السؤال #1

Which of the following is the GREATEST benefit to an organization when updates to the risk register are made promptly after the completion of a risk assessment?

A. Enhanced awareness of risk management

B. Improved collaboration among risk professionals

C. Optimized risk treatment decisions

D. Improved senior management communication

عرض الإجابة

اجابة صحيحة: C

السؤال #2

which of the following the PRIMARY consideration when establishing an organization risk management the colony?

A. risk to lesson level

B. benchmarking information

C. resource requirements

D. business context

عرض الإجابة

اجابة صحيحة: D

السؤال #3

which of the following BEST Indicates effective Information security Incident management?

A. percentage of high-risk security incidents

B. Average time to Identify critical information security accidents

C. Monthly trend of information security-related incidents,

D. Frequency of information security incident response plan testing

عرض الإجابة

اجابة صحيحة: D

السؤال #4

The PRIMARY benefit of conducting continuous monitoring of access contracts is the ability to identify

A. inconsistencies between security policies and procedures

B. leading or lagging key risk indicators (KRIs)

C. possible noncompliant activities that lead to data disclosure

D. unknown threats to undermine existing access controls

عرض الإجابة

اجابة صحيحة: C

السؤال #5

The BEST key performance indicator (KPI) for monitoring adherence to an organization's user accounts provisioning practices is the percentage of:

A. accounts without documented approval

B. user accounts with default passwords

C. active accounts belonging to former personnel

D. accounts with dormant activity

عرض الإجابة

اجابة صحيحة: A

السؤال #6

Which of the following is the GREATEST benefit to an organization when updates to the risk register are made promptly after the completion of a risk assessment?

A. Enhanced awareness of risk management

B. Improved collaboration among risk professionals

C. Optimized risk treatment decisions

D. Improved senior management communication

عرض الإجابة

اجابة صحيحة: C

السؤال #7

which of the following is the most important objective of embedding risk management practices into the initiation phase of the project management life cycle?

A. TO assess risk throughout the project

B. To deliver projects on time and on budget

C. To include project risk in the enterprise-wide IT risk profile

D. To assess inherent risk

عرض الإجابة

اجابة صحيحة: A

السؤال #8

Which of the following is MOST helpful to management when determining the resources needed to mitigate a risk?

A. A vulnerability report

B. A heat map

C. An internal audit

D. A business impact analysis (BIA)

عرض الإجابة

اجابة صحيحة: D

السؤال #9

Which of the following is the BEST way to determine whether new controls mitigate security gaps in a business system?

A. Measure the change in inherent risk

B. Complete an offsite business continuity exercise

C. Conduct a compliance check against standards

D. Perform a vulnerability assessment

عرض الإجابة

اجابة صحيحة: D

السؤال #10

the main purpose of a risk register is to:

A. identify shareholders associated with risk scenarios

B. document the risk universe of organization

C. enable well-informed risk management decisions

D. promote an understanding of risk across the organization

عرض الإجابة

اجابة صحيحة: C

السؤال #11

who is responsible for IT security controls that are outstanding to an external service provider?

A. service provider's information security manager

B. organization's risk function

C. service provider's IT management

D. organization's information security manager

عرض الإجابة

اجابة صحيحة: B

السؤال #12

Business areas within an organization have engaged various cloud service providers directly without assistance from the IT department. What should the risk practitioner do?

A. Escalate to the risk committee

B. Engage with the business area managers to review controls applied

C. Recommend a risk assessment be conducted

D. Recommend the IT department remove access to the cloud services

عرض الإجابة

اجابة صحيحة: B

السؤال #13

Accountability for a particular risk is BEST represented in a:

A. risk catalog

B. risk register

C. risk scenario

D. risk matrix

عرض الإجابة

اجابة صحيحة: D

السؤال #14

Which of the following MOST effectively limits the impact of a ransomware attack?

A. End user training

B. Data backups

C. Cyber insurance

D. Cryptocurrency reserve

عرض الإجابة

اجابة صحيحة: B

السؤال #15

which of the following is the primary benefit of using an entry in the risk register on track of the aggregate risk associated with server failure?

A. It provides a cost-benefit analysis on control options availiable for implementation

B. It provides a view on where controls should be applied to maximize of servers

C. It provides historical information about the impact of individual servers malfunctioning

D. It provides a comprehensive view of the impact should the servers multiply fail

عرض الإجابة

اجابة صحيحة: D

السؤال #16

when developing IT risk scenarios, it is most important to consider:

A. executive management directives

B. the organization's threat profile

C. organizational objectives

D. external audit findings

عرض الإجابة

اجابة صحيحة: C

السؤال #17

Which of the following is performed after a risk assessment is completed?

A. Defining risk taxonomy

B. Identifying vulnerabilities

C. Defining risk response options

D. Conducting an impact analysis

عرض الإجابة

اجابة صحيحة: D

السؤال #18

Who should be responsible for implementing and maintaining security controls?

