthorized data transfers

Configuring the DLP control to block credit card numbers

Testing the DLP rule change control process

Page 16 of 30

151. Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?

A decrease in control layering effectiveness

An increase in inherent risk

An increase in control vulnerabilities

An increase in the level of residual risk

152. Which of the following is MOST helpful to ensure effective security controls for a cloud service provider?

A control self-assessment

A third-party security assessment report

Internal audit reports from the vendor

Service level agreement monitoring

153. In addition to the risk register, what should a risk practitioner review to develop an understanding of the organization's risk profile?

The control catalog

The asset profile

Business objectives

Key risk indicators (KRls)

154. Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios?

Derive scenarios from IT risk policies and standards.

Map scenarios to a recognized risk management framework.

Gather scenarios from senior management.

Benchmark scenarios against industry peers.

155. The BEST way to justify the risk mitigation actions recommended in a risk assessment would be to:

align with audit results.

benchmark with competitor s actions.

reference best practice.

focus on the business drivers

156. Which of the following would be the BEST recommendation if the level of risk in the IT risk profile has decreased and is now below management's risk appetite?

Optimize the control environment.

Realign risk appetite to the current risk level.

Decrease the number of related risk scenarios.

Reduce the risk management budget.

157. An organization has outsourced its IT security operations to a third party.

Who is ULTIMATELY accountable for the risk associated with the outsourced operations?

The third party s management

The organization's management

The control operators at the third party

The organization's vendor management office

158. A risk practitioners PRIMARY focus when validating a risk response action plan should be that risk response:

reduces risk to an acceptable level

quantifies risk impact

aligns with business strategy

advances business objectives.

159. Which of the following is MOST critical when designing controls?

Involvement of internal audit

Involvement of process owner

Quantitative impact of the risk

Identification of key risk indicators

160. To implement the MOST effective monitoring of key risk indicators (KRIs), which of the following needs to be in place?

Threshold definition

Escalation procedures

Automated data feed

Controls monitoring

Page 17 of 30

161. Which of the following techniques would be used during a risk assessment to demonstrate to stakeholders that all known alternatives were evaluated?

Control chart

Sensitivity analysis

Trend analysis

Decision tree

162. Risk mitigation procedures should include:

buying an insurance policy.

acceptance of exposures

deployment of counter measures.

enterprise architecture implementation.

163. Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a disaster recovery plan (DRP)?

Number of users that participated in the DRP testing

Number of issues identified during DRP testing

Percentage of applications that met the RTO during DRP testing

Percentage of issues resolved as a result of DRP testing

164. Which of the following is the MOST important data source for monitoring key risk indicators (KRIs)?

Directives from legal and regulatory authorities

Audit reports from internal information systems audits

Automated logs collected from different systems

Trend analysis of external risk factors

165. An organization has allowed its cyber risk insurance to lapse while seeking a new insurance provider. The risk practitioner should report to management that the risk has been:

transferred

mitigated.

accepted

avoided

166. Which of the following controls will BEST detect unauthorized modification of data by a database administrator?

Reviewing database access rights

Reviewing database activity logs

Comparing data to input records

Reviewing changes to edit checks

167. Whether the results of risk analyses should be presented in quantitative or qualitative terms should be based PRIMARILY on the:

requirements of management.

specific risk analysis framework being used.

organizational risk tolerance

results of the risk assessment.

168. Which of the following is the BEST way to determine software license compliance?

List non-compliant systems in the risk register.

Conduct periodic compliance reviews.

Review whistlebtower reports of noncompliance.

Monitor user software download activity.

169. Which of the following BEST enables a proactive approach to minimizing the potential impact of unauthorized data disclosure?

Cyber insurance

Data backups

Incident response plan

Key risk indicators (KRIs)

170. An organization has completed a project to implement encryption on all databases that host customer data .

Which of the following elements of the risk register should be updated the reflect this change?

Risk likelihood

Inherent risk

Risk appetite

Risk tolerance

Page 18 of 30

171. Which of the following MOST effectively limits the impact of a ransomware attack?

Cyber insurance

Cryptocurrency reserve

Data backups

End user training

172. Which of the following BEST indicates that an organizations risk management program is effective?

Fewer security incidents have been reported.

The number of audit findings has decreased.

