Certified in Risk and Information Systems Control

Question 1

A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the following should be done FIRST?

A. Implement new controls.

B. Re-evaluate the existing control design.

C. Redesign the process.

D. Recalibrate the key performance indicator (KPI).

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Which stakeholders are PRIMARILY responsible for determining enterprise IT risk appetite?

A. Audit and compliance management

B. The chief information officer (CIO) and the chief financial officer (CFO)

C. Executive management and the board of directors

D. Enterprise risk management and business process owners

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

An organization outsources the processing of us payroll data A risk practitioner identifies a control weakness at the third party trial exposes the payroll data. Who should own this risk?

A. The organization ' s process owner

B. The third party ' s IT operations manager

C. The organization ' s risk practitioner

D. The third party ' s chief risk officer (CRO)

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which of the following should be the PRIMARY recipient of reports showing the progress of a current IT risk mitigation project?

A. IT risk manager

B. Project sponsor

C. Senior management

D. Project manager

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Which of the following is the MOST important consideration when determining the appropriate data retention period throughout the data management life cycle?

A. Legal and regulatory requirements

B. Choice of encryption algorithms

C. Data owner preferences

D. Data storage and collection methods

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

A risk practitioner is collaborating with key stakeholders to prioritize a large number of IT risk scenarios.
Which scenarios should receive the PRIMARY focus?

A. Scenarios with the highest risk impact to the business

B. Scenarios with the largest budget allocation for risk mitigation

C. Scenarios with the highest frequency of incidents

D. Scenarios with the highest number of open audit issues

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Which of the following is MOST helpful in providing a high-level overview of current IT risk severity*?

A. Risk mitigation plans

B. Risk appetite statement

C. Key risk indicators (KRls)

D. heat map

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which of the following is the PRIMARY concern for a risk practitioner regarding an organization ' s adoption of innovative big data analytics capabilities?

A. Analytics methods may identify someone who was previously de-identified.

B. There may be a lack of documented processes for big data analysis.

C. It may be difficult to find experts who can develop analytical queries.

D. It may be expensive to maintain a data lake.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

A. KRIs assist in the preparation of the organization ' s risk profile.

B. KRIs provide a basis to set the risk appetite for an organization.

C. KRIs provide an early warning that a risk threshold is about to be reached.

D. KRIs signal that a change in the control environment has occurred.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which of the following is the FIRST consideration to reduce risk associated with the storage of personal data?

A. Minimize the collection of data

B. Normalize the personal data

C. Implement privacy training

D. Encrypt the personal data

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?

A. Public relations manager

B. Data privacy manager

C. Database manager

D. Business manager

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

When creating a separate IT risk register for a large organization, which of the following is MOST important to consider with regard to the existing corporate risk ' register?

A. Leveraging business risk professionals

B. Relying on generic IT risk scenarios

C. Using a common risk taxonomy

D. Describing IT risk in business terms

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 13

An organization uses a web application hosted by a cloud service that is populated by data sent to the vendor via email on a monthly basis. Which of the following should be the FIRST consideration when analyzing the risk associated with the application?

A. Whether the data has been appropriately classified

B. Whether the service provider ' s data center is located in the same country

C. Whether the service provider contract allows right of onsite audit

D. Whether the data sent by email has been encrypted

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

ISACA Certified in Risk and Information Systems Control - CRISC Exam Practice Test

Latest Update

Useful Links

Contact Us