Brilliant CRISC Exam Dumps Get CRISC Dumps PDF
CRISC Dumps PDF - CRISC Real Exam Questions Answers
Main Requirements
To earn the ISACA CRISC certification, the applicants are required to pass a single test. Additionally, they must meet the experience-level eligibility requirement. This is at least three years of practical experience in the field of IT risk management and IS control. The experience level is an integral part of the exam prerequisites, and there is no waiver or substitution for it.
Exam Overview
The CRISC certification exam is made up of 150 multiple-choice questions and the time allotted for its completion is 240 minutes. The candidates can take it in Chinese (Simplified and Traditional), English, German, French, Italian, Korean, Japanese, Spanish, and Turkish. The passing score is 450 points (out of 800).
To register for the test, the students must pay the required fee. For the ISACA members, it is $575, while for the non-members – $760. This exam is administered through the PSI testing centers across the world. You can take it at any time because registration is always on-going. After making payment, you can schedule your test as early as 48 hours. However, make sure that you understand its content before you attempt the exam to avoid retaking it. If you do not pass the test, you will have to pay another fee.
NEW QUESTION 510
An application runs a scheduled job that compiles financial data from multiple business systems and updates the financial reporting system. If this job runs too long, it can delay financial reporting. Which of the following is the risk practitioner's BEST recommendation?
- A. Implement database activity and capacity monitoring.
- B. Ensure the business is aware of the risk.
- C. Consider providing additional system resources to this job.
- D. Ensure the enterprise has a process to detect such situations.
Answer: A
NEW QUESTION 511
An organization is implementing encryption for data at rest to reduce the risk associated with unauthorized access. Which of the following MUST be considered to assess the residual risk?
- A. Cloud storage architecture
- B. Key management
- C. Data destruction requirements
- D. Data retention requirements
Answer: B
NEW QUESTION 512
You work as a project manager for Bluewell Inc. You have identified a project risk. You have then implemented the risk action plan and it turn out to be non-effective. What type of plan you should implement in such case?
- A. Risk response plan
- B. Risk avoidance
- C. Risk fallback plan
- D. Risk mitigation
Answer: C
Explanation:
Section: Volume B
Explanation:
A risk fallback plan is a proper plan devised to identify definite action to be taken if the risk action plan (Risk Mitigation Plan) is not helpful. Fallback plan is important in Risk Response Planning. If the contingency plan for a risk is not successful, then the project team implements the fallback plan. Fall-back planning is intended for a known and specific activity that may perhaps fail to produce desired outcome. It is related with technical procedures and with the responsibility of the technical lead.
Incorrect Answers:
A, C, D: These all choices itself comes under risk action plan. As in the described scenario, risk action plan is not turned to be effective, these should not be implemented again.
NEW QUESTION 513
Which of the following is the priority of data owners when establishing risk mitigation method?
- A. Intrusion detection
- B. Antivirus controls
- C. Platform security
- D. User entitlement changes
Answer: D
Explanation:
Section: Volume A
Explanation:
Data owners are responsible for assigning user entitlement changes and approving access to the systems for which they are responsible.
Incorrect Answers:
B, C, D: Data owners are not responsible for intrusion detection, platform security or antivirus controls.
These are the responsibilities of data custodians.
NEW QUESTION 514
An IT risk practitioner has been asked to regularly report on the overall status and effectiveness of the IT risk management program. Which of the following is MOST useful for this purpose?
- A. Balanced scorecard
- B. Capability maturity level
- C. Internal audit plan
- D. Control self-assessment (CSA)
Answer: A
NEW QUESTION 515
An organization has outsourced its IT security management function to an external service provider. The BEST party to own the IT security controls under this arrangement is the:
- A. service provider's IT security function
- B. organization's risk function
- C. service provider's audit function
- D. organization's IT management
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 516
An IT license audit has revealed that there are several unlicensed copies of co be to:
- A. centralize administration rights on laptops so that installations are controlled
- B. report the issue to management so appropriate action can be taken.
- C. immediately uninstall the unlicensed software from the laptops
- D. procure the requisite licenses for the software to minimize business impact.
Answer: A
NEW QUESTION 517
Which of the following would MOST likely cause a risk practitioner to reassess risk scenarios?
- A. A change in the risk management policy
- B. An increase in intrusion attempts
- C. A change in the regulatory environment
- D. A major security incident
Answer: C
NEW QUESTION 518
Which of the following is the BEST way to determine whether new controls mitigate security gaps in a business system?
- A. Complete an offsite business continuity exercise.
- B. Conduct a compliance check against standards.
- C. Perform a vulnerability assessment.
- D. Measure the change in inherent risk.
Answer: B
NEW QUESTION 519
You are the risk professional in Bluewell Inc. You have identified a risk and want to implement a specific risk mitigation activity. What you should PRIMARILY utilize?
- A. Business case
- B. Technical evaluation report
- C. Budgetary requirements
- D. Vulnerability assessment report
Answer: A
Explanation:
Section: Volume C
Explanation/Reference:
Explanation:
As business case includes business need (like new product, change in process, compliance need, etc.) and the requirements of the enterprise (new technology, cost, etc.), risk professional should utilize this for implementing specific risk mitigation activity. Risk professional must look at the costs of the various controls and compare them against the benefits that the organization will receive from the risk response. Hence he/she needs to have knowledge of business case development to illustrate the costs and benefits of the risk response.
Incorrect Answers:
A, C, D: These all options are supplemental.
NEW QUESTION 520
Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?
- A. Audit recommendations may not be implemented
- B. Specific user accountability cannot be established
- C. User management coordination does not exist
- D. Users may have unauthorized access to originate, modify or delete data
Answer: D
Explanation:
Explanation/Reference:
Explanation:
There is an increased risk without a policy defining who has the responsibility for granting access to specific data or systems, as one could gain system access without a justified business needs. There is better chance that business objectives will be properly supported when there is appropriate ownership.
Incorrect Answers:
A, B, D: These risks are not such significant as compared to unauthorized access.
NEW QUESTION 521
For no apparent reason, the time required to complete daily processing for a legacy application is approaching a risk threshold. Which of the following activities should be performed FIRST?
- A. Suspend processing to investigate the problem.
- B. Temporarily increase the risk threshold.
- C. Initiate a feasibility study for a new application.
- D. Conduct a root-cause analysis.
Answer: D
NEW QUESTION 522
Which of the following components of risk scenarios has the potential to generate internal or external threat on an enterprise?
- A. Timing dimension
- B. Actors
- C. Events
- D. Assets
Answer: B
Explanation:
Section: Volume A
Explanation:
Components of risk scenario that are needed for its analysis are:
* Actor: Actors are those components of risk scenario that has the potential to generate the threat that can be internal or external, human or non-human. Internal actors are within the enterprise like staff, contractors, etc. On the other hand, external actors include outsiders, competitors, regulators and the market.
* Threat type: Threat type defines the nature of threat, that is, whether the threat is malicious, accidental, natural or intentional.
* Event: Event is an essential part of a scenario; a scenario always has to contain an event. Event describes the happenings like whether it is a disclosure of confidential information, or interruption of a system or project, or modification, theft, destruction, etc.
* Asset: Assets are the economic resources owned by business or company. Anything tangible or intangible that one possesses, usually considered as applicable to the payment of one's debts, is considered an asset. An asset can also be defined as a resource, process, product, computing infrastructure, and so forth that an organization has determined must be protected. Tangible asset: Tangible are those asset that has physical attributes and can be detected with the senses, e.g., people, infrastructure, and finances.
Intangible asset: Intangible are those assets that has no physical attributes and cannot be detected with the senses, e.g., information, reputation and customer trust.
* Timing dimension: The timing dimension is the application of the scenario to detect time to respond to or recover from an event. It identifies if the event occurs at a critical moment and its duration. It also specifies the time lag between the event and the consequence, that is, if there an immediate consequence (e.g., network failure, immediate downtime) or a delayed consequence (e.g., wrong IT architecture with accumulated high costs over a long period of time).
NEW QUESTION 523
You are the project manager of HGT project. You are in the first phase of the risk response process and are doing following tasks :
Communicating risk analysis results
Reporting risk management activities and the state of compliance
Interpreting independent risk assessment findings
Identifying business opportunities
Which of the following process are you performing?
- A. Reporting risk
- B. Mitigating risk
- C. Articulating risk
- D. Tracking risk
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Articulating risk is the first phase in the risk response process to ensure that information on the true state of exposures and opportunities are made available in a timely manner and to the right people for appropriate response. Following are the tasks that are involved in articulating risk:
Communicate risk analysis results.
Report risk management activities and the state of compliance.
Interpret independent risk assessment findings.
Identify business opportunities.
Incorrect Answers:
B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together. This comes under risk response process and is latter stage after articulating risk.
C: Tracking risk is the process of tracking the ongoing status of risk mitigation processes. This tracking ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule.
D: This is not related to risk response process. It is a type of risk. Reporting risks are the risks that are caused due to wrong reporting which leads to bad decision.
NEW QUESTION 524
You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?
- A. Decision tree analysis
- B. Cause-and-effect analysis
- C. Project network diagrams
- D. Delphi Technique
Answer: A
Explanation:
Section: Volume C
Explanation
Explanation:
Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.
Incorrect Answers:
A: Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning.
B: Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning. This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.
D: Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus.
NEW QUESTION 525
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:
- A. stakeholder risk tolerance.
- B. benchmarking criteria.
- C. the control environment.
- D. suppliers used by the organization.
Answer: C
NEW QUESTION 526
A business unit is implementing a data analytics platform to enhance its customer relationship management (CRM) system primarily to process data that has been provided by its customers. Which of the following presents the GREATEST risk to the organization's reputation?
- A. Use of a data analytics system is not disclosed to customers.
- B. Revenue generated is not disclosed to customers.
- C. Data usage exceeds individual consent.
- D. Third-party software is used for data analytics.
Answer: C
NEW QUESTION 527
Which of the following is the PRIMARY purpose of periodically reviewing an organization's risk profile?
- A. Align business objectives with risk appetite.
- B. Design and implement risk response action plans.
- C. Enable risk-based decision making.
- D. Update risk responses in the risk register
Answer: C
NEW QUESTION 528
While reviewing the risk register, a risk practitioner notices that different business units have significant variances in inherent risk for the same risk scenario. Which of the following is the BEST course of action?
- A. Update the risk register with the average of residual risk for both business units.
- B. Update the risk register to ensure both risk scenarios have the highest residual risk.
- C. Request that both business units conduct another review of the risk.
- D. Review the assumptions of both risk scenarios to determine whether the variance is reasonable.
Answer: D
NEW QUESTION 529
Which of the following BEST enables a proactive approach to minimizing the potential impact of unauthorized data disclosure?
- A. Cyber insurance
- B. Key risk indicators (KRIs)
- C. Data backups
- D. Incident response plan
Answer: B
NEW QUESTION 530
An employee lost a personal mobile device that may contain sensitive corporate information. What should be the risk practitioner's recommendation?
- A. Disable the user account.
- B. Conduct a risk analysis.
- C. Initiate a remote data wipe.
- D. Invoke the incident response plan
Answer: D
NEW QUESTION 531
You work as a project manager for TechSoft Inc. You are working with the project stakeholders on the qualitative risk analysis process in your project. You have used all the tools to the qualitative risk analysis process in your project. Which of the following techniques is NOT used as a tool in qualitative risk analysis process?
- A. Risk Urgency Assessment
- B. Risk Data Quality Assessment
- C. Risk Categorization
- D. Risk Reassessment
Answer: D
Explanation:
Explanation/Reference:
Explanation:
You will not need the Risk Reassessment technique to perform qualitative risk analysis. It is one of the techniques used to monitor and control risks.
Incorrect Answers:
A, C, D: The tools and techniques for Qualitative Risk Analysis process are as follows:
Risk Probability and Impact Assessment: Risk probability assessment investigates the chances of a
particular risk to occur.
Risk Impact Assessment investigates the possible effects on the project objectives such as cost,
quality, schedule, or performance, including positive opportunities and negative threats.
Probability and Impact Matrix: Estimation of risk's consequence and priority for awareness is conducted
by using a look-up table or the probability and impact matrix. This matrix specifies the mixture of probability and impact that directs to rating the risks as low, moderate, or high priority.
Risk Data Quality Assessment: Investigation of quality of risk data is a technique to calculate the
degree to which the data about risks are useful for risk management.
Risk Categorization: Risks to the projects can be categorized by sources of risk, the area of project
affected and other valuable types to decide the areas of the project most exposed to the effects of uncertainty.
Risk Urgency Assessment: Risks that requires near-term responses are considered more urgent to
address.
Expert Judgment: It is required to categorize the probability and impact of each risk to determine its
location in the matrix.
NEW QUESTION 532
Tom works as a project manager for BlueWell Inc. He is determining which risks can affect the project. Which of the following inputs of the identify risks process is useful in identifying risks, and provides a quantitative assessment of the likely cost to complete the scheduled activities?
- A. Risk management plan
- B. Cost management plan
- C. Activity cost estimates
- D. Explanation:
The activity cost estimates review is valuable in identifying risks as it provides a quantitative assessment of the expected cost to complete the scheduled activities and is expressed as a range, with a width of the range indicating the degrees of risk. - E. Activity duration estimates
Answer: C,D
Explanation:
is incorrect. This is the output of plan risk management process. A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them. It also consists of the risk assessment matrix. Answer:A is incorrect. The activity duration estimates review is valuable in identifying risks associated to the time allowances for the activities or projects as a whole, with a width of the range indicating the degrees of risk. Answer:C is incorrect. The cost management plan sets how the costs on a project are managed during the project's lifecycle. It defines the format and principles by which the project costs are measured, reported, and controlled. The cost management plan identifies the person responsible for managing costs, those who have the authority to approve changes to the project or its budget, and how cost performance is quantitatively calculated and reported upon.
NEW QUESTION 533
......
Certification Path
The Certified in Risk and Information Systems Control Certification includes only one CRISC exams.
Valid CRISC Test Answers & ISACA CRISC Exam PDF: https://www.passtestking.com/ISACA/CRISC-practice-exam-dumps.html
Realistic CRISC Exam Dumps with Accurate & Updated Questions: https://drive.google.com/open?id=1u55R5zNvkqPVjeMy7GF0Y9NoZWU5Qy2u