Residual risk is reduced.

inherent risk Is unchanged.

173. Which of the following is the MOST effective way to help ensure an organization's current risk scenarios are relevant?

Adoption of industry best practices

Involvement of stakeholders in risk assessment

Review of risk scenarios by independent parties

Documentation of potential risk in business cases

174. An organization has implemented a system capable of comprehensive employee monitoring .

Which of the following should direct how the system is used?

Organizational strategy

Employee code of conduct

Industry best practices

Organizational policy

175. Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?

A data extraction tool

An access control list

An intrusion detection system (IDS)

An acceptable usage policy

176. Which of the following is MOST helpful in developing key risk indicator (KRl) thresholds?

Loss expectancy information

Control performance predictions

IT service level agreements (SLAs)

Remediation activity progress

177. The BEST key performance indicator (KPI) to measure the effectiveness of a vendor risk management program is the percentage of:

vendors providing risk assessments on time.

vendor contracts reviewed in the past year.

vendor risk mitigation action items completed on time.

vendors that have reported control-related incidents.

178. An organization has engaged a third party to provide an Internet gateway encryption service that protects sensitive data uploaded to a cloud service.

This is an example of risk:

mitigation.

avoidance.

transfer.

acceptance.

179. A risk practitioner notices a trend of noncompliance with an IT-related control .

Which of the following would BEST assist in making a recommendation to management?

Assessing the degree to which the control hinders business objectives

Reviewing the IT policy with the risk owner

Reviewing the roles and responsibilities of control process owners

Assessing noncompliance with control best practices

180. Which of the following BEST confirms the existence and operating effectiveness of information systems controls?

Self-assessment questionnaires completed by management

Review of internal audit and third-party reports

Management review and sign-off on system documentation

First-hand direct observation of the controls in operation

Page 19 of 30

181. When reviewing a risk response strategy, senior management's PRIMARY focus should be placed on the:

cost-benefit analysis.

investment portfolio.

key performance indicators (KPIs).

alignment with risk appetite.

182. What should a risk practitioner do FIRST when vulnerability assessment results identify a weakness in an application?

Review regular control testing results.

Recommend a penetration test.

Assess the risk to determine mitigation needed.

Analyze key performance indicators (KPIs).

183. A bank wants to send a critical payment order via email to one of its offshore branches.

Which of the following is the BEST way to ensure the message reaches the intended recipient without alteration?

Add a digital certificate

Apply multi-factor authentication

Add a hash to the message

Add a secret key

184. What is the MOST important consideration when aligning IT risk management with the enterprise risk management (ERM) framework?

Risk and control ownership

Senior management participation

Business unit support

Risk nomenclature and taxonomy

185. Which of the following controls would BEST reduce the likelihood of a successful network attack through social engineering?

Automated controls

Security awareness training

Multifactor authentication

Employee sanctions

186. Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?

Single loss expectancy (SLE)

Cost of the information system

Availability of additional compensating controls

Potential business impacts are within acceptable levels

187. An organization is planning to acquire a new financial system .

Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?

Project sponsor

Process owner

Risk manager

Internal auditor

188. A department has been granted an exception to bypass the existing approval process for purchase orders.

The risk practitioner should verify the exception has been approved by which of the following?

Internal audit

Control owner

Senior management

Risk manager

189. A bank has outsourced its statement printing function to an external service provider .

Which of the following is the MOST critical requirement to include in the contract?

Monitoring of service costs

Provision of internal audit reports

Notification of sub-contracting arrangements

Confidentiality of customer data

190. Which of the following is MOST important for a risk practitioner to ensure once a risk action plan has been completed?

The risk owner has validated outcomes.

The risk register has been updated.

The control objectives are mapped to risk objectives.

The requirements have been achieved.

Page 20 of 30

191. Which of the following BEST helps to identify significant events that could impact an organization?

Vulnerability analysis

Control analysis

Scenario analysis

Heat map analysis

192. A control owner identifies that the organization's shared drive contains personally identifiable information (Pll) that can be accessed by all personnel .

Which of the following is the MOST effective risk response?

Protect sensitive information with access controls.

Implement a data loss prevention (DLP) solution.

Re-communicate the data protection policy.

Implement a data encryption solution.

