[Nov 08, 2023] Get New CRISC Certification – Valid Exam Dumps Questions
100% Passing Guarantee - Brilliant CRISC Exam Questions PDF
NEW QUESTION # 707
Which of the following is a risk practitioner's BEST course of action upon learning that a control under internal review may no longer be necessary?
- A. Verify the effectiveness of the original mitigation plan.
- B. Consult the internal auditor for a second opinion.
- C. Update the status of the control as obsolete.
- D. Obtain approval to retire the control.
Answer: C
NEW QUESTION # 708
Whose risk tolerance matters MOST when making a risk decision?
- A. Customers who would be affected by a breach
- B. The business process owner of the exposed assets
- C. The information security manager
- D. Auditors, regulators, and standards organizations
Answer: D
Explanation:
Section: Volume D
NEW QUESTION # 709
You are the project manager of GHT project. You identified a risk of noncompliance with regulations due to missing of a number of relatively simple procedures.
The response requires creating the missing procedures and implementing them. In which of the following risk response prioritization should this case be categorized?
- A. Business case to be made
- B. Risk avoidance
- C. Deferrals
- D. Quick win
Answer: D
Explanation:
Explanation/Reference:
Explanation:
This is categorized as a "quick win" because the allocation of existing resources or a minor resource investment provides measurable benefits. Quick win is very effective and efficient response that addresses medium to high risk.
Incorrect Answers:
A: "Business case to be made" requires careful analysis and management decisions on investments that are more expensive or difficult risk responses to medium to high risk. Here in this scenario, there is only minor investment that is why, it is not "business case to be made".
C: Risk avoidance is a type of risk response and not risk response prioritization option.
D: Deferral addresses costly risk response to a low risk, and hence in this specified scenario it is not used.
NEW QUESTION # 710
Which of the following is the BEST approach to mitigate the risk associated with a control deficiency?
- A. Perform a business case analysis
- B. Implement compensating controls.
- C. Conduct a control sell-assessment (CSA)
- D. Build a provision for risk
Answer: C
NEW QUESTION # 711
Which of the following would be MOST helpful when estimating the likelihood of negative events?
- A. Threat analysis
- B. Cost-benefit analysis
- C. Business impact analysis
- D. Risk response analysis
Answer: A
NEW QUESTION # 712
A change management process has recently been updated with new testing procedures. The NEXT course of action is to:
- A. monitor processes to ensure recent updates are being followed
- B. communicate to those who test and promote changes
- C. conduct a cost-benefit analysis to justify the cost of the control
- D. assess the maturity of the change management process
Answer: A
NEW QUESTION # 713
Prudent business practice requires that risk appetite not exceed:
- A. risk tolerance.
- B. inherent risk.
- C. risk capacity.
- D. residual risk.
Answer: A
NEW QUESTION # 714
A risk owner should be the person accountable for:
- A. implementing actions.
- B. managing controls.
- C. the business process.
- D. the risk management process
Answer: A
NEW QUESTION # 715
A PRIMARY advantage of involving business management in evaluating and managing risk is that management:
- A. can make better informed business decisions
- B. is more objective than risk management
- C. can balance technical and business risk
- D. better understands the system architecture
Answer: A
NEW QUESTION # 716
Risks with low ratings of probability and impact are included for future monitoring in which of the following?
- A. Observation list
- B. Risk alarm
- C. Watch-list
- D. Risk register
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Watch-list contains risks with low rating of probability and impact. This list is useful for future monitoring of low risk factors.
Incorrect Answers:
A, B: No such documents as risk alarm and observation list is prepared during risk identification process.
D: Risk register is a document that contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning. Description, category, cause, probability of occurring, impact on objectives, proposed responses, owner, and the current status of all identified risks are put in the risk register.
NEW QUESTION # 717
Which of the following is the MOST effective way to integrate risk and compliance management?
- A. Embedding risk management into processes that are aligned with business drivers
- B. Embedding risk management into compliance decision-making
- C. Conducting regular self-assessments to verify compliance
- D. Designing corrective actions to improve risk response capabilities
Answer: A
NEW QUESTION # 718
What are the two MAJOR factors to be considered while deciding risk appetite level? Each correct answer represents a part of the solution. Choose two.
- A. The amount of loss the enterprise wants to accept
- B. The capacity of the enterprise's objective to absorb loss.
- C. Risk-aware decisions
- D. Explanation:
Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission. This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the following two major factors should be taken into account: The enterprise's objective capacity to absorb loss, e.g., financial loss, reputation damage, etc. The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the enterprise wants to accept in pursue of its objective fulfillment. - E. Alignment with risk-culture
Answer: A,B,D
Explanation:
is incorrect. Alignment with risk-culture is also one of the factors but is not as important as these two. Answer: C is incorrect. Risk aware decision is not the factor, but is the result which uses risk appetite information as its input.
NEW QUESTION # 719
Which of the following will BEST help to ensure that information system controls are effective?
