Certified in Risk and Information Systems Control (CRISC) Domain 2 Practice Exam

These questions are part of the practice quiz. Start practicing

• Which activity is MOST important when determining a risk mitigation strategy?
• Which of the following is used to determine whether unauthorized modifications were made to production programs?
• Why is obtaining feedback from all end users not sufficient alone to ensure risk management effectiveness?
• Which example includes probability but not impact?
• The organizational structure, policies, standards, technology, architecture and controls criteria are PRIMARILY used to:
• If the organization implements a third-party application globally, which role will be responsible for the risk posed by the application to the business?
• What is the PRIMARY objective of risk assessments performed by risk professionals?
• Which statement about business continuity plans represents the MOST significant threat to an organization?
• In the risk management process, a cost-benefit analysis is MAINLY performed:
• A likelihood-Impact matrix would MOST likely be used during the evaluation of a software development project to?
• Which type of risk assessment methods involves conducting interviews and using anonymous questionnaires by subject matter experts?
• After completing a risk assessment, should the documented test results be retained, destroyed, summarized, or published?
• A Business Impact Analysis includes which of the following metrics?
• Residual risk is defined as the risk that remains after which of the following?
• Which risk assessment technique will produce a view that highlights links between possible causes, controls, and consequences?
• The scenario described as information not being received by the necessary recipients in a timely manner is best categorized as which risk?
• The IT department wants to use a server for an enterprise database, but the hardware is not certified by its manufacturer for the intended operating system or database software. The risk practitioner determines that introducing the hardware presents:
• Cause-and-effect analysis is typically used to identify root causes and potential risk; a typical form is the fishbone diagram.
• Which of the following is the GREATEST challenge of performing a quantitative risk analysis?
• Which approach to risk scenario development was used when attacker methods, vulnerabilities, motivations and skill of the attacker, and potential damage were considered?
• At the end of which risk management phase should information about newly discovered risk be communicated to decision makers and relevant stakeholders?
• Testing compliance of a response and recovery plan should begin by conducting a:
• Capability models are used PRIMARILY to assess risk management processes by:
• Which of the following is BEST suited for the review of IT risk analysis results before the results are sent to management for approval and use in decision making?
• When assessing the performance of a critical application server, the MOST reliable assessment results may be obtained from:
• What is the FIRST step in identifying IT risk scenarios?
• Which information security document defines platform baselines and is generally not updated as frequently as procedures?
• Not being available when needed is an example of which risk category?
• In risk management, the term 'risk rating' is used to...
• Senior management has defined the enterprise risk appetite as moderate. A business-critical application has been determined to pose a high risk. What is the NEXT action the risk practitioner should undertake?
• In risk management, which analysis estimates the frequency and impact of risk scenarios and is a component of a business impact analysis?
• Which of the following BEST enables a peer review of an enterprise's risk management process?
• Which of the following controls is an example of one that reduces the probability of a risk event?
• Which metric is primarily used for budgeting decisions rather than directly guiding incident response?
• Which is the BEST way to verify that antivirus signature files on production servers are up to date?
• An enterprise is hiring a consultant to help determine the maturity level of the risk management program. The MOST important element of the request for proposal is the:
• Which statement best describes Recovery Time Objectives (RTOs) in the context of a Business Impact Analysis?
• How often should risk be evaluated to balance timely updates with resource use?
• Which of the following should management use to allocate resources for risk response?
• Which statement BEST describes the purpose of annual loss exposure in risk management?
• Which statement accurately describes the relationship between cost-benefit analysis and information asset valuation?
• When performing a risk assessment on the impact of losing a server, the monetary value should be based on the:
• Which practice is MOST closely associated with delivering value over time from a supplier?
• Which document documents the priority and method for implementing individual risk actions?
• Which provides the MOST valuable input to incident-response efforts?
• Which of the following BEST demonstrates the organization's readiness for unexpected events?
• Which method is BEST suited to quantify the financial impact of a specific risk scenario?
• The organizational criteria such as structure, policies, standards, technology, architecture and controls are primarily used to:
• Which of the following roles is responsible for evaluating the effectiveness of existing internal information security controls within an enterprise?
• Which function is performed by risk and control analysis when assessing gaps between current and desired states?
• The PRIMARY goal of a postincident review is to:
• Which risk assessment approach contemplates risk events from the threat perspective?
• To determine the factors responsible for a loss event, which analytical method should be used?
• Which risk is described as a composite form requiring both integrity and availability to be reasonably controlled?
• Investments in risk management technologies should be based on:
• To understand the organization’s IT risk for annual strategic direction, management should refer to which of the following?
• When a new regulation affecting a specific type of transaction is identified, what is the FIRST step for an IT manager?
• Cost-benefit analysis of controls is primarily used for what purpose?
• What is the primary advantage of performing a risk assessment on a consistent basis?
• Which statement best describes the difference between threat analysis and scenario analysis in estimating likelihood?
• The PRIMARY reason to have the risk management process reviewed by independent risk management professional(s) is to:
• A $1 million regulatory fine is the same for two organizations with different capital. Which assertion about impact is most reasonable?
• The PRIMARY benefit of using a maturity model to assess the enterprise's data management process is that it:
• Deriving the likelihood and impact of risk scenarios through statistical methods is BEST described as:
• Which of the following should be in place before a black box penetration test begins?
• Which of the following capability dimensions is NOT typically considered when using a maturity model for the risk management process?
• In a healthcare organization using role-based access controls for its patient data, which statement BEST describes how the control reduces risk?
• In a software development organization, risk assessments are most effective when performed at which point in the life cycle?
• If a server logs only access attempts and outcomes, with no commands executed captured, which risk is most directly introduced?
• Which BEST describes the risk-related roles and responsibilities of an organizational business unit (BU) management team?
• Which statement about anti-malware controls best describes how they reduce risk?
• Which logging deficiency most directly impedes regulatory compliance and incident investigation?
• Which statement about capability maturity models is true?
• Who is ultimately accountable for the day-to-day work of risk management and goal achievement within a business unit?
• What primarily determines the choice between quantitative and qualitative risk assessment methodologies?
• When assessing the capability of the risk-management process, a regulatory body would place the greatest reliance on which type of review?
• What is the objective of a business impact analysis (BIA)?
• What should an organization use to assess the security controls of a third party hosting its server infrastructure?
• Which is MOST important during the quantitative risk analysis process?
• When would an enterprise project management department PRIMARILY use risk analysis?
• The lack of adequate controls represents which of the following?
• Which activity is MOST important when evaluating risk to an enterprise or business process?
• In IT risk analysis, which outcome is most directly achieved?
• Beyond replacement cost, what should be considered when valuing the impact of a server?
• Which data analysis method will be most effective in a comprehensive review of hardware and human failures to identify the source(s) of an incident?
• Which is the BEST method to analyze risk, incidents and related interdependencies to determine the impact on organizational goals?
• Which action is MOST likely to occur during the activation of an incident response plan?
• Which is an example of a directive control in relation to risk management?
• Which statement about annual loss expectancy (ALE) is correct?
• Which method BEST estimates the likelihood of significant events affecting an enterprise?
• Which qualitative technique is commonly used to gather expert opinions through multiple rounds of anonymous input?
• Which option best describes a chained exploit in the context of risk and information systems control?
• The MOST effective method to conduct a risk assessment on an internal system in an organization is to start by understanding the:
• Which is PRIMARY reason for subjecting the risk management process to independent review by risk auditors/assessors?
• Which approach will produce comprehensive results when performing a qualitative risk analysis?
• Which step ensures the risk mitigation strategy aligns with organizational standards?
• Which of the following tools is a graphical ranking of risk by defined ranges of frequency and magnitude?
• Which statement BEST describes how an anti-malware system reduces risk?
• Which statement best describes the Delphi method?
• Which concept of data validation is MOST likely to be of value when reviewing transaction data for fraudulent activity?
• Who will be accountable for the risk posed by the application if implemented globally?
• Which component supports conclusions in a risk assessment?
• What is a major risk associated with implementing single sign-on (SSO) in an enterprise?
• In governance, who makes the final decision on implementing a risk response after a risk assessment?
• Which of the following is MOST useful in developing a series of recovery time objectives?
• Which statement best describes the role of internal audit within risk management?
• Which risk management activity initially identifies critical business functions and key business risks?
• In using a capability maturity model to assess the risk management process, which capability dimension is MOST important?
• During the risk assessment process, it is MOST important to establish a clear line of accountability to:
• Which of the following is the BEST way to ensure that a corporate network is adequately secured against external attack?
• An internal assessment reveals that logging captures only a few dozen hardcoded transactions and uses FIFO with retention less than 24 hours. What is the MOST financially damaging vulnerability?
• An enterprise has outsourced personnel data processing to a supplier, and a regulatory violation occurs during processing. Who will be held legally responsible?
• Which BEST ensures effective prioritization and treatment of risk?
• What is the MOST important reason for conducting periodic risk assessments?
• Which project management tool is MOST appropriate when managing a system development project of uncertain duration?
• Why is an external review generally more suitable than an internal review for regulatory purposes?
• Which approach BEST helps an enterprise achieve risk-based organizational objectives?
• The MOST likely trigger for conducting a comprehensive risk assessment is changes to?
• What is the main challenge in calculating the benefits to be realized from the implementation of a control?
• Which analysis assesses the general control environment of an organization?
• During an internal risk assessment in a global enterprise, local management has proactively mitigated some high-level risk related to the global purchasing process. This means that:
• It is MOST important for a risk evaluation to:
• Which statement BEST captures how the results of a risk assessment are used?
• Which assumption is inappropriate in risk evaluation?
• Which statement best describes the IT controls framework's role in risk management?
• How is a risk indicator best described?
• Information security procedures should:
• Which of the following BEST ensures that identified risk remains at an acceptable level?
• Which role is responsible for implementing access control rules after the data owner approves access requests?
• When an enterprise wants to quickly implement a technical solution that deviates from the organization's policies, what should the risk practitioner do?
• Who is MOST likely responsible for data classification within an enterprise?
• Which statement best describes the relationship between vulnerability assessments and risk scenarios in qualitative risk analysis?
• Which automated monitoring technique in an application uses triggers to indicate a suspicious condition?
• Which scenario best illustrates risk aggregation?
• Of the following, which control would a risk practitioner recommend to mitigate the risk that personnel who have the ability to change system configuration settings also modify computer operational logs?
• Which method reveals the gap between desired control objectives and actual control design, highlighting deficiencies?
• When leveraging a third party for the procurement of IT equipment, which control practice is MOST closely associated with delivering value over time?
• Who is primarily responsible for ensuring that identified risk is mitigated to an acceptable level before implementing a new application within the production infrastructure?
• A risk assessment process that uses likelihood and impact in calculating the level of risk is a:
• Which factor BEST assists in the development of the risk profile?
• Which two concepts are components of total risk but do not by themselves develop the risk profile?
• Which statement about maturity models used for data management is true?
• Who authorizes data access based on justified business need?
• Which of the following risk assessment outputs is MOST suitable to help justify the information security program?
• Which factor should be included when assessing the impact of losing network connectivity for 18 to 24 hours?
• An asset's annual loss expectancy is calculated as the:
• While prioritizing the risk for treatment, the IT risk practitioner should PRIMARILY consider the:
• During which phase of the system development life cycle are security features configured, enabled, tested and verified?
• Which data analysis method is used to assess how sensitive a decision is to changes in input assumptions?
• What is the BEST reason to perform a risk assessment?
• Which document defines the allowable limits of user behavior?
• When an organizational risk assessment reveals that many IT standards have not been updated, the BEST course of action is to:
• A substantive test to verify tape inventory accuracy involves which of the following?
• Which of the following is an output of risk assessment?
• Which of the following signifies the need to review an enterprise's risk practices?
• Which option best describes the PRIMARY purpose of independent risk auditors/assessors in validating risk management results?
• Which artifact provides a centralized view of all organizational risks to enable prioritization and treatment?
• What is the ultimate goal of risk aggregation?
• Business continuity plans should be written and maintained by?
• What is the primary purpose of a business impact analysis in risk management?
• If the application must be used by the business, which role ultimately becomes a critical stakeholder who must be informed about the risk?
• Who is responsible for safe custody, transport and storage of data and implementation of business rules, such as granting access to data, once the data owner approves?
• Which example includes all required components of a risk calculation?
• A company has improved its organizational security and compliance program since the last security review one year ago. What should be done to evaluate its current risk profile?
• Which of the following is an example of availability risk?
• The PRIMARY result of a risk assessment process is:
• Which of the following uses risk scenarios when estimating the likelihood and impact of significant risk to the organization?
• What is the role of the data owner in internal information security controls?
• Which option BEST ensures that an identified risk is mitigated?
• A procurement employee notices that new printer models offered by the vendor keep a copy of all printed documents on an internal hard disk. Considering the risk of unintentionally disclosing confidential data, the employee should:
• Which is the PRIMARY factor when deciding between conducting a quantitative or qualitative risk assessment?
• Which is MOST beneficial to improvement of an enterprise's risk management process?
• Which exercise type is used to simulate incidents and coordinate responses in real time?
• Which role provides formal authorization on user access?
• Which of the following is an input into risk-management process improvement that does not define the desired state?
• Which of the following BEST ensures the overall effectiveness of a risk management program?
• Which control reduces the impact of a risk event?
• Which project management technique is best for managing a system development project with uncertain duration?
• Which BEST assists a risk practitioner in measuring the existing level of development of risk management processes against their desired state?
• Which action best evaluates the effectiveness of a risk mitigation control during the risk assessment process?
• A process by which someone logs onto a web site, then receives a token via a short message service (SMS) message, is an example of what control type?
• Risk assessment techniques should be used by a risk practitioner to:
• Which technique BEST helps determine whether there have been unauthorized program changes since the last authorized program update?
• For uncertified hardware used for an enterprise database, which statement best describes the risk level?
• Which of the following BEST ensures detection of back doors?
• Which of the following is MOST useful when computing annual loss exposure?
• Which factor should be assessed after the likelihood of a loss event has been determined?
• Which BEST describes the role of management in implementing a risk management strategy?
• Which of the following is BEST used to determine the current level of development of risk management processes against the desired state?
• Who owns the risk treatment decision in a risk assessment of a local office's network infrastructure?
• A PRIMARY reason for initiating a policy-exception process is when:
• To evaluate the effectiveness of a risk mitigation control during the risk assessment process, the team should:
• Which consideration is MOST applicable to risk assessments dealing with data management?
• Executive management's role in business continuity planning?
• Which of the following BEST helps identify information systems control deficiencies?
• Which factor determines the magnitude of annual loss exposure alongside the probability of a risk event?
• Risk assessments should be repeated at regular intervals because:
• Which risk assessment technique would the practitioner use to analyze system exposure to personnel?
• How can the total impact to operations be calculated when hard drives supporting a critical financial system fail?
• Which statement best describes control metrics?
• The use of a capability maturity model is based on which concept?
• After a security incident, which technique is the FIRST step toward yielding an actionable plan to mitigate the risk?
• IT risk is measured by its:
• If implemented globally, which stakeholder should be included in reporting the risk?
• What is a control objective?
• Which activity provides the BEST information to guide a decision on risk treatment?
• When developing security requirements for a third-party hosting provider, an organization should primarily base them on which of the following?
• What is the FIRST step for a risk practitioner when an enterprise has decided to outsource all IT services and support to a third party?
• Which data is NOT essential to the risk assessment process?
• Which project management method uses optimistic, likely, and pessimistic time estimates to manage uncertainty?