Steps Necessary To Pass The CRISC Exam from Training Expert VCEEngine
Valid Way To Pass Isaca Certificaton's CRISC Exam
NEW QUESTION 127
An organization has outsourced its IT security operations to a third party. Who is ULTIMATELY accountable for the risk associated with the outsourced operations?
- A. The organization's management
- B. The control operators at the third party
- C. The organization's vendor management office
- D. The third party s management
Answer: A
NEW QUESTION 128
Which of the following BEST indicates that an organization has implemented IT performance requirements?
- A. Service level agreements
- B. Vendor references
- C. Accountability matrix
- D. Benchmarking data
Answer: A
NEW QUESTION 129
Which of the following IS processes provide indirect information?
Each correct answer represents a complete solution. Choose three.
- A. Problem management
- B. Post-implementation reviews of program changes
- C. Recovery testing
- D. Security log monitoring
Answer: A,B,D
Explanation:
Section: Volume B
Explanation:
Security log monitoring, Post-implementation reviews of program changes, and Problem management provide indirect information. Security log monitoring provide indirect information about certain controls in the security environment, particularly when used to analyze the source of failed access attempts.
Post-implementation reviews of program changes provide indirect information about the effectiveness of internal controls over the development process.
Problem management provide indirect information about the effectiveness of several different IS processes that may ultimately be determined to be the source of incidents.
Incorrect Answers:
D: Recovery testing is the direct evidence that the redundancy or backup controls work effectively. It doesn't provide any indirect information.
NEW QUESTION 130
An organization is planning to acquire a new financial system. Which of the following stakeholders would provide the MOST relevant information for analyzing the risk associated with the new IT solution?
- A. Internal auditor
- B. Project sponsor
- C. Risk manager
- D. Process owner
Answer: C
Explanation:
Section: Volume D
Explanation
NEW QUESTION 131
Which of the following is prepared by the business and serves as a starting point for producing the IT Service Continuity Strategy?
- A. Business Continuity Strategy
- B. Index of Disaster-Relevant Information
- C. Availability/ ITSCM/ Security Testing Schedule
- D. Explanation:
The Business Continuity Strategy is an outline of the approach to ensure the continuity of Vital Business Functions in the case of disaster events. The Business Continuity Strategy is prepared by the business and serves as a starting point for producing the IT Service Continuity Strategy. - E. Disaster Invocation Guideline
Answer: A
Explanation:
is incorrect. Disaster Invocation Guideline is a document produced by IT Service Continuity Management with detailed instructions on when and how to invoke the procedure for fighting a disaster. Most importantly, the guideline defines the first step to be taken by the Service Desk after learning that a disaster has occurred. Answer: B is incorrect. Index of Disaster-Relevant Information is a catalogue of all information that is relevant in the event of disasters. This document is maintained and circulated by IT Service Continuity Management to all members of IT staff with responsibilities for fighting disasters. Answer: D is incorrect. Availability/ ITSCM/ Security Testing Schedule is a schedule for the regular testing of all availability, continuity, and security mechanisms jointly maintained by Availability, IT Service Continuity, and IT Security Management.
NEW QUESTION 132
You are the project manager of HGT project. You have identified project risks and applied appropriate response for its mitigation. You noticed a risk generated as a result of applying response. What this resulting risk is known as?
- A. Response risk
- B. Secondary risk
- C. High risk
- D. Pure risk
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Secondary risk is a risk that is generated as the result of risk response.
Incorrect Answers:
A: A pure risk is a risk that has only a negative effect on the project. Pure risks are activities that are dangerous to complete and manage such as construction, electrical work, or manufacturing.
C, D: These terms are not applied for the risk that is generated as a result of risk response.
NEW QUESTION 133
Which of the following is prepared by the business and serves as a starting point for producing the IT Service Continuity Strategy?
- A. Business Continuity Strategy
- B. Index of Disaster-Relevant Information
- C. Availability/ ITSCM/ Security Testing Schedule
- D. Disaster Invocation Guideline
Answer: A
Explanation:
Section: Volume A
Explanation:
The Business Continuity Strategy is an outline of the approach to ensure the continuity of Vital Business Functions in the case of disaster events. The Business Continuity Strategy is prepared by the business and serves as a starting point for producing the IT Service Continuity Strategy.
Incorrect Answers:
B: Index of Disaster-Relevant Information is a catalog of all information that is relevant in the event of disasters.
This document is maintained and circulated by IT Service Continuity Management to all members of IT staff with responsibilities for fighting disasters.
C: Disaster Invocation Guideline is a document produced by IT Service Continuity Management with detailed instructions on when and how to invoke the procedure for fighting a disaster. Most importantly, the guideline defines the first step to be taken by the Service Desk after learning that a disaster has occurred.
D: Availability/ ITSCM/ Security Testing Schedule is a schedule for the regular testing of all availability, continuity, and security mechanisms jointly maintained by Availability, IT Service Continuity, and IT Security Management.
NEW QUESTION 134
You work as a Project Manager for Company Inc. You have to conduct the risk management activities for a project. Which of the following inputs will you use in the plan risk management process?
Each correct answer represents a complete solution. Choose all that apply.
- A. Schedule management plan
- B. Cost management plan
- C. Project scope statement
- D. Explanation:
The inputs to the plan risk management process are as follows:
Project scope statement: It provides a clear sense of the range of possibilities associated with the
project and establishes the framework for how significant the risk management effort may become.
Cost management plan: It describes how risk budgets, contingencies, and management reserves
will be reported and accessed.
Schedule management plan: It describes how the schedule contingencies will be reported and
assessed.
Communication management plan: It describes the interactions, which occurs on the project and
determines who will be available to share information on various risks and responses at different
times.
Enterprise environmental factors: It include, but are not limited to, risk attitudes and tolerances that
describe the degree of risk that an organization withstand.
Organizational process assets: It includes, but are not limited to, risk categories, risk statement
formats, standard templates, roles and responsibilities, authority levels for decision-making,
lessons learned, and stakeholder registers. - E. Quality management plan
Answer: A,B,C,D
Explanation:
is incorrect. It is not an input for Plan risk management process.
NEW QUESTION 135
An organization is considering adopting artificial intelligence (AI). Which of the following is the risk practitioner's MOST important course of action?
- A. Develop key risk indicators (KRIs).
- B. Ensure sufficient pre-implementation testing.
- C. Identify applicable risk scenarios.
- D. Identify the organization's critical data.
Answer: C
NEW QUESTION 136
Which of the following methods is an example of risk mitigation?
- A. Not providing capability for employees to work remotely
- B. Outsourcing the IT activities and infrastructure
- C. Taking out insurance coverage for IT-related incidents
- D. Enforcing change and configuration management processes
Answer: D
NEW QUESTION 137
A bank has outsourced its statement printing function to an external service provider. Which of the following is the MOST critical requirement to include in the contract?
- A. Monitoring of service costs
- B. Notification of sub-contracting arrangements
- C. Confidentiality of customer data
- D. Provision of internal audit reports
Answer: C
NEW QUESTION 138
You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. Choose three.
- A. It helps making smart choices based on potential risk mitigation costs and losses
- B. It helps in taking risk response decisions
- C. It helps in determination of the cost of protecting what is important
- D. It helps in providing a monetary impact view of risk
Answer: A,C,D
NEW QUESTION 139
To help ensure all applicable risk scenarios are incorporated into the risk register, it is MOST important to review the:
- A. risk assessment results
- B. cost-benefit analysis
- C. vulnerability assessment results
- D. risk mitigation approach
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 140
An IT license audit has revealed that there are several unlicensed copies of co be to:
- A. procure the requisite licenses for the software to minimize business impact.
- B. centralize administration rights on laptops so that installations are controlled
- C. report the issue to management so appropriate action can be taken.
- D. immediately uninstall the unlicensed software from the laptops
Answer: B
NEW QUESTION 141
An enterprise has identified risk events in a project. While responding to these identified risk events, which among the following stakeholders is MOST important for reviewing risk response options to an IT risk.
- A. Incident response team members
- B. Information security managers
- C. Internal auditors
- D. Explanation:
Business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others. - E. Business managers
Answer: D,E
Explanation:
is incorrect. Information security managers may best understand the technical tactical situation, but business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others, which includes collaboration with, and support from, lT security managers. Answer: C is incorrect. The incident response team must ensure open communication to management and stakeholders to ensure that business managers understand the associatedrisk and are provided enough information to make informed risk-based decisions. They are not responsible for reviewing risk response options.
NEW QUESTION 142
The MAIN goal of the risk analysis process is to determine the:
- A. control deficiencies
- B. frequency and magnitude of loss
- C. threats and vulnerabilities
- D. potential severity of impact
Answer: B
NEW QUESTION 143
All business units within an organization have the same risk response plan for creating local disaster recovery plans. In an effort to achieve cost effectiveness., the BEST course of action would be to:
- A. evaluate opportunities to combine disaster recovery plans
- B. outsource disaster recovery to an external provider
- C. select a provider to standardize the disaster recovery plans
- D. centralize the risk response function at the enterprise level
Answer: A
NEW QUESTION 144
Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes' impact on the features and functions of the project's product?
- A. Configuration management system
- B. Cost change control system
- C. Explanation:
The configuration management system ensures that proposed changes to the project's scope are reviewed and evaluated for their affect on the project's product. Configure management process is important in achieving business objectives. Ensuring the integrity of hardware and software configurations requires the establishment and maintenance of an accurate and complete configuration repository. This process includes collecting initial configuration information, establishing baselines, verifying and auditing configuration information, and updating the configuration repository as needed. Effective configuration management facilitates greater system availability minimizes production issues and resolves issues more quickly. - D. Integrated change control
- E. Scope change control system
Answer: A
Explanation:
is incorrect. The scope change control system focuses on reviewing the actual changes to the project scope. When a change to the project's scope is proposed, the configuration management system is also invoked. Answer:A is incorrect. The cost change control system is responsible for reviewing and controlling changes to the project costs. Answer:D is incorrect. Integrated change control examines the affect of a proposed change on the project as a whole.
NEW QUESTION 145
The best way to test the operational effectiveness of a data backup procedure is to:
- A. inspect a selection of audit trails and backup logs
- B. interview employees to compare actual with expected procedures
- C. demonstrate a successful recovery from backup files
- D. conduct an audit of files stored offsite
Answer: D
Explanation:
Section: Volume D
NEW QUESTION 146
An organization has outsourced its billing function to an external service provider. Who should own the risk of customer data leakage caused by the service provider?
- A. Vendor risk manager
- B. Business process owner
- C. The service provider
- D. Legal counsel
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 147
Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?
- A. An acceptable usage policy
- B. A data extraction tool
- C. An access control list
- D. An intrusion detection system (IDS)
Answer: D
NEW QUESTION 148
Which of the following would BEST help secure online financial transactions from improper users?
- A. Multi-level authorization
- B. Review of log-in attempts
- C. Periodic review of audit trails
- D. Multi-factor authentication
Answer: D
Explanation:
Section: Volume D
NEW QUESTION 149
You work as a project manager for TechSoft Inc. You are working with the project stakeholders on the qualitative risk analysis process in your project. You have used all the tools to the qualitative risk analysis process in your project. Which of the following techniques is NOT used as a tool in qualitative risk analysis process?
- A. Risk Reassessment
- B. Risk Categorization
- C. Risk Data Quality Assessment
- D. Risk Urgency Assessment
Answer: A
Explanation:
Section: Volume D
Explanation:
You will not need the Risk Reassessment technique to perform qualitative risk analysis. It is one of the techniques used to monitor and control risks.
Incorrect Answers:
A, C, D: The tools and techniques for Qualitative Risk Analysis process are as follows:
* Risk Probability and Impact Assessment: Risk probability assessment investigates the chances of a particular risk to occur.
* Risk Impact Assessment investigates the possible effects on the project objectives such as cost, quality, schedule, or performance, including positive opportunities and negative threats.
* Probability and Impact Matrix: Estimation of risk's consequence and priority for awareness is conducted by using a look-up table or the probability and impact matrix. This matrix specifies the mixture of probability and impact that directs to rating the risks as low, moderate, or high priority.
* Risk Data Quality Assessment: Investigation of quality of risk data is a technique to calculate the degree to which the data about risks are useful for risk management.
* Risk Categorization: Risks to the projects can be categorized by sources of risk, the area of project affected and other valuable types to decide the areas of the project most exposed to the effects of uncertainty.
* Risk Urgency Assessment: Risks that requires near-term responses are considered more urgent to address.
* Expert Judgment: It is required to categorize the probability and impact of each risk to determine its location in the matrix.
NEW QUESTION 150
Which of the following is the PRIMARY reason to establish root cause of an IT security incident?
- A. Avoid recurrence of the incident.
- B. Assign responsibility and accountability for the incident.
- C. Prepare a report for senior management.
- D. Update the risk register.
Answer: B
NEW QUESTION 151
You are working in an enterprise. Assuming that your enterprise periodically compares finished goods inventory levels to the perpetual inventories in its ERP system. What kind of information is being provided by the lack of any significant differences between perpetual levels and actual levels?
- A. Risk management plan
- B. Direct information
- C. Risk audit information
- D. Indirect information
Answer: D
Explanation:
Explanation/Reference:
Explanation:
The lack of any significant differences between perpetual levels and actual levels provides indirect information that its billing controls are operating. It does not provide any direct information.
Incorrect Answers:
A: It does not provide direct information as there is no information about the propriety of cutoff.
C, D: These are not the types of information.
NEW QUESTION 152
......
All CRISC Dumps and Certified in Risk and Information Systems Control Training Courses: https://www.vceengine.com/CRISC-vce-test-engine.html
Free Test Engine For Certified in Risk and Information Systems Control Certification Exams: https://drive.google.com/open?id=1JrfT3GsbGqZkM7sz5jQFnT1P6QGHBJsn