- A. Automating manual controls
- B. Testing controls periodically
- C. Responding promptly to control exceptions
- D. Implementing compensating controls
Answer: B
NEW QUESTION # 720
Determining if organizational risk is tolerable requires:
- A. mapping residual risk with cost of controls
- B. comparing against regulatory requirements
- C. understanding the organization's risk appetite.
- D. comparing industry risk appetite with the organization's.
Answer: C
NEW QUESTION # 721
You are using Information system. You have chosen a poor password and also sometimes transmits data over unprotected communication lines. What is this poor quality of password and unsafe transmission referring to?
- A. Vulnerabilities
- B. Probabilities
- C. Threats
- D. Impacts
Answer: A
Explanation:
Section: Volume C
Explanation:
Vulnerabilities represent characteristics of information resources that may be exploited by a threat. The given scenario describes such a situation, hence it is a vulnerability.
Incorrect Answers:
A: Probabilities represent the likelihood of the occurrence of a threat, and this scenario does not describe a probability.
B: Threats are circumstances or events with the potential to cause harm to information resources. This scenario does not describe a threat.
D: Impacts represent the outcome or result of a threat exploiting a vulnerability. The stem does not describe an impact.
NEW QUESTION # 722
The PRIMARY objective for selecting risk response options is to:
- A. reduce risk factors.
- B. minimize residual risk.
- C. identify compensating controls.
- D. reduce risk 10 an acceptable level.
Answer: D
NEW QUESTION # 723
An organization's control environment is MOST effective when:
- A. controls are implemented consistent
- B. controls operate efficiently.
- C. control designs are reviewed periodically
- D. controls perform as intended.
Answer: D
NEW QUESTION # 724
Which of the following processes is described in the statement below?
"It is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions."
- A. Risk communication
- B. Risk response planning
- C. Risk governance
- D. Explanation:
Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner. Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders. Risk communication can be explained more clearly with the help of the following definitions: It defines the issue of what a group does, not just what it says. It must take into account the valuable element in user's perceptions of risk. It will be more valuable if it is thought of as conversation, not instruction.
Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders. - E. Risk identification
Answer: A,D
Explanation:
is incorrect. A risk response ensures that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is process of selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost and benefit of the particular risk response option. Risk response ensures that management is providing accurate reports on: The level of risk faced by the enterprise The incidents' type that have occurred Any alteration in the enterprise's risk profile based on changes in the risk environment
NEW QUESTION # 725
Mitigating technology risk to acceptable levels should be based PRIMARILY upon:
- A. organizational risk appetite.
- B. business process requirements.
- C. business sector best practices.
- D. availability of automated solutions.
Answer: A
NEW QUESTION # 726
A risk practitioner has discovered a deficiency in a critical system that cannot be patched. Which of the following should be the risk practitioner's FIRST course of action?
- A. Conduct a risk assessment.
- B. Report the issue to internal audit.
- C. Review the business impact assessment.
- D. Submit a request to change management.
Answer: A
NEW QUESTION # 727
Which of the following characteristics of risk controls answers the aspect about the control given below:
"Will it continue to function as expressed over the time and adopts as changes or new elements are introduced to the environment"
- A. Reliability
- B. Sustainability
- C. Distinct
- D. Consistency
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Sustainability ensures that the control continues to function as expressed over the time and adopts as changes or new elements are introduced to the environment.
Incorrect Answers:
A: Reliability of control ensures that it will serve its purpose under multiple circumstances.
C: Consistent characteristic of the control tells whether the control can be applied in the same manner across the organization.
D: A control or countermeasure which does not overlap in its performance with another control or countermeasure is considered as distinct. Hence the separation of controls in the production environment rather than the separation in the design and implementation of the risk refers to distinct.
NEW QUESTION # 728
Senior management wants to increase investment in the organization's cybersecurity program in response to changes in the external threat landscape. Which of the following would BEST help to prioritize investment efforts?
- A. Engaging independent cybersecurity consultants
- B. Reviewing the outcome of the latest security risk assessment
- C. Increasing the frequency of updates to the risk register
- D. Analyzing cyber intelligence reports
Answer: B
NEW QUESTION # 729
When reviewing the business continuity plan (BCP) of an online sales order system, a risk practitioner notices that the recovery time objective (RTO) has a shorter lime than what is defined in the disaster recovery plan (DRP). Which of the following is the BEST way for the risk practitioner to address this concern?
- A. Communicate the discrepancy to the DR manager for follow-up.
- B. Adopt the RTO defined in the DRP.
- C. Update the risk register to reflect the discrepancy.
- D. Adopt the RTO defined in the BCR
Answer: A
NEW QUESTION # 730
......
Free CRISC braindumps download: https://www.exam4docs.com/CRISC-study-questions.html
CRISC Dumps 2023 - NewISACA Exam Questions: https://drive.google.com/open?id=13YRScJl3RhW3M4k-YemC1OlLVhJp_KZQ