193. Which of the following resources is MOST helpful when creating a manageable set of IT risk scenarios?

Results of current and past risk assessments

Organizational strategy and objectives

Lessons learned from materialized risk scenarios

Internal and external audit findings

194. Which of the following BEST enables a proactive approach to minimizing the potential impact of unauthorized data disclosure?

Key risk indicators (KRIs)

Data backups

Incident response plan

Cyber insurance

195. Which of the following is the MOST effective way to mitigate identified risk scenarios?

Assign ownership of the risk response plan

Provide awareness in early detection of risk.

Perform periodic audits on identified risk.

areas Document the risk tolerance of the organization.

196. An internally developed payroll application leverages Platform as a Service (PaaS) infrastructure from the cloud.

Who owns the related data confidentiality risk?

IT infrastructure head

Human resources head

Supplier management head

Application development head

197. A monthly payment report is generated from the enterprise resource planning (ERP) software to validate data against the old and new payroll systems .

What is the BEST way to mitigate the risk associated with data integrity loss in the new payroll system after data migration?

Compare new system reports with functional requirements.

Compare encrypted data with checksums.

Compare results of user acceptance testing (UAT) with the testing criteria.

Compare processing output from both systems using the previous month's data.

198. Which of the following would provide the MOST objective assessment of the effectiveness of an organization's security controls?

An internal audit

Security operations center review

Internal penetration testing

A third-party audit

199. Which of the following is the PRIMARY reason to establish the root cause of an IT security

incident?

Prepare a report for senior management.

Assign responsibility and accountability for the incident.

Update the risk register.

Avoid recurrence of the incident.

200. Which of the following is performed after a risk assessment is completed?

Defining risk taxonomy

Identifying vulnerabilities

Conducting an impact analysis

Defining risk response options

Page 21 of 30

201. The PRIMARY basis for selecting a security control is:

to achieve the desired level of maturity.

the materiality of the risk.

the ability to mitigate risk.

the cost of the control.

202. Which of the following should management consider when selecting a risk mitigation option?

Maturity of the enterprise architecture

Cost of control implementation

Reliability of key performance indicators (KPIs)

Reliability of key risk indicators (KPIs)

203. Which of the following is MOST important when developing risk scenarios?

The scenarios are based on industry best practice.

The scenarios focus on current vulnerabilities.

The scenarios are relevant to the organization.

The scenarios include technical consequences.

204. Who is PRIMARILY accountable for risk treatment decisions?

Risk owner

Business manager

Data owner

Risk manager

205. Which of the following BEST promotes commitment to controls?

Assigning control ownership

Assigning appropriate resources

Assigning a quality control review

Performing regular independent control reviews

206. IT disaster recovery point objectives (RPOs) should be based on the:

maximum tolerable downtime.

maximum tolerable loss of data.

need of each business unit.

type of business.

207. To mitigate the risk of using a spreadsheet to analyze financial data, IT has engaged a third-party vendor to deploy a standard application to automate the process .

Which of the following parties should own the risk associated with calculation errors?

business owner

IT department

Risk manager

Third-party provider

208. An organization has opened a subsidiary in a foreign country .

Which of the following would be the BEST way to measure the effectiveness of the subsidiary's IT systems controls?

Implement IT systems in alignment with business objectives.

Review metrics and key performance indicators (KPIs).

Review design documentation of IT systems.

Evaluate compliance with legal and regulatory requirements.

209. Which of the following is MOST influential when management makes risk response decisions?

Risk appetite

Audit risk

Residual risk

Detection risk

210. A PRIMARY function of the risk register is to provide supporting information for the development of an organization's risk:

strategy.

profile.

process.

map.

Page 22 of 30

211. Who should be responsible for implementing and maintaining security controls?

End user

Internal auditor

Data owner

Data custodian

212. Which of the following activities should be performed FIRST when establishing IT risk management processes?

Collect data of past incidents and lessons learned.

Conduct a high-level risk assessment based on the nature of business.

Identify the risk appetite of the organization.

Assess the goals and culture of the organization.

213. Which of the following should an organization perform to forecast the effects of a disaster?

Develop a business impact analysis (BIA).

Define recovery time objectives (RTO).

Analyze capability maturity model gaps.

Simulate a disaster recovery.

