Check the Free demo of our CRISC Exam Dumps with 1014 Questions [Q36-Q50]

4.3/5 - (3 votes)

Check the Free demo of our CRISC Exam Dumps with 1014 Questions

Clear your concepts with CRISC Questions Before Attempting Real exam

Exam Overview

The CRISC certification exam is made up of 150 multiple-choice questions and the time allotted for its completion is 240 minutes. The candidates can take it in Chinese (Simplified and Traditional), English, German, French, Italian, Korean, Japanese, Spanish, and Turkish. The passing score is 450 points (out of 800).

To register for the test, the students must pay the required fee. For the ISACA members, it is $575, while for the non-members – $760. This exam is administered through the PSI testing centers across the world. You can take it at any time because registration is always on-going. After making payment, you can schedule your test as early as 48 hours. However, make sure that you understand its content before you attempt the exam to avoid retaking it. If you do not pass the test, you will have to pay another fee.

Potential Candidates

The candidates for this certification are the professionals with ample experience in the management of IT risks. It is also aimed at the individuals with the relevant skills and competence in designing, implementing, monitoring, and maintaining information security controls.

NEW QUESTION 36
Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?

An access control list

An acceptable usage policy

An intrusion detection system (IDS)

A data extraction tool

Section: Volume D

NEW QUESTION 37
Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Using an aggregated view of organizational risk

Relying on key risk indicator (KRI) data

Ensuring relevance to organizational goals

Including trend analysis of risk metrics

Section: Volume D
Explanation

NEW QUESTION 38
Which of the following is the PRIMARY reason for a risk practitioner to use global standards related to risk management?

To continuously improve risk management processes

To build an organizational risk-aware culture

To comply with legal and regulatory requirements

To identify gaps in risk management practices

Section: Volume D

NEW QUESTION 39
You are the project manager of GHT project. Your project utilizes a machine for production of goods. This machine has the specification that if its temperature would rise above 450 degree Fahrenheit then it may result in burning of windings. So, there is an alarm which blows when machine’s temperature reaches 430 degree Fahrenheit and the machine is shut off for 1 hour. What role does alarm contribute here?

Of risk indicator

Of risk identification

Of risk trigger

Of risk response

Section: Volume D
Explanation:
Here in this scenario alarm indicates the potential risk that the rising temperature of machine can cause, hence it is enacting as a risk indicator.
Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.
Incorrect Answers:
B: The first thing we must do in risk management is to identify the areas of the project where the risks can occur. This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
C: The temperature 430 degrees in scenario is the risk trigger. A risk trigger is a warning sign or condition that a risk event is about to happen. As in this scenario the 430-degree temperature is the indication of upcoming risks, hence 430 degree temperature is a risk trigger.
D: Risk response is the action taken to reduce the risk event occurrence. Hence here risk response is shutting off of machine.

NEW QUESTION 40
You are the project manager of GHT project. You have planned the risk response process and now you are about to implement various controls. What you should do before relying on any of the controls?

Review performance data

Discover risk exposure

Conduct pilot testing

Articulate risk

Explanation:
Pilot testing and reviewing of performance data to verify operation against design are done before
relying on control.

is incorrect. Articulating risk is the first phase in the risk response process to ensure
that information on the true state of exposures and opportunities are made available in a timely
manner and to the right people for appropriate response.
But it does not play any role in identifying whether any specific control is reliable or not.

is incorrect. Discovering risk exposure helps in identifying the severity of risk, but it
does not play any role in specifying the reliability of control.

NEW QUESTION 41
After the implementation of Internet of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?

To reevaluate continued use of IoT devices.

To recommend changes to the IoT policy.

To confirm the impact to the risk profile.

To add new controls to mitigate the risk.

Section: Volume D

NEW QUESTION 42
An IT risk practitioner has determined that mitigation activities differ from an approved risk action plan. Which of the following is the risk practitioner’s BEST course of action?

Report the observation to the chief risk officer (CRO).

Validate the adequacy of the implemented risk mitigation measures.

Update the risk register with the implemented risk mitigation actions.

Revert the implemented mitigation measures until approval is obtained

NEW QUESTION 43
You are the project manager of GHT project. You want to perform post-project review of your project. What is the BEST time to perform post-project review by you and your project development team to access the effectiveness of the project?

Project is completed and the system has been in production for a sufficient time period

During the project

Immediately after the completion of the project

Project is about to complete

Explanation/Reference:
Explanation:
The project development team and appropriate end users perform a post-project review jointly after the project has been completed and the system has been in production for a sufficient time period to assess its effectiveness.
Incorrect Answers:
B: The post-project review of project for accessing effectiveness cannot be done during the project as effectiveness can only evaluated after setting the project in process of production.
C: It is not done immediately after the completion of the project as its effectiveness cannot be measured until the system has been in production for certain time period.
D: Post-project review for evaluating the effectiveness of the project can only be done after the completion of the project and the project is in production phase.

NEW QUESTION 44
Which of the following is the BEST way to quantify the likelihood of risk materialization?

Balanced scorecard

Threat and vulnerability assessment

Compliance assessments

Business impact analysis (BIA)

NEW QUESTION 45
Which element of an organization’s risk register is MOST important to update following the commissioning of a new financial reporting system?

Key risk indicators (KRIs)

The owner of the financial reporting process

The risk rating of affected financial processes

The list of relevant financial controls

NEW QUESTION 46
Which of the following is the GREATEST concern associated with the transmission of healthcare data across the internet?

Unencrypted data

Lack of redundant circuits

Low bandwidth connections

Data integrity

NEW QUESTION 47
During a risk assessment, the risk practitioner finds a new risk scenario without controls has been entered into the risk register. Which of the following is the MOST appropriate action?

Include the new risk scenario in the current risk assessment.

Postpone the risk assessment until controls are identified.

Request the risk scenario be removed from the register.

Exclude the new risk scenario from the current risk assessment

NEW QUESTION 48
The MAIN goal of the risk analysis process is to determine the:

potential severity of impact.

control deficiencies.

frequency and magnitude of loss.

threats and vulnerabilities.

Section: Volume D

NEW QUESTION 49
Which of the following matrices is used to specify risk thresholds?

Risk indicator matrix

Impact matrix

Risk scenario matrix

Probability matrix

Section: Volume A
Explanation:
Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.
Incorrect Answers:
B, D: Estimation of risk’s consequence and priority for awareness is conducted by using probability and impact matrix. These matrices specify the mixture of probability and impact that directs to rating the risks as low, moderate, or high priority.
C: A risk scenario is a description of an event that can lay an impact on business, when and if it would occur.
Some examples of risk scenario are of:
* Having a major hardware failure
* Failed disaster recovery planning (DRP)
* Major software failure

NEW QUESTION 50
What type of policy would an organization use to forbid its employees from using organizational e-mail for personal use?

Anti-harassment policy

Acceptable use policy

Intellectual property policy

Section: Volume C
Explanation:
An acceptable use policy is a set of rules applied by the owner/manager of a network, website or large computer system that restrict the ways in which the network site or system may be used. Acceptable Use Policies are an integral part of the framework of information security policies.
Incorrect Answers:
A, C: These two policies are not related to Information system security.
D: Privacy policy is a statement or a legal document (privacy law) that discloses some or all of the ways a party gathers, uses, discloses and manages a customer or client’s data.

Loading …

Get professional help from our CRISC Dumps PDF: https://www.dumpleader.com/CRISC_exam.html

Exam Overview

Potential Candidates

Leave a Reply Cancel reply