Isaca Certificaton CRISC Practice Test Engine: Try These 930 Exam Questions
Guaranteed Success in Isaca Certificaton CRISC Exam Dumps
What is the duration of the CRISC Exam
- Format: Multiple choices, multiple answers
- Length of Examination: 4 hours
NEW QUESTION 381
You are the project manager of GHT project. You have planned the risk response process and now you are about to implement various controls. What you should do before relying on any of the controls?
- A. Discover risk exposure
- B. Review performance data
- C. Explanation:
Pilot testing and reviewing of performance data to verify operation against design are done before
relying on control. - D. Conduct pilot testing
- E. Articulate risk
- F. is incorrect. Articulating risk is the first phase in the risk response process to ensure
that information on the true state of exposures and opportunities are made available in a timely
manner and to the right people for appropriate response.
But it does not play any role in identifying whether any specific control is reliable or not.
Answer: B,D
Explanation:
is incorrect. Discovering risk exposure helps in identifying the severity of risk, but it
does not play any role in specifying the reliability of control.
NEW QUESTION 382
Which among the following is the BEST reason for defining a risk response?
- A. To overview current status of risk
- B. To ensure that the residual risk is within the limits of the risk appetite and tolerance
- C. To mitigate risk
- D. To eliminate risk from the enterprise
Answer: B
Explanation:
Section: Volume C
Explanation:
The purpose of defining a risk response is to ensure that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is based on selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost or benefit of the particular risk response option.
Incorrect Answers:
A: Risk cannot be completely eliminated from the enterprise.
C: This is not a valid answer.
D: Mitigation of risk is itself the risk response process, not the reason behind this.
NEW QUESTION 383
Which of the following is the MAIN benefit of involving stakeholders in the selection of key risk indicators (KRIs)?
- A. Improving risk awareness
- B. Optimizing risk treatment decisions
- C. Leveraging existing metrics
- D. Obtaining buy-in from risk owners
Answer: B
NEW QUESTION 384
Malware has recently affected an organization. The MOST effective way to resolve this situation and define a comprehensive risk treatment plan would be to perform:
- A. a root cause analysis.
- B. an impact assessment.
- C. a vulnerability assessment.
- D. a gap analysis.
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 385
You are a project manager for your organization and you're working with four of your key stakeholders. One of the stakeholders is confused as to why you're not discussing the current problem in the project during the risk identification meeting. Which one of the following statements best addresses when a project risk actually happens?
- A. is incorrect. You can identify risks before they occur and not after their occurrence.
- B. Risks can happen at any time in the project.
- C. Project risks are always in the future.
- D. Explanation:
According to the PMBOK, a project risk is always in the future. If the risk event has already
happened, then it is an issue, not a risk. - E. Project risks are uncertain as to when they will happen.
- F. Risk triggers are warning signs of when the risks will happen.
Answer: C
Explanation:
is incorrect. Triggers are warning signs and conditions of risk events, but this answer
isn't the best choice for this option B is incorrect. Risks can only happen in the future.
NEW QUESTION 386
When developing risk treatment alternatives for a Business case, it is MOST helpful to show risk reduction based on:
- A. regulatory guidelines
- B. risk appetite.
- C. control efficiency
- D. cost-benefit analysis.
Answer: D
NEW QUESTION 387
You are the project manager for BlueWell Inc. You have noticed that the risk level in your project increases above the risk tolerance level of your enterprise. You have applied several risk responses. Now you have to update the risk register in accordance to risk response process. All of the following are included in the risk register except for which item?
- A. Network diagram analysis of critical path activities
- B. Risk triggers
- C. Agreed-upon response strategies
- D. Risk owners and their responsibility
Answer: A
Explanation:
Section: Volume B
Explanation:
The risk register does not examine the network diagram and the critical path. There may be risks associated with the activities on the network diagram, but it does not address the network diagram directly.
The risk register is updated at the end of the plan risk response process with the information that was discovered during the process. The response plans are recorded in the risk register. In the risk register, risk is stated in order of priority, i.e., those with the highest potential for threat or opportunity first. Some risks might not require response plans at all, but then too they should be put on a watch list and monitored throughout the project. Following elements should appear in the risk register:
* List of identified risks, including their descriptions, root causes, and how the risks impact the project objectives
* Risk owners and their responsibility
* Outputs from the Perform Qualitative Analysis process
* Agreed-upon response strategies
* Risk triggers
* Cost and schedule activities needed to implement risk responses
* Contingency plans
* Fallback plans, which are risk response plans that are executed when the initial risk response plan proves to be ineffective
* Contingency reserves
* Residual risk, which is a leftover risk that remains after the risk response strategy has been implemented
* Secondary risks, which are risks that come about as a result of implementing a risk response
NEW QUESTION 388
An organization's chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner's BEST course of action is to:
- A. update the risk register with the selected risk response.
- B. identify key risk indicators (KRIs) for ongoing monitoring.
- C. recommend that the CTO revisit the risk acceptance decision.
- D. validate the CTO's decision wish the business process owner.
Answer: D
Explanation:
Section: Volume D
NEW QUESTION 389
You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project. Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project. What term is assigned to the low-level of stakeholder tolerance in this project?
- A. Mitigation-ready project management
- B. Risk utility function
- C. Risk avoidance
- D. Risk-reward mentality
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Risk utility function is assigned to the low-level of stakeholder tolerance in this project.
The risk utility function describes a person's or organization's willingness to accept risk. It is synonymous with stakeholder tolerance to risk.
Risk utility function facilitates the selection and acceptance of risk and provides opportunity to merge the approach with setting thresholds of risk acceptability and using utility-risk ratios if necessary.
Incorrect Answers:
A: This is not a valid project management and risk management term.
B: Risk avoidance is a risk response to avoid negative risk events.
D: Risk-reward describes the balance between accepting risks and the expected reward for the risk event.
Risk-reward mentality is not a valid project management term.
NEW QUESTION 390
Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios?
- A. Derive scenarios from IT risk policies and standards
- B. Gather scenarios from senior management
- C. Map scenarios to a recognized risk management framework
- D. Benchmark scenarios against industry peers
Answer: C
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 391
Upon learning that the number of failed back-up attempts continually exceeds the current risk threshold, the risk practitioner should:
- A. keep monitoring the situation as there is evidence that this is normal.
- B. inquire about the status of any planned corrective actions.
- C. adjust the risk threshold to better reflect actual performance.
- D. initiate corrective action to address the known deficiency.
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 392
Which of the following control detects problem before it can occur?
- A. Detective control
- B. Preventative control
- C. Deterrent control
- D. Compensation control
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Preventative controls are the controls that detect the problem before it occurs. They attempt to predict potential problems and make adjustments to prevent those problems to occur in near future. This prediction is being made by monitoring both the system's operations and its inputs.
Incorrect Answers:
A: Deterrent controls are similar to the preventative controls, but they diminish or reverse the attraction of the environment to prevent risk from occurring instead of making adjustments to the environment.
B: Detective controls simply detect and report on the occurrence of a problems. They identify specific symptoms to potential problems.
C: Compensation controls ensure that normal business operations continue by applying appropriate resource.
NEW QUESTION 393
Which of the following is a key component of strong internal control environment?
- A. RMIS
- B. Manual control
- C. Segregation of duties
- D. Automated tools
Answer: C
Explanation:
Section: Volume C
Explanation:
Segregation of duties (SOD) is a key component to maintaining a strong internal control environment because it reduces the risk of fraudulent transactions. When duties for a business process or transaction are segregated it becomes more difficult for fraudulent activity to occur because it would involve collusion among several employees.
Incorrect Answers:
A: An RMIS can be a very effective tool in monitoring all risk factors that impact the enterprise. The danger is that many important classes of risk may be omitted from consideration by the system. hence it doesn't ensure strong internal control environment.
C: Manual controls usually not form strong internal control environment. By not automating SOD controls, there is, potentially, the issue of these controls becoming a barrier in serving the customer. As manual authorizations are often time consuming and require another step in any business process, this takes time away from serving the customer.
Automated compliance solutions aim to provide enterprises with timely and efficient internal controls that do not disrupt their normal business process.
D: It is not directly related in maintaining strong internal control environment. The automated tools are typically used to address SOD and also to provide the enterprise with reporting functionality on SOD violations (i.e., detective controls) and to put in place preventive controls.
NEW QUESTION 394
You and your project team have identified a few risk events in the project and recorded the events in the risk register. Part of the recording of the events includes the identification of a risk owner. Who is a risk owner?
- A. Explanation:
Risk owner for each risk should be the person who has the most influence over its outcome.
Selecting the risk owner thus usually involves considering the source of risk and identifying the
person who is best placed to understand and implement what needs to be done. They are also
responsible for responding to the event and reporting on the risk status. - B. is incorrect. A risk owner will monitor the identified risks for status changes, but all
project stakeholders should be iteratively looking to identify the risks. - C. A risk owner is the party authorized to respond to the risk event.
- D. A risk owner is the party that will monitor the risk events.
- E. is incorrect. Risk owners are not the people who cause the risk event.
- F. A risk owner is the party that has caused the risk event.
- G. A risk owner is the party that will pay for the cost of the risk event if it becomes an issue.
Answer: A,B,C,E
Explanation:
is incorrect. Risk owners do not pay for the cost of the risk event.
NEW QUESTION 395
Which of the following is the MOST critical security consideration when an enterprise outsource its major part of IT department to a third party whose servers are in foreign company?
- A. Laws and regulations of the country of origin may not be enforceable in foreign country
- B. The enterprise could not be able to monitor the compliance with its internal security and privacy guidelines
- C. Additional network intrusion detection sensors should be installed, resulting in additional cost
- D. Explanation:
Laws and regulations of the country of origin may not be enforceable in foreign country and conversely, it is also true that laws and regulations of the foreign outsourcer may also impact the enterprise. Hence violation of applicable laws may not be recognized or rectified due to lack of knowledge of the local laws. - E. A security breach notification may get delayed due to time difference
Answer: A
Explanation:
is incorrect. Outsourcing does not remove the enterprise's responsibility regarding internal requirements. Hence monitoring the compliance with its internal security and privacy guidelines is not a problem. Answer:A is incorrect. Security breach notification is not a problem and also time difference does not play any role in 24/7 environment. Pagers, cellular phones, telephones, etc. are there to communicate the notifications. Answer:D is incorrect. The need for additional network intrusion detection sensors is not a major problem as it can be easily managed. It only requires addition funding, but can be addressed.
NEW QUESTION 396
......
Test Engine to Practice CRISC Test Questions: https://www.topexamcollection.com/CRISC-vce-collection.html
ISACA CRISC Daily Practice Exam New 2022 Updated 930 Questions: https://drive.google.com/open?id=1fhTCOuHBx2N9MVw_JpXywVTdS2XLYzLB