214. Which of the following would be of GREATEST assistance when justifying investment in risk response strategies?

Total cost of ownership

Resource dependency analysis

Cost-benefit analysis

Business impact analysis

215. Which of the following is the MOST important objective of regularly presenting the project risk register to the project steering committee?

To allocate budget for resolution of risk issues

To determine if new risk scenarios have been identified

To ensure the project timeline is on target

To track the status of risk mitigation actions

216. Which of the following is MOST critical to the design of relevant risk scenarios?

The scenarios are based on past incidents.

The scenarios are linked to probable organizational situations.

The scenarios are mapped to incident management capabilities.

The scenarios are aligned with risk management capabilities.

217. A software developer has administrative access to a production application .

Which of the following should be of GREATEST concern to a risk practitioner?

The administrative access does not allow for activity log monitoring.

The administrative access does not follow password management protocols.

The administrative access represents a deviation from corporate policy.

The administrative access represents a segregation of duties conflict.

218. Which of the following should be the PRIMARY focus of an independent review of a risk management process?

Accuracy of risk tolerance levels

Consistency of risk process results

Participation of stakeholders

Maturity of the process

219. An organization is considering modifying its system to enable acceptance of credit card payments.

To reduce the risk of data exposure, which of the following should the organization do FIRST?

Conduct a risk assessment.

Update the security strategy.

Implement additional controls.

Update the risk register.

220. The MAIN purpose of having a documented risk profile is to:

comply with external and internal requirements.

enable well-informed decision making.

prioritize investment projects.

keep the risk register up-to-date.

Page 23 of 30

221. Which of the following is the PRIMARY reason for an organization to ensure the risk register is updated regularly?

Risk assessment results are accessible to senior management and stakeholders.

Risk mitigation activities are managed and coordinated.

Key risk indicators (KRIs) are evaluated to validate they are still within the risk threshold.

Risk information is available to enable risk-based decisions.

222. An organization's internal audit department is considering the implementation of robotics process automation (RPA) to automate certain continuous auditing tasks.

Who would own the risk associated with ineffective design of the software bots?

Lead auditor

Project manager

Chief audit executive (CAE)

Chief information officer (CIO)

223. Which of the following should a risk practitioner do FIRST when an organization decides to use a cloud service?

Review the vendor selection process and vetting criteria.

Assess whether use of service falls within risk tolerance thresholds.

Establish service level agreements (SLAs) with the vendor.

Check the contract for appropriate security risk and control provisions.

224. Which of the following is MOST important for developing effective key risk indicators (KRIs)?

Engaging sponsorship by senior management

Utilizing data and resources internal to the organization

Including input from risk and business unit management

Developing in collaboration with internal audit

225. The PRIMARY purpose of vulnerability assessments is to:

provide clear evidence that the system is sufficiently secure.

determine the impact of potential threats.

test intrusion detection systems (IDS) and response procedures.

detect weaknesses that could lead to system compromise.

226. A key risk indicator (KRI) indicates a reduction in the percentage of appropriately patched servers .

Which of the following is the risk practitioner's BEST course of action?

Determine changes in the risk level.

Outsource the vulnerability management process.

Review the patch management process.

Add agenda item to the next risk committee meeting.

227. A company has located its computer center on a moderate earthquake fault .

Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The alternative site is a hot site with equipment ready to resume processing immediately.

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site does not reside on the same fault to matter how the distance apart.

228. Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced.

The risk practitioner should advise the risk owner to FIRST

review the key risk indicators.

conduct a risk analysis.

update the risk register

reallocate risk response resources.

229. Which of The following will BEST communicate the importance of risk mitigation initiatives to senior management?

Business case

Balanced scorecard

Industry standards

Heat map

230. IT stakeholders have asked a risk practitioner for IT risk profile reports associated with specific departments to allocate resources for risk mitigation.

The BEST way to address this request would be to use:

the cost associated with each control.

historical risk assessments.

key risk indicators (KRls).

information from the risk register.

Page 24 of 30

231. The MOST significant benefit of using a consistent risk ranking methodology across an organization is that it enables:

allocation of available resources

clear understanding of risk levels

assignment of risk to the appropriate owners

risk to be expressed in quantifiable terms

232. An organization has four different projects competing for funding to reduce overall IT risk .

Which project should management defer?

Project Charlie

Project Bravo

Project Alpha

Project Delta

233. Which of the following requirements is MOST important to include in an outsourcing contract to help ensure sensitive data stored with a service provider is secure?

A third-party assessment report of control environment effectiveness must be provided at least annually.

Incidents related to data toss must be reported to the organization immediately after they occur.

Risk assessment results must be provided to the organization at least annually.

A cyber insurance policy must be purchased to cover data loss events.

234. An organization has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data .

What should be The FIRST course of action?

Invoke the incident response plan.

Determine the business impact.

Conduct a forensic investigation.

Invoke the business continuity plan (BCP).

235. Which of the following methods would BEST contribute to identifying obscure risk scenarios?

Brainstorming sessions

Control self-assessments

Vulnerability analysis

Monte Carlo analysis

236. During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective .

Which of the following should be the risk practitioner's FIRST course of action?

Recommend risk remediation of the ineffective controls.

Compare the residual risk to the current risk appetite.

Determine the root cause of the control failures.

Escalate the control failures to senior management.

237. Which of the following should be a risk practitioner’s MOST important consideration when developing IT risk scenarios?

The impact of controls on the efficiency of the business in delivering services

Linkage of identified risk scenarios with enterprise risk management

Potential threats and vulnerabilities that may have an impact on the business

Results of network vulnerability scanning and penetration testing

238. Which of the following is the MOST important consideration when performing a risk assessment of a fire suppression system within a data center?

Insurance coverage

Onsite replacement availability

Maintenance procedures

Installation manuals

239. Which of the following should be the MAIN consideration when validating an organization's risk appetite?

Comparison against regulations

Maturity of the risk culture

Capacity to withstand loss

Cost of risk mitigation options

240. Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?

To enhance compliance with standards

To minimize subjectivity of assessments

To increase consensus among peers

To provide assessments for benchmarking

Page 25 of 30

241. Which of the following is MOST effective in continuous risk management process improvement?

Periodic assessments

Change management

Awareness training

Policy updates

242. Once a risk owner has decided to implement a control to mitigate risk, it is MOST important to develop:

a process for measuring and reporting control performance.

an alternate control design in case of failure of the identified control.

a process for bypassing control procedures in case of exceptions.

procedures to ensure the effectiveness of the control.

243. Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?

Risk policy review

Business impact analysis (B1A)

Control catalog

Risk register

244. Performing a background check on a new employee candidate before hiring is an example of what type of control?

Detective

Compensating

Corrective

Preventive

245. Which of the following is the PRIMARY role of the board of directors in corporate risk governance?

Approving operational strategies and objectives

Monitoring the results of actions taken to mitigate risk

Ensuring the effectiveness of the risk management program

Ensuring risk scenarios are identified and recorded in the risk register

246. Which of the following BEST helps to balance the costs and benefits of managing IT risk?

Prioritizing risk responses

Evaluating risk based on frequency and probability

Considering risk factors that can be quantified

Managing the risk by using controls

247. What can be determined from the risk scenario chart?

Relative positions on the risk map

Risk treatment options

Capability of enterprise to implement

The multiple risk factors addressed by a chosen response

248. Which of the following is MOST likely to be impacted as a result of a new policy which allows staff members to remotely connect to the organization's IT systems via personal or public computers?

Risk appetite

Inherent risk

Key risk indicator (KRI)

Risk tolerance

249. To minimize risk in a software development project, when is the BEST time to conduct a risk analysis?

During the business requirement definitions phase

Before periodic steering committee meetings

At each stage of the development life cycle

During the business case development

250. Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?

Cost versus benefit of additional mitigating controls

Annualized loss expectancy (ALE) for the system

Frequency of business impact

Cost of the Information control system

Page 26 of 30

251. Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?

The business case for the use of loT

The loT threat landscape

Policy development for loT

The network that loT devices can access

252. An IT operations team implements disaster recovery controls based on decisions from application owners regarding the level of resiliency needed.

Who is the risk owner in this scenario?

Business resilience manager

Disaster recovery team lead

Application owner

IT operations manager

253. An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes .

Which of the following would be the BEST metric to determine if the program is performing as expected?

Decrease in the time to move changes to production

Ratio of emergency fixes to total changes

Ratio of system changes to total changes

Decrease in number of changes without a fallback plan

254. Which of the following is the MAIN benefit of involving stakeholders in the selection of key risk indicators (KRIs)?

Improving risk awareness

Obtaining buy-in from risk owners

Leveraging existing metrics

Optimizing risk treatment decisions

255. An organization has recently updated its disaster recovery plan (DRP) .

Which of the following would be the GREATEST risk if the new plan is not tested?

External resources may need to be involved.

Data privacy regulations may be violated.

Recovery costs may increase significantly.

Service interruptions may be longer than anticipated.

256. Which of the following is the MOST important consideration when selecting either a qualitative or quantitative risk analysis?

Expertise in both methodologies

Maturity of the risk management program

Time available for risk analysis

Resources available for data analysis

257. The BEST way to test the operational effectiveness of a data backup procedure is to:

conduct an audit of files stored offsite.

interview employees to compare actual with expected procedures.

inspect a selection of audit trails and backup logs.

demonstrate a successful recovery from backup files.

258. Risk aggregation in a complex organization will be MOST successful when:

using the same scales in assessing risk

utilizing industry benchmarks

using reliable qualitative data for risk Hems

including primarily low level risk factors

259. Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?

The outsourcing of related IT processes

Outcomes of periodic risk assessments

Changes in service level objectives

Findings from continuous monitoring

260. An organization is unable to implement a multi-factor authentication requirement until the next fiscal year due to budget constraints. Consequently, a policy exception must be submitted .

Which of the following is MOST important to include in the analysis of the exception?

Sections of the policy that may justify not implementing the requirement

Risk associated with the inability to implement the requirement

Budget justification to implement the new requirement during the current year

Industry best practices with respect to implementation of the proposed control

Page 27 of 30

261. An organization has just implemented changes to close an identified vulnerability that impacted a critical business process .

What should be the NEXT course of action?

Redesign the heat map.

Review the risk tolerance.

Perform a business impact analysis (BIA)

Update the risk register.

262. Which of the following is MOST important to understand when developing key risk indicators (KRIs)?

KRI thresholds

Integrity of the source data

Control environment

Stakeholder requirements

263. A risk practitioner shares the results of a vulnerability assessment for a critical business application with the business manager .

Which of the following is the NEXT step?

Develop a risk action plan to address the findings.

Evaluate the impact of the vulnerabilities to the business application.

Escalate the findings to senior management and internal audit.

Conduct a penetration test to validate the vulnerabilities from the findings.

264. During a control review, the control owner states that an existing control has deteriorated over time .

What is the BEST recommendation to the control owner?

Implement compensating controls to reduce residual risk

Escalate the issue to senior management

Discuss risk mitigation options with the risk owner.

Certify the control after documenting the concern.

265. Who is accountable for risk treatment?

Enterprise risk management team

Risk mitigation manager

Business process owner

Risk owner

266. During the initial risk identification process for a business application, it is MOST important to include which of the following stakeholders?

Business process owners

Business process consumers

Application architecture team

Internal audit

267. Which of the following BEST confirms the existence and operating effectiveness of information systems controls?

Self-assessment questionnaires completed by management

Review of internal audit and third-party reports

Management review and sign-off on system documentation

First-hand direct observation of the controls in operation

268. The effectiveness of a control has decreased .

What is the MOST likely effect on the associated risk?

The risk impact changes.

The risk classification changes.

The inherent risk changes.

The residual risk changes.

269. Which of the following is MOST important to include in a Software as a Service (SaaS) vendor agreement?

An annual contract review

A service level agreement (SLA)

A requirement to adopt an established risk management framework

A requirement to provide an independent audit report

270. Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?

Chief financial officer

Information security director

Internal audit director

Chief information officer

Page 28 of 30

271. A risk practitioner recently discovered that sensitive data from the production environment is required for testing purposes in non-production environments .

Which of the following i the BEST recommendation to address this situation?

Enable data encryption in the test environment

Implement equivalent security in the test environment.

Prevent the use of production data for test purposes

Mask data before being transferred to the test environment.

272. Which of the following is the MAIN reason for analyzing risk scenarios?

Identifying additional risk scenarios

Updating the heat map

Assessing loss expectancy

Establishing a risk appetite

273. The implementation of a risk treatment plan will exceed the resources originally allocated for the risk response .

Which of the following should be the risk owner's NEXT action?

Perform a risk assessment.

Accept the risk of not implementing.

Escalate to senior management.

Update the implementation plan.

274. Which of the following will BEST help ensure that risk factors identified during an information systems review are addressed?

Informing business process owners of the risk

Reviewing and updating the risk register

Assigning action items and deadlines to specific individuals

Implementing new control technologies

275. Which type of cloud computing deployment provides the consumer the GREATEST degree of control over the environment?

Community cloud

Private cloud

Hybrid cloud

Public cloud

276. An IT risk practitioner is evaluating an organization's change management controls over the last six months. The GREATEST concern would be an increase in:

rolled back changes below management's thresholds.

change-related exceptions per month.

the average implementation time for changes.

number of user stories approved for implementation.

277. Which of the following is the GREATEST concern associated with the transmission of healthcare data across the internet?

Unencrypted data

Lack of redundant circuits

Low bandwidth connections

Data integrity

278. The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:

ensure policy and regulatory compliance.

assess the proliferation of new threats.

verify Internet firewall control settings.

identify vulnerabilities in the system.

279. Which of the following would be MOST helpful to a risk owner when making risk-aware decisions?

Risk exposure expressed in business terms

Recommendations for risk response options

Resource requirements for risk responses

List of business areas affected by the risk

280. Which of the following is MOST important for an organization that wants to reduce IT operational risk?

Increasing senior management's understanding of IT operations

Increasing the frequency of data backups

Minimizing complexity of IT infrastructure

Decentralizing IT infrastructure

Page 29 of 30

281. Which of the following is MOST important for an organization to have in place when developing a risk management framework?

A strategic approach to risk including an established risk appetite

A risk-based internal audit plan for the organization

A control function within the risk management team

An organization-wide risk awareness training program

282. Implementing which of the following will BEST help ensure that systems comply with an established baseline before deployment?

Vulnerability scanning

Continuous monitoring and alerting

Configuration management

Access controls and active logging

283. To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:

risk mitigation approach

cost-benefit analysis.

risk assessment results.

vulnerability assessment results

284. Which of the following risk register elements is MOST likely to be updated if the attack surface or exposure of an asset is reduced?

Likelihood rating

Control effectiveness

Assessment approach

Impact rating

285. Which of the following is the GREATEST concern when an organization uses a managed security service provider as a firewall administrator?

Exposure of log data

Lack of governance

Increased number of firewall rules

Lack of agreed-upon standards

286. Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact?

Risk magnitude

Incident probability

Risk appetite

Cost-benefit analysis

287. Which of these documents is MOST important to request from a cloud service

provider during a vendor risk assessment?

Nondisclosure agreement (NDA)

Independent audit report

Business impact analysis (BIA)

Service level agreement (SLA)

288. The risk associated with inadvertent disclosure of database records from a public cloud service provider (CSP) would MOST effectively be reduced by:

encrypting the data

including a nondisclosure clause in the CSP contract

assessing the data classification scheme

reviewing CSP access privileges

289. Which of the following is the BEST indication that an organization's risk management program has not reached the desired maturity level?

Significant increases in risk mitigation budgets

Large fluctuations in risk ratings between assessments

A steady increase in the time to recover from incidents

A large number of control exceptions

290. After identifying new risk events during a project, the project manager s NEXT step should be to:

determine if the scenarios need 10 be accepted or responded to.

record the scenarios into the risk register.

continue with a qualitative risk analysis.

continue with a quantitative risk analysis.

Page 30 of 30

291. During an IT department reorganization, the manager of a risk mitigation action plan was replaced. The new manager has begun implementing a new control after identifying a more effective option .

Which of the following is the risk practitioner's BEST course of action?

Communicate the decision to the risk owner for approval

Seek approval from the previous action plan manager.

Identify an owner for the new control.

Modify the action plan in the risk register.

292. Which of the following should be included in a risk assessment report to BEST facilitate senior management's understanding of the results?

Benchmarking parameters likely to affect the results

Tools and techniques used by risk owners to perform the assessments

A risk heat map with a summary of risk identified and assessed

The possible impact of internal and external risk factors on the assessment results

CRISC Certified in Risk and Information Systems Control Material

CRISC Certified in Risk and Information Systems Control Material

Share this post

Leave a Reply Cancel reply