DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

Pass Your CRISC Certification Questions & Practice Tests, Certified in Risk and Information Systems Control | SPOTO

Prepare to pass your CRISC certification exam with confidence using SPOTO's comprehensive resources. Access a wide range of practice tests and mock exams to assess your knowledge and readiness. Our exam materials, including exam dumps and sample questions, reinforce key concepts in risk management and information systems control. Utilize our exam simulator for realistic exam practice, simulating the exam environment and improving your time management skills. With SPOTO, you'll have all the tools you need to succeed in your CRISC certification journey. Start your exam preparation today and become a certified risk management expert capable of optimizing risk management across your organization.
Take other online exams
Question #1
What is the MAIN purpose of designing risk management programs? A. To reduce the risk to a level that the enterprise is willing to accept
B. To reduce the risk to the point at which the benefit exceeds the expense
C. To reduce the risk to a level that is too small to be measurable
D. To reduce the risk to a rate of return that equals the current cost of capital
View answer
Correct Answer: D

View The Updated CRISC Exam Questions

SPOTO Provides 100% Real CRISC Exam Questions for You to Pass Your CRISC Exam!

Get CRISC Practice Test
Question #2
One of the risk events you've identified is classified as force majeure. What risk response is likely to be used?
A. Acceptance
B. Transference
C. Enhance
D. Mitigation
View answer
Correct Answer: D
Question #3
Which among the following is the BEST reason for defining a risk response? A. To eliminate risk from the enterprise
B. To ensure that the residual risk is within the limits of the risk appetite and tolerance
C. To overview current status of risk
D. To mitigate risk
View answer
Correct Answer: C
Question #4
Which of the following considerations should be taken into account while selecting risk indicators that ensures greater buy-in and ownership?
A. Lag indicator
B. Lead indicator
C. Root cause
D. Stakeholder
View answer
Correct Answer: D
Question #5
Henry is the project sponsor of the JQ Project and Nancy is the project manager. Henry has asked Nancy to start the risk identification process for the project, but Nancy insists that the project team be involved in the process. Why should the project team be involved in the risk identification?
A. So that the project team can develop a sense of ownership for the risks and associated risk responsibilities
B. So that the project manager can identify the risk owners for the risks within the project and the needed risk responses
C. So that the project manager isn't the only person identifying the risk events within the project
D. So that the project team and the project manager can work together to assign risk ownership
View answer
Correct Answer: D
Question #6
During which of the following processes, probability and impact matrix are prepared?
A. Risk response
B. Monitoring and Control Risk
C. Quantitative risk assessment D
View answer
Correct Answer: A
Question #7
What are the PRIMARY objectives of a control? A. Detect, recover, and attack
B. Prevent, respond, and log
C. Prevent, control, and attack
D. Prevent, recover, and detect
View answer
Correct Answer: ABD
Question #8
You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events. Where will you record the mitigation response?
A. Risk register B
C. Project management plan
D. Risk management plan
View answer
Correct Answer: C
Question #9
You are the project manager of GHT project. You have initiated the project and conducted the feasibility study. What result would you get after conducting feasibility study? Each correct answer represents a complete solution. Choose all that apply.
A. Recommend alternatives and course of action
B. Risk response plan
C. Project management plan
D. Results of criteria analyzed, like costs, benefits, risk, resources required and organizational impact
View answer
Correct Answer: A
Question #10
Which of the following is the BEST way to ensure that outsourced service providers comply with the enterprise's information security policy?
A. Penetration testing
B. Service level monitoring
C. Security awareness training
D. Periodic audits
View answer
Correct Answer: D
Question #11
Which of the following are the common mistakes while implementing KRIs? Each correct answer represents a complete solution. Choose three.
A. Choosing KRIs that are difficult to measure
B. Choosing KRIs that has high correlation with the risk
C. Choosing KRIs that are incomplete or inaccurate due to unclear specifications
D. Choosing KRIs that are not linked to specific risk
View answer
Correct Answer: D
Question #12
Which of the following come under the phases of risk identification and evaluation? Each correct answer represents a complete solution. Choose three.
A. Maintain a risk profile
B. Collecting data
C. Analyzing risk
D. Applying controls
View answer
Correct Answer: B
Question #13
You work as a project manager for BlueWell Inc. You are involved with the project team on the different risk issues in your project. You are using the applications of IRGC model to facilitate the understanding and managing the rising of the overall risks that have impacts on the economy and society. One of your team members wants to know that what the need to use the IRGC is. What will be your reply?
A. IRGC models aim at building robust, integrative inter-disciplinary governance models for emerging and existing risks
B. IRGC is both a concept and a tool
C. IRGC addresses the development of resilience and the capacity of organizations and people to face unavoidable risks
D. IRGC addresses understanding of the secondary impacts of a risk
View answer
Correct Answer: A
Question #14
Which of the following statements is NOT true regarding the risk management plan?
A. The risk management plan is an output of the Plan Risk Management process
B. The risk management plan is an input to all the remaining risk-planning processes
C. The risk management plan includes a description of the risk responses and triggers
D. The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets
View answer
Correct Answer: A
Question #15
How residual risk can be determined?
A. By determining remaining vulnerabilities after countermeasures are in place
B. By transferring all risks
C. By threat analysis
D. By risk assessment
View answer
Correct Answer: ACD
Question #16
While considering entity-based risks, which dimension of the COSO ERM framework is being referred?
A. Organizational levels
B. Risk components
C. Strategic objectives
D. Risk objectives
View answer
Correct Answer: B
Question #17
You are the project manager of project for a client. The client has promised your company a bonus, if the project is completed early. After studying the project work, you elect to crash the project in order to realize the early end date. This is an example of what type of risk response?
A. Negative risk response, because crashing will add risks
B. Positive risk response, as crashing is an example of enhancing
C. Positive risk response, as crashing is an example of exploiting
D. Negative risk response, because crashing will add costs
View answer
Correct Answer: D
Question #18
Which of the following are the MOST important risk components that must be communicated among all the stakeholders? Each correct answer represents a part of the solution. Choose three.
A. Various risk response used in the project
B. Expectations from risk management
C. Current risk management capability
D. Status of risk with regard to IT risk
View answer
Correct Answer: ACD
Question #19
Which of the following risks is associated with not receiving the right information to the right people at the right time to allow the right action to be taken?
A. Relevance risk
B. Integrity risk
C. Availability risk
D. Access risk
View answer
Correct Answer: C
Question #20
Thomas is a key stakeholder in your project. Thomas has requested several changes to the project scope for the project you are managing. Upon review of the proposed changes, you have discovered that these new requirements are laden with risks and you recommend to the change control board that the changes be excluded from the project scope. The change control board agrees with you. What component of the change control system communicates the approval or denial of a proposed change request? A. Configuration m
B. Integrated change control
C. Change log
D. Scope change control system
View answer
Correct Answer: A
Question #21
What are the requirements of effectively communicating risk analysis results to the relevant stakeholders? Each correct answer represents a part of the solution. Choose three.
A. The results should be reported in terms and formats that are useful to support business decisions
B. Communicate only the negative risk impacts of events in order to drive response decisions
C. Communicate the risk-return context clearly
D. Provide decision makers with an understanding of worst-case and most probable scenarios
View answer
Correct Answer: B
Question #22
Your project has several risks that may cause serious financial impact if they occur. You have studied the risk events and made some potential risk responses for the risk events but management wants you to do more. They'd like you to create some type of a chart that identified the risk probability and impact with a financial amount for each risk event. What is the likely outcome of creating this type of chart? A. Risk response plan
B. Contingency reserve
C. Risk response
D. Quantitative analysis
View answer
Correct Answer: D
Question #23
John is the project manager of the NHQ Project for his company. His project has 75 stakeholders, some of which are external to the organization. John needs to make certain that he communicates about risk in the most appropriate method for the external stakeholders. Which project management plan will be the best guide for John to communicate to the external stakeholders?
A. Risk Response Plan
B. Communications Management Plan
C. Project Management Plan
D. Risk Management Plan
View answer
Correct Answer: B
Question #24
You are the risk official in Techmart Inc. You are asked to perform risk assessment on the impact of losing a server. For this assessment you need to calculate monetary value of the server. On which of the following bases do you calculate monetary value?
A. Cost to obtain replacement
B. Original cost to acquire
C. Annual loss expectancy
D. Cost of software stored
View answer
Correct Answer: ACDE
Question #25
Kelly is the project manager of the NNQ Project for her company. This project will last for one year and has a budget of $350,000. Kelly is working with her project team and subject matter experts to begin the risk response planning process. What are the two inputs that Kelly would need to begin the plan risk response process? A. Risk register and the results of risk analysis
B. Risk register and the risk response plan
C. Risk register and power to assign risk responses
D. Risk register and the risk management plan
View answer
Correct Answer: B
Question #26
You are the Risk Official in Bluewell Inc. You have detected much vulnerability during risk assessment process. What you should do next?
A. Prioritize vulnerabilities for remediation solely based on impact
B. Handle vulnerabilities as a risk, even though there is no threat
C. Analyze the effectiveness of control on the vulnerabilities' basis
D. Evaluate vulnerabilities for threat, impact, and cost of mitigation
View answer
Correct Answer: A
Question #27
Which of the following comes under phases of risk management?
A. Assessing risk
B. Prioritization of risk
C. Identify risk
D. Monitoring risk
E. Developing risk
View answer
Correct Answer: D
Question #28
Which of the following establishes mandatory rules, specifications and metrics used to measure compliance against quality, value, etc? A. Framework
B. Legal requirements
C. Standard
D. Practices
View answer
Correct Answer: B
Question #29
You are the project manager of the AFD project for your company. You are working with the project team to reassess existing risk events and to identify risk events that have not happened and whose relevancy to the project has passed. What should you do with these events that have not happened and would not happen now in the project?
A. Add the risk to the issues log
B. Close the outdated risks C
D. Add the risks to a low-priority watch-list
View answer
Correct Answer: A
Question #30
Mike is the project manager of the NNP Project for his organization. He is working with his project team to plan the risk responses for the NNP Project. Mike would like the project team to work together on establishing risk thresholds in the project. What is the purpose of establishing risk threshold?
A. It is a study of the organization's risk tolerance
B. It is a warning sign that a risk event is going to happen
C. It is a limit of the funds that can be assigned to risk events
View answer
Correct Answer: C
Question #31
There are four inputs to the Monitoring and Controlling Project Risks process. Which one of the following will NOT help you, the project manager, to prepare for risk monitoring and controlling?
A. Risk register
B. Work Performance Information
C. Project management plan D
View answer
Correct Answer: A
Question #32
You are the project manager for Bluewell Inc. You are studying the documentation of project plan. The documentation states that there are twenty-five stakeholders with the project. What will be the number of communication channel s for the project?
A. 20
B. 100 C
D. 300
View answer
Correct Answer: C
Question #33
In which of the following risk management capability maturity levels risk appetite and tolerance are applied only during episodic risk assessments?
A. Level 3
B. Level 2
C. Level 4
D. Level 1
View answer
Correct Answer: B
Question #34
What type of policy would an organization use to forbid its employees from using organizational e-mail for personal use? A. Anti-harassment policy
B. Acceptable use policy
C. Intellectual property policy
D. Privacy policy
View answer
Correct Answer: D
Question #35
Which of the following is true for risk evaluation?
A. Risk evaluation is done only when there is significant change
B. Risk evaluation is done once a year for every business processes
C. Risk evaluation is done annually or when there is significant change
D. Risk evaluation is done every four to six months for critical business processes
View answer
Correct Answer: D
Question #36
You are the project manager for BlueWell Inc. You have noticed that the risk level in your project increases above the risk tolerance level of your enterprise. You have applied several risk response. Now you have to update the risk register in accordance to risk response process. All of the following are included in the risk register except for which item?
A. Risk triggers B
C. Network diagram analysis of critical path activities
D. Risk owners and their responsibility
View answer
Correct Answer: D
Question #37
Which of the following individuals is responsible for identifying process requirements, approving process design and managing process performance?
A. Business process owner
B. Risk owner
C. Chief financial officer
D. Chief information officer
View answer
Correct Answer: BCD
Question #38
You are the project manager of GHT project. You have identified a risk event on your current project that could save $670,000 in project costs if it occurs. Your organization is considering hiring a vendor to help establish proper project management techniques in order to assure it realizes these savings. Which of the following statements is TRUE for this risk event?
A. This risk event should be accepted because the rewards outweigh the threat to the project
B. This risk event should be mitigated to take advantage of the savings
C. This risk event is an opportunity to the project and should be exploited
D. This is a risk event that should be shared to take full advantage of the potential savings
View answer
Correct Answer: C
Question #39
Which among the following is the MOST crucial part of risk management process?
A. Risk communication
B. Auditing
C. Risk monitoring
D. Risk mitigation
View answer
Correct Answer: ACD

View The Updated ISACA Exam Questions

SPOTO Provides 100% Real ISACA Exam Questions for You to Pass Your ISACA Exam!

Get ISACA Practice Test

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.