A. End user

B. Data owner

C. Internal auditor

D. Data custodian

عرض الإجابة

اجابة صحيحة: B

السؤال #19

which of the following is the most effective key performance indicator {KPI} for change management?

A. average the required to implement a change

B. percentage of change with a fallback plan

C. number of changes implemented

D. percentage of successful changes

عرض الإجابة

اجابة صحيحة: D

السؤال #20

which of the following provides the most helpful information in identify risk in an organization?

A. risk scenarios

B. risk analysis

C. risk register

D. risk responses

عرض الإجابة

اجابة صحيحة: A

السؤال #21

QUESTION 83IT disaster recovery point objectives (RPOs) should be based on the:

A. maximum tolerable downtime

B. maximum tolerable loss of data

C. need of each business unit

D. type of business

عرض الإجابة

اجابة صحيحة: C

السؤال #22

which of the following should be considered FIRST when assessing risk associated with the adoption of emerging technologies?

A. Control self-assessment (CSA)

B. Cost-benefit analysis

C. organizational strategy

D. Business requirements

عرض الإجابة

اجابة صحيحة: C

السؤال #23

The BEST way to obtain senior management support for investment in a control implementation would be to articulate the reduction in:

A. inherent risk

B. residual risk

C. vulnerabilities

D. detected incidents

عرض الإجابة

اجابة صحيحة: A

السؤال #24

a proper advantage involving business management in evaluating and managing that management:

A. better understands the system architecture

B. can make better informed business decision

C. is more objective than risk management

D. can balance technical and business risk

عرض الإجابة

اجابة صحيحة: B

السؤال #25

which of these documents is most important to request from a cloud service provide during a vender risk assessment?

A. independent and report

B. business impact analysis (BIA)

C. service level agreement (SLA)

D. nondisclosure agreement (NDA)

عرض الإجابة

اجابة صحيحة: A

السؤال #26

Which of the following is MOST essential for an effective change control environment?

A. Separation of development and production environments

B. Business management approval of change requests

C. IT management review of implemented changes

D. Requirement of an implementation rollback plan

عرض الإجابة

اجابة صحيحة: B

السؤال #27

which of the following is the best way to identity changes in the risk profile of an organization?

A. monitor key risk indicator (KRIs)

B. monitor key performance indicator (KRIs)

C. conduct a gap analysis

D. interview the risk owner

عرض الإجابة

اجابة صحيحة: C

السؤال #28

A risk assessment has identified Increased losses associated with an IT risk scenario. It is MOST important for the risk practitioner to:

A. update the risk rating

B. revaluate inherent risk

C. develop new risk scenarios

D. implement additional controls

عرض الإجابة

اجابة صحيحة: A

السؤال #29

A risk assessment indicates the residual risk associated with a new bring your own device (BYOD) program is within organizational risk tolerance. Which of the following should the risk practitioner recommend be done NEXT?

A. Implement monitoring to detect control deterioration

B. Identify log Sources to monitor BYOD usage and risk impact

C. Implement targeted awareness training for new BYOD users

D. Reduce the risk tolerance level

عرض الإجابة

اجابة صحيحة: A

السؤال #30

During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards. The overall control environment may still be effective if:

A. a control mitigation plan is in place

B. residual risk is accepted

C. risk management is effective

D. compensating controls are in place

عرض الإجابة

اجابة صحيحة: D

السؤال #31

IT stakeholders have asked risk practitioner for IT risk profile reports associated with specify departments to allocate resources for risk mitigation. the best way to address is request would be to use:

A. the cost associated with each control

B. historicity assessments

C. information from the risk register

D. key risk indicators (KPIs)

عرض الإجابة

اجابة صحيحة: C

السؤال #32

which of the following is the MOST relevant information to include iIn a risk management strategy?

A. cost of controls

B. Quantified risk triggers

C. Organizational goals

D. Regulatory requirements

عرض الإجابة

اجابة صحيحة: C

السؤال #33

An organization's chief technology officer (CTO) has decided to accept the risk associated with thepotential loss from a denial-of-service (DoS) attack in this situation, what is the risk practitioner's BEST course of action?

A. Update the risk register with the selected risk response

B. Recommend that the CTO revisit the risk acceptance decision

C. Identify key risk indicators (KRIs) for ongoing monitoring

D. Validate the CTO's decision with the business process owner

عرض الإجابة

اجابة صحيحة: C

السؤال #34

Which of the following is the PRIMARY purpose of periodically reviewing an organization's risk profile?

A. Update risk responses in the risk register

B. Enable risk-based decision making

C. Align business objectives with risk appetite

D. Design and implement risk response action plans

عرض الإجابة

اجابة صحيحة: B

السؤال #35

Which of the following is MOST important to sustainable development of secure IT services?

A. Security training for systems development staff

B. Security architecture principles

C. Well-documented business cases

D. Secure coding practices

عرض الإجابة

اجابة صحيحة: B

السؤال #36

Which of the following is MOST important to the effective monitoring of key risk indications (KPIs)?

A. preventing the generation of false alerts

B. updating the threat inventory with new threats

C. determining threshold levels

D. automating log data analysis

عرض الإجابة

اجابة صحيحة: C

السؤال #37

"read" rights to application files in a controlled server environment should be approved by the :

A. database administrator

B. chief Information officer

C. business process owner

D. systems administrator

عرض الإجابة

اجابة صحيحة: C

السؤال #38

Prior to selecting key performance indicators (KPIS), it is MOST important to ensure:

A. process flowcharts are current

B. data collection technology is available

C. measurement objectives are defined

D. trending data is available

عرض الإجابة

اجابة صحيحة: C

السؤال #39

When reviewing a business continuity plan (BCP), which of the following would be the MOST significant deficiency?

A. Each business location has separate, inconsistent BCPs

B. BCP is often tested using the walk-through method

C. Recovery time objectives (RTOS) do not meet business requirements

D. BCP testing is not in conjunction with the disaster recovery plan (DRP)

عرض الإجابة

اجابة صحيحة: C

السؤال #40

An organization striving to be on the leading edge in regard to risk monitoring would MOST likely implement

A. monitoring activities for all critical assets

B. a tool for monitoring critical activities and controls

C. real-time monitoring of risk events and control exceptions

D. procedures monitor the operation of controls

عرض الإجابة

اجابة صحيحة: C

السؤال #41

which of the following would be most useful to senior management when determinate an appropriate response?

A. A comparison of current risk levels with established tolerance

B. A comparison of cost variance with defined response strategies

C. A comparison of current risk levels with estimated inherent risk levels

D. A comparison of accepted risk scenarios associated with regulation compliance

عرض الإجابة

اجابة صحيحة: A

السؤال #42

Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?

A. Implement segregation of duties

B. Apply single sign-on for access control

C. Enforce the use of digital signatures

D. Enforce internal data access policy

عرض الإجابة

اجابة صحيحة: D

السؤال #43

Mitigating technology risk to acceptable levels should be based PRIMARILY upon:

A. organizational risk appetite

B. business sector best practices

C. availability of automated solutions

D. business process requirements

عرض الإجابة

اجابة صحيحة: D

السؤال #44

Which of the following will BEST help to ensure that information system controls are effective?

A. Responding promptly to control exceptions

B. Testing controls periodically

C. Implementing compensating controls

D. Automating manual controls

عرض الإجابة

اجابة صحيحة: B

السؤال #45

An organization's IT infrastructure is running end-of-life software that is not allowed without exception approval. Which of the following would provide the MOST helpful information to justify investing in updated software?

A. The balanced Scorecard

B. A cost-benefit analysis

C. A roadmap of IT strategic planning

D. The risk management framework

عرض الإجابة

اجابة صحيحة: B

السؤال #46

a risk practitioner has identified that the organization's secondary data center does and provide redundany for actical application. who should have the authority to accept the assess risk?

A. dictator recovery management

B. business application owner

C. business continuity direction

D. data center manager

عرض الإجابة

اجابة صحيحة: B

السؤال #47

which of the following best indicates that an organization has implemented IT performance requirements?

A. benchmarking data

B. service level agreements

C. account ability matrix

D. vendor references

عرض الإجابة

اجابة صحيحة: B

السؤال #48

The annualized loss expectancy (ALE) method of risk analysis:

A. can be used to determine the indirect business impact

B. can be used in a cost-benefit analysis:

C. helps in calculating the expected cost of controls:

D. uses qualitative risk rankings such as low, medium, and high

عرض الإجابة

اجابة صحيحة: B

السؤال #49

Which of the following statements BEST describes risk appetite?

A. The effective management of risk and internal control environments

B. Acceptable variation between risk thresholds and business objectives

C. The acceptable variation relative to the achievement of objectives

D. The amount of risk an organization is willing to accept

عرض الإجابة

اجابة صحيحة: D

السؤال #50

Who is MOST likely to be responsible for the coordination between the lT risk strategy and the business risk strategy?

A. Internal audit director

B. Information security director

C. Chief financial officer

D. Chief information officer

عرض الإجابة

اجابة صحيحة: B

السؤال #51

Which of the following is the primary reason to have the risk management process reviewed by a third party?

A. Obtaining an object view of process gaps and system errors:

B. Obtain objective assessment of the control environment

C. validate the threat management process

D. Ensure the risk profile is defined and communicated

عرض الإجابة

اجابة صحيحة: B

السؤال #52

The PRIMARY objective for requiring an independent review of an organization's IT risk mana

A. can be used to determine the indirect business impact

B. can be used in a cost-benefit analysis

C. helps in calculating the expected cost of controls

D. uses qualitative risk rankings such as low, medium, and high

عرض الإجابة

اجابة صحيحة: B

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

View The Updated CRISC Exam Questions

View The Updated ISACA Exam Questions

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

View The Updated CRISC Exam Questions

View The Updated ISACA Exam Questions

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان