CRISC Study Guide Brilliant CRISC Exam Dumps PDF
View CRISC Exam Question Dumps With Latest Demo
ISACA CRISC Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION 406
During qualitative risk analysis you want to define the risk urgency assessment. All of the following are indicators of risk priority except for which one?
- A. Risk rating
- B. Cost of the project
- C. Symptoms
- D. Warning signs
Answer: B
Explanation:
Section: Volume B
Explanation:
The cost of the project is not an indicator of risk urgency. The affect of the risk on the overall cost of the project may be considered, but it is not the best answer.
Incorrect Answers:
A: Warning signs are an indicator of the risk urgency.
B: Symptoms are an indicator of the risk urgency.
C: The risk rating can be an indicator of the risk urgency.
NEW QUESTION 407
Which of the following are true for quantitative analysis?
Each correct answer represents a complete solution. Choose three.
- A. Produces statistically reliable results
- B. Allows discovery of which phenomena are likely to be genuine and which are merely chance occurrences
- C. Allows data to be classified and counted
- D. Determines risk factors in terms of high/medium/low.
Answer: A,B,C
Explanation:
Explanation/Reference:
Explanation:
As quantitative analysis is data driven, it:
Allows data classification and counting.
Allows statistical models to be constructed, which help in explaining what is being observed.
Generalizes findings for a larger population and direct comparisons between two different sets of data
or observations.
Produces statistically reliable results.
Allows discovery of phenomena which are likely to be genuine and merely occurs by chance.
Incorrect Answers:
A: Risk factors are expressed in terms of high/medium/low in qualitative analysis, and not in quantitative analysis.
NEW QUESTION 408
A change management process has recently been updated with new testing procedures. What is the NEXT course of action?
- A. Communicate to those who test and promote changes.
- B. Conduct a cost-benefit analysis to justify the cost of the control.
- C. Assess the maturity of the change management process.
- D. Monitor processes to ensure recent updates are being followed.
Answer: D
NEW QUESTION 409
Which of the following is MOST important to include when identifying risk scenarios for inclusion in a risk review of a third-party service provider?
- A. Supplier questionnaires.
- B. Process mapping.
- C. Purchasing agreements.
- D. Open vendor issues.
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 410
When it appears that a project risk is going to happen, what is this term called?
- A. Trigger
- B. Threshold
- C. Contingency response
- D. Issue
Answer: A
Explanation:
Section: Volume C
Explanation:
A trigger is a warning sign or a condition that a risk event is likely to occur within the project.
Incorrect Answers:
A: Issues are events that come about as a result of risk events. Risks become issues only after they have actually occurred.
B: A contingency response is a pre-planned response for a risk event, such as a rollback plan.
D: A threshold is a limit that the risk passes to actually become an issue in the project.
NEW QUESTION 411
Tom works as a project manager for BlueWell Inc. He is determining which risks can affect the project. Which of the following inputs of the identify risks process is useful in identifying risks, and provides a quantitative assessment of the likely cost to complete the scheduled activities?
- A. Cost management plan
- B. Activity duration estimates
- C. Risk management plan
- D. Activity cost estimates
Answer: D
Explanation:
Section: Volume C
Explanation:
The activity cost estimates review is valuable in identifying risks as it provides a quantitative assessment of the expected cost to complete the scheduled activities and is expressed as a range, with a width of the range indicating the degrees of risk.
Incorrect Answers:
A: The activity duration estimates review is valuable in identifying risks associated to the time allowances for the activities or projects as a whole, with a width of the range indicating the degrees of risk.
B: This is the output of plan risk management process. A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them. It also consists of the risk assessment matrix.
C: The cost management plan sets how the costs on a project are managed during the project's lifecycle. It defines the format and principles by which the project costs are measured, reported, and controlled. The cost management plan identifies the person responsible for managing costs, those who have the authority to approve changes to the project or its budget, and how cost performance is quantitatively calculated and reported upon.
NEW QUESTION 412
Which of the following statements are true for enterprise's risk management capability maturity level 3?
- A. Risk management is viewed as a business issue, and both the drawbacks and benefits of risk are recognized
- B. Explanation:
An enterprise's risk management capability maturity level is 3 when:
Risk management is viewed as a business issue, and both the drawbacks and benefits of risk are
recognized.
There is a selected leader for risk management, engaged with the enterprise risk committee,
across the enterprise.
The business knows how IT fits in the enterprise risk universe and the risk portfolio view.
Local tolerances drive the enterprise risk tolerance.
Risk management activities are being aligned across the enterprise.
Formal risk categories are identified and described in clear terms.
Situations and scenarios are included in risk awareness training beyond specific policy and
structures and promote a common language for communicating risk.
Defined requirements exist for a centralized inventory of risk issues.
Workflow tools are used to accelerate risk issues and track decisions. - C. Workflow tools are used to accelerate risk issues and track decisions
- D. The enterprise formally requires continuous improvement of risk management skills, based on clearly defined personal and enterprise goals
- E. The business knows how IT fits in the enterprise risk universe and the risk portfolio view
Answer: A,B,C,E
Explanation:
is incorrect. Enterprise having risk management capability maturity level 5 requires continuous improvement of risk management skills, based on clearly defined personal and enterprise goals.
NEW QUESTION 413
Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?
- A. A decrease in the number of key controls
- B. Changes in control ownership
- C. Changes in control design
- D. An increase in residual risk
Answer: D
NEW QUESTION 414
An organization moved its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation stipulates that data can only be processed within the country where it is collected. Which of the following should be done FIRST when addressing this situation?
- A. Understand data flows.
- B. Implement strong access controls.
- C. Include a right-to-audit clause.
- D. Analyze data protection methods.
Answer: A
NEW QUESTION 415
Which of the following are parts of SWOT Analysis?
Each correct answer represents a complete solution. (Choose four.)
- A. Opportunities
- B. Tools
- C. Strengths
- D. Threats
- E. Weaknesses
Answer: A,C,D,E
Explanation:
Section: Volume D
Explanation:
SWOT analysis is a strategic planning method used to evaluate the Strengths, Weaknesses, Opportunities, and Threats involved in a project or in a business venture. It involves specifying the objective of the business venture or project and identifying the internal and external factors that are favorable and unfavorable to achieving that objective. The technique is credited to Albert Humphrey, who led a research project at Stanford University in the 1960s and 1970s using data from Fortune 500 companies.
Incorrect Answers:
B: Tools are not the parts of SWOT analysis.
NEW QUESTION 416
Which of the following should be implemented to BEST mitigate the risk associated with infrastructure updates?
- A. Change management audit
- B. Risk assessment
- C. Role-specific technical training
- D. Change control process
Answer: D
NEW QUESTION 417
When preparing a risk status report for periodic review by senior management, it is MOST important to ensure the report includes:
- A. recommendations by an independent risk assessor
- B. risk exposure in business terms
- C. a summary of incidents that have impacted the organization
- D. a detailed view of individual risk exposures
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 418
Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?
- A. Number of high-risk vulnerabilities outstanding
- B. Defined thresholds for high-risk vulnerabilities
- C. Percentage of high-risk vulnerabilities addressed
- D. Percentage of high-risk vulnerabilities missed
Answer: C
NEW QUESTION 419
You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk the response adopted is re- architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?
- A. Business case to be made
- B. Deferrals
- C. Contagious risk
- D. Quick win
Answer: A
Explanation:
Explanation/Reference:
Explanation:
This is categorized as a Business case to be made because the project cost is very large. The response to be implemented requires quite large investment. Therefore it comes under business case to be made.
Incorrect Answers:
A: It addresses costly risk response to a low risk. But here the response is less costly than that of business case to be made.
B: Quick win is very effective and efficient response that addresses medium to high risk. But in this the response does not require large investments.
D: This is not risk response prioritization option, instead it is a type of risk that happen with the several of the enterprise's business partners within a very short time frame.
NEW QUESTION 420
You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk, the response adopted is re- architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?
- A. Business case to be made
- B. Deferrals
- C. Contagious risk
- D. Quick win
Answer: A
Explanation:
Section: Volume A
Explanation:
This is categorized as a Business case to be made because the project cost is very large. The response to be implemented requires quite large investment. Therefore it comes under business case to be made.
Incorrect Answers:
A: It addresses costly risk response to a low risk. But here the response is less costly than that of business case to be made.
B: Quick win is very effective and efficient response that addresses medium to high risk. But in this the response does not require large investments.
D: This is not risk response prioritization option, instead it is a type of risk that happen with the several of the enterprise's business partners within a very short time frame.
NEW QUESTION 421
Which of the following is MOST important to have in place to ensure the effectiveness of risk and security metrics reporting?
- A. Regularly scheduled audits
- B. Incident reporting procedures
- C. Incident management policy
- D. Organizational reporting process
Answer: D
NEW QUESTION 422
You are the project manager of GHT project. Your project utilizes a machine for production of goods. This machine has the specification that if its temperature would rise above 450 degree Fahrenheit then it may result in burning of windings. So, there is an alarm which blows when machine's temperature reaches 430 degree Fahrenheit and the machine is shut off for 1 hour. What role does alarm contribute here?
- A. Of risk indicator
- B. Of risk response
- C. Of risk trigger
- D. Of risk identification
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Here in this scenario alarm indicates the potential risk that the rising temperature of machine can cause, hence it is enacting as a risk indicator.
Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.
Incorrect Answers:
B: The first thing we must do in risk management is to identify the areas of the project where the risks can occur. This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
C: The temperature 430 degrees in scenario is the risk trigger. A risk trigger is a warning sign or condition that a risk event is about to happen. As in this scenario the 430-degree temperature is the indication of upcoming risks, hence 430 degree temperature is a risk trigger.
D: Risk response is the action taken to reduce the risk event occurrence. Hence here risk response is shutting off of machine.
NEW QUESTION 423
Which of the following business requirements MOST relates to the need for resilient business and information systems processes?
- A. Availability
- B. Integrity
- C. Effectiveness
- D. Confidentiality
Answer: A
Explanation:
Section: Volume D
Explanation:
Availability relates to information being available when required by the business process in present as well as in future. Resilience is the ability to provide and maintain an acceptable level of service during disasters or when facing operational challenges. Hence they are most closely related.
Incorrect Answers:
A: Integrity relates to the accuracy and completeness of information as well as to its validity in accordance with business values and expectations. While the lack of system resilience can in some cases affect data integrity, resilience is more closely linked to the business information requirement of availability.
B: Confidentiality deals with the protection of sensitive information from unauthorized disclosure. While the lack of system resilience can in some cases affect data confidentiality, resilience is more closely linked to the business information requirement of availability.
C: Effectiveness deals with information being relevant and pertinent to the business process as well as being delivered in a timely, correct, consistent and usable manner. While the lack of system resilience can in some cases affect effectiveness, resilience is more closely linked to the business information requirement of availability.
NEW QUESTION 424
