Certified in Risk and Information Systems Control

Question 1

Which of the following is the PRIMARY purpose of periodically reviewing an organization ' s risk profile?

A. Update risk responses in the risk register

B. Design and implement risk response action plans.

C. Enable risk-based decision making.

D. Align business objectives with risk appetite.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An organization is implementing robotic process automation (RPA) to streamline business processes. Given that implementation of this technology is expected to impact existing controls, which of the following is the risk practitioner ' s BEST course of action?

A. Reassess whether mitigating controls address the known risk in the processes.

B. Update the data governance policy to address the new technology.

C. Perform a gap analysis of the impacted processes.

D. Update processes to address the new technology.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Which of the following is a risk practitioner ' s BEST course of action when a control is not meeting agreed- upon performance criteria?

A. Implement additional controls to further mitigate risk

B. Redefine performance criteria based on control monitoring results

C. Review performance results with the control owner

D. Recommend a tool to meet the performance requirements

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Reviewing which of the following BEST helps an organization gain insight into its overall risk profile?

A. Risk register

B. Risk metrics

C. Risk appetite

D. Threat landscape

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

The GREATEST concern when maintaining a risk register is that:

A. impacts are recorded in qualitative terms.

B. IT risk is not linked with IT assets.

C. significant changes in risk factors are excluded.

D. executive management does not perform periodic reviews.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

A risk practitioner has been tasked with conducting a risk identification workshop with stakeholders to compile an IT risk profile. Which of the following would be MOST helpful in the brainstorming phase of this exercise?

A. List of issues and events from the risk register.

B. IT control assessment results and trends.

C. Key risk indicators (KRIs) outside of appetite.

D. Internal audit reports with adverse findings.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

When reporting to senior management on changes in trends related to IT risk, which of the following is MOST important?

A. Transparency

B. Maturity

C. Materiality

D. Confidentiality

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which of the following is the MOST important reason to communicate risk assessments to senior management?

A. To ensure the maturity of the assessment program can be validated

B. To ensure actions can be taken to align assessment results to risk appetite

C. To ensure key risk indicator (KRI) thresholds can be adjusted for tolerance

D. To ensure awareness of risk and controls is shared with key decision makers

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

An organization uses a web application hosted by a cloud service that is populated by data sent to the vendor via email on a monthly basis. Which of the following should be the FIRST consideration when analyzing the risk associated with the application?

A. Whether the data has been appropriately classified

B. Whether the service provider ' s data center is located in the same country

C. Whether the service provider contract allows right of onsite audit

D. Whether the data sent by email has been encrypted

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

In the context of business continuity management, which of the following does the maximum allowable downtime represent?

A. The maximum data loss an organization can tolerate during a disaster

B. The maximum time required to recover all critical systems to full operational capacity after a disaster

C. The maximum length of time that a business can be disrupted before significant harm occurs

D. The maximum time required to initiate the disaster recovery plan (DRP)

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:

A. communicate risk trends to stakeholders.

B. identify threats to emerging technologies.

C. highlight noncompliance with the risk policy

D. assign ownership of emerging risk scenarios.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

The BEST way to demonstrate alignment of the risk profile with business objectives is through:

A. risk tolerance.

B. risk appetite.

C. risk policy.

D. risk scenarios.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 13

Which of the following is MOST helpful when determining whether a system security control is effective?

A. Current security threat report

B. Control standard operating procedures

C. Updated risk register

D. Latest security assessment

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 14

Which of the following BEST enables a risk practitioner to focus on risk factors that could potentially affect the results of an IT initiative?

A. Conducting stakeholder surveys

B. Measuring and reporting qualitative risk trends

C. Assessing trends in quantitative risk analysis results

D. Prioritizing threats and controls

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

ISACA Certified in Risk and Information Systems Control - CRISC Exam Practice Test

Latest Update

Useful Links

Contact Us