The Best CRISC Exam Study Material Premium Files and Preparation Tool (Nov-2024)

Get Instant Access to CRISC Practice Exam Questions

NEW QUESTION # 878
Which of the following should be included in a risk scenario to be used for risk analysis?

• A. Residual risk
• B. Risk appetite
• C. Risk tolerance
• D. Threat type

Answer: D

NEW QUESTION # 879
Which of the following is MOST important to include in a Software as a Service (SaaS) vendor agreement?

• A. A service level agreement (SLA)
• B. A requirement to provide an independent audit report
• C. A requirement to adopt an established risk management framework
• D. An annual contract review

Answer: A

Explanation:
A service level agreement (SLA) is a contract between a SaaS vendor and a customer that defines the quality and availability of the SaaS service, as well as the responsibilities and obligations of both parties. An SLA is most important to include in a SaaS vendor agreement because it sets the expectations and standards for the SaaS service, provides a mechanism for measuring and monitoring the service performance, and establishes the remedies and penalties for service failures or breaches. An SLA can also help to mitigate the risks and liabilities associated with SaaS delivery, such as data security, privacy, compliance, and disaster recovery. The other options are not the most important to include in a SaaS vendor agreement, although they may be beneficial or desirable depending on the context and nature of the SaaS service. An annual contract review is a process of evaluating and revising the SaaS vendor agreement to reflect the changing needs and circumstances of the customer and the vendor, but it is not a mandatory or essential element of the agreement. A requirement to adopt an established risk management framework is a way of ensuring that the SaaS vendor follows the best practices and standards for identifying, assessing, and mitigating the risks related to the SaaS service, but it is not a specific or measurable term of the agreement. A requirement to provide an independent audit report is a way of verifying and validating the SaaS vendor's compliance with the SLA and other contractual obligations, but it is not a direct or primary component of the agreement. References = SaaS Agreements: Key Contractual Provisions, SaaS Agreement: Everything You Need to Know, Essential checklist for SaaS agreement negotiations, Key Clauses To Understand and Evaluate in SaaS Contracts, SaaS Reseller Agreement:
Everything You Need to Know

NEW QUESTION # 880
Which of the following risks is the risk that happen with an important business partner and affects a large group of enterprises within an area or industry?

• A. Systemic risk
• B. Reporting risk
• C. Operational risk
• D. Contagious risk

Answer: A

Explanation:
Section: Volume A
Explanation:
Systemic risks are those risks that happen with an important business partner and affect a large group of enterprises within an area or industry. An example would be a nationwide air traffic control system that goes down for an extended period of time (six hours), which affects air traffic on a very large scale.
Incorrect Answers:
A: Contagious risks are those risk events that happen with several of the enterprise's business partners within a very short time frame.
B, C: Their scopes do not limit to the important or general enterprise's business partners. These risks can occur with both.
Operational risks are those risks that are associated with the day-to-day operations of the enterprise. It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
Reporting risks are caused due to wrong reporting which leads to bad decision. This bad decision due to wrong report hence causes a risk on the functionality of the organization.

NEW QUESTION # 881
From a risk management perspective, which of the following is the PRIMARY benefit of using automated system configuration validation tools?

• A. Operational costs are reduced.
• B. Staff costs are reduced.
• C. Inherent risk is reduced.
• D. Residual risk is reduced.

Answer: A

NEW QUESTION # 882
The PRIMARY purpose of IT control status reporting is to:

• A. ensure compliance with IT governance strategy.
• B. benchmark IT controls with Industry standards.
• C. assist internal audit in evaluating and initiating remediation efforts.
• D. facilitate the comparison of the current and desired states.

Answer: D

NEW QUESTION # 883
Which of the following is the BEST indication of the effectiveness of a business continuity program?

• A. Business continuity tests are performed successfully and issues are addressed.
• B. Business continuity and disaster recovery plans are regularly updated.
• C. Business units are familiar with the business continuity plans and process.
• D. Business impact analyses are reviewed and updated in a timely manner.

Answer: A

Explanation:
According to the Section 4: Quiz 40 - Business Continuity Plan Flashcards, the best indication of the effectiveness of a business continuity program is the successful performance of business continuity tests and the resolution of any issues that arise. Business continuity tests are exercises that simulate various scenarios of disruption or disaster and evaluate the organization's ability to recover and resume its critical functions.
Business continuity tests can help to validate the assumptions, objectives, and strategies of the business continuity program, as well as to identify and address any gaps, weaknesses, or errors in the business continuity and disaster recovery plans. By performing business continuity tests regularly and effectively, the organization can ensure that its business continuity program is aligned with its needs and expectations, and that it can cope with any potential crisis. References = Section 4: Quiz 40 - Business Continuity Plan Flashcards

NEW QUESTION # 884
Which of the following are the principles of risk management?
Each correct answer represents a complete solution. Choose three.

• A. Risk management should be transparent and inclusive
• B. Risk management should be an integral part of the organization
• C. Risk management is the responsibility of executive management
• D. Risk management should be a part of decision-making

Answer: A,B,D

Explanation:
Explanation/Reference:
Explanation:
The International Organization for Standardization (ISO) identifies the following principles of risk management. Risk management should:
create value

be an integral part of organizational processes

be part of decision making

explicitly address uncertainty

be systematic and structured

be based on the best available information

be tailored

take into account human factors

be transparent and inclusive

be dynamic, iterative, and responsive to change

be capable of continual improvement and enhancement

NEW QUESTION # 885
A risk practitioner has identified that the organization's secondary data center does not provide redundancy for a critical application. Who should have the authority to accept the associated risk?

• A. Data center manager
• B. Business application owner
• C. Business continuity director
• D. Disaster recovery manager

Answer: B

NEW QUESTION # 886
An organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system. Which of the following is the risk practitioner's BEST course of action?

• A. Perform a penetration test.
• B. Perform an impact assessment.
• C. Escalate the risk to senior management.
• D. Request an external audit.

Answer: B

Explanation:
The risk practitioner's best course of action when an organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system is to perform an impact assessment, as it involves estimating the potential consequences or damage that the vulnerability may cause to the system and its related business processes, and prioritizing the risk response accordingly. The other options are not the best courses of action, as they may not address the urgency or severity of the vulnerability, or may require the prior knowledge of the impact or risk level, respectively. References = CRISC Review Manual, 7th Edition, page
100.

NEW QUESTION # 887
The PRIMARY benefit associated with key risk indicators (KRls) is that they:

• A. help an organization identify emerging threats.
• B. benchmark the organization's risk profile.
• C. identify trends in the organization's vulnerabilities.
• D. enable ongoing monitoring of emerging risk.

Answer: D

NEW QUESTION # 888
Which of the following is the BEST evidence that risk management is driving business decisions in an organization?

• A. Residual risk is within risk tolerance.
• B. Risk ownership is identified and assigned.
• C. Risk treatment options receive adequate funding.
• D. Compliance breaches are addressed in a timely manner.

Answer: C

Explanation:
Risk treatment options are the actions or plans that are implemented to modify or reduce the risk exposure of the organization. Risk treatment options receive adequate funding when the organization allocates sufficient resources and budget to support the risk response actions, and to ensure that the risk controls are effective and efficient. This is the best evidence that risk management is driving business decisions in the organization, as it shows that the organization prioritizes and values the risk management process, and that it aligns its risk strategy and objectives with its business goals and value creation. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 245. CRISC:
Certified in Risk & Information Systems Control Sample Questions, Question 245. CRISC Sample Questions
2024, Question 245.

NEW QUESTION # 889
An organization allows programmers to change production systems in emergency situations. Which of the following is the BEST control?

• A. Implementing an emergency change authorization process
• B. Reviewing the programmers' emergency change reports
• C. Periodically reviewing operator logs
• D. Limiting the number of super users

Answer: A

Explanation:
Implementing an emergency change authorization process is the best control for an organization that allows programmers to change production systems in emergency situations, because it helps to ensure that the changes are justified, approved, documented, and tested before they are implemented, and that they are monitored and reviewed after they are implemented. An emergency change is a change that is required to resolve or prevent a critical issue or incident that may affect the availability, performance, or security of the production systems. A production system is a system that is used to support or enable the operational or business functions or processes of the organization. An emergency change authorization process is a process that defines the roles and responsibilities, criteria and procedures, and tools and techniques for managing and controlling the emergency changes. Implementing an emergency change authorization process is the best control, as it helps to minimize the risks and impacts of the emergency changes, and to maintain the integrity and reliability of the production systems. Periodically reviewing operator logs, limiting the number of super users, and reviewing the programmers' emergency change reports are all possible controls for an organization that allows programmers to change production systems in emergency situations, but they are not the best control, as they do not provide a comprehensive and consistent approach to the emergency change management. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.4.1, page 208

NEW QUESTION # 890
You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events. Where will you record the mitigation response?

• A. Project management plan
• B. Risk register
• C. Risk management plan
• D. Risk log
• E. Explanation:
  The Identified risks and potential responses are documented in the risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonlyfound in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

Answer: B

Explanation:
is incorrect. The risk management plan is an input to the risk response planning, but it is not the best choice for thisquestionoption B is incorrect. This is not a valid choice for thequestionoption C is incorrect. The project management plan is the parent of the risk management plan, but the best choice is the risk register.

NEW QUESTION # 891
Which of the following is MOST important to the effectiveness of key performance indicators (KPIs)?

• A. Automation
• B. Annual review
• C. Relevance
• D. Management approval

Answer: C

Explanation:
Key performance indicators (KPIs) are metrics that reflect how well an organization is achieving its goals and objectives. KPIs should be specific, measurable, achievable, relevant, and time-bound. The most important characteristic of a KPI is its relevance, meaning that it should be aligned with the organization's vision, mission, strategy, and values. A relevant KPI should also be meaningful and useful for the intended audience, such as the management, the staff, or the stakeholders. A relevant KPI should provide insight into the performance and progress of the organization, as well as enable decision making and improvement actions. A KPI that is not relevant may be misleading, inaccurate, or irrelevant, and may not reflect the true state of the organization or its goals. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.2, p. 116-117

NEW QUESTION # 892
An organization is preparing to transfer a large number of customer service representatives to the sales department. Of the following, who is responsible for mitigating the risk associated with residual system access?

• A. IT service desk manager
• B. Customer service manager
• C. Access control manager
• D. Sales manager

Answer: C

Explanation:
* Residual system access is the risk that the customer service representatives who are transferred to the sales department may still have access to the systems or applications that they used in their previous role, which may not be relevant or authorized for their new role.
* The access control manager is the person or function who is responsible for defining, implementing, and maintaining the policies and procedures for granting, modifying, reviewing, and revoking access rights to the systems or applications, based on the principle of least privilege and the segregation of duties.
* The access control manager is responsible for mitigating the risk associated with residual system access, by ensuring that the access rights of the customer service representatives are updated or removed according to their new role and responsibilities, and that the access changes are documented and approved by the appropriate authorities.
* The other options are not responsible for mitigating the risk associated with residual system access.
They are either irrelevant or less effective than the access control manager.
The references for this answer are:
* Risk IT Framework, page 26
* Information Technology & Security, page 20
* Risk Scenarios Starter Pack, page 18

NEW QUESTION # 893
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:

• A. stakeholder risk tolerance.
• B. the control environment.
• C. benchmarking criteria.
• D. suppliers used by the organization.

Answer: A

NEW QUESTION # 894
Which of the following resources is MOST helpful to a risk practitioner when updating the likelihood rating in the risk register?

• A. Audit reports with risk ratings
• B. Penetration test results
• C. Business impact analysis (BIA)
• D. Risk control assessment

Answer: C

NEW QUESTION # 895
Which of the following is the GREATEST risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider?

• A. Inadequate service level agreement (SLA) with the provider
• B. More complex test restores
• C. More complex incident response procedures
• D. Inadequate data encryption

Answer: D

NEW QUESTION # 896
Which of the following is a technique that provides a systematic description of the combination of unwanted occurrences in a system?

• A. Fault tree analysis
• B. Sensitivity analysis
• C. Scenario analysis
• D. Cause and effect analysis

Answer: A

Explanation:
Explanation/Reference:
Explanation:
Fault tree analysis (FIA) is a technique that provides a systematic description of the combination of possible occurrences in a system, which can result in an undesirable outcome. It combines hardware failures and human failures.
Incorrect Answers:
A: Sensitivity analysis is the quantitative risk analysis technique that:
Assist in determination of risk factors that have the most potential impact Examines the extent to which the uncertainty of each element affects the object under consideration when all other uncertain elements are held at their baseline values B: This analysis provides ability to see a range of values across several scenarios to identify risk in specific situation. It provides ability to identify those inputs which will provide the greatest level of uncertainty.
D: Cause-and-effect analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes. These tools also help in identifying potential risk.

NEW QUESTION # 897
Suppose you are working in Company Inc. and you are using risk scenarios for estimating the likelihood and impact of the significant risks on this organization. Which of the following assessment are you doing?

• A. Threat and vulnerability assessment
• B. Risk assessment
• C. IT audit
• D. Explanation:
  Threat and vulnerability assessment consider the full spectrum of risks. It identifies the likelihood of occurrence of risks and impact of the significant risks on the organization using the risk scenarios. For example: Natural threats can be evaluated by using historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, etc.
• E. IT security assessment

Answer: A

Explanation:
is incorrect. Risk assessment uses quantitative and qualitative analysis approaches to evaluate each significant risk identified. Answer:A and B are incorrect. These use either some technical evaluation tool or assessment methodologies to evaluate risk but do not use risk scenarios.

NEW QUESTION # 898
You are the project manager for your organization to install new workstations, servers, and cabling throughout a new building, where your company will be moving into. The vendor for the project informs you that the cost of the cabling has increased due to the some reason. This new cost will cause the cost of your project to increase by nearly eight percent. What change control system should the costs be entered into for review?

• A. Scope change control system
• B. Only changes to the project scope should pass through a change control system.
• C. Contract change control system
• D. Cost change control system

Answer: D

Explanation:
Explanation/Reference:
Explanation:
Because this change deals with the change of the deliverable, it should pass through the cost change control system. The cost change control system reviews the reason why the change has happened, what the cost affects, and how the project should respond.
Incorrect Answers:
B: This is not a contract change. According to the evidence that a contract exists or that the cost of the materials is outside of the terms of a contract if one existed. Considered a time and materials contract where a change of this nature could be acceptable according to the terms of the contract. If the vendor wanted to change the terms of the contract then it would be appropriate to enter the change into the contract change control system.
C: The scope of the project will not change due to the cost of the materials.
D: There are four change control systems that should always be entertained for change: schedule, cost, scope, and contract.

NEW QUESTION # 899
Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

• A. Review management's detailed action plans.
• B. Interview control owners.
• C. Inspect external audit documentation.
• D. Observe the control enhancements in operation.

Answer: D

NEW QUESTION # 900
......

Validate your Skills with Updated CRISC Exam Questions & Answers and Test Engine: https://prep4sure.vce4dumps.com/CRISC-latest-dumps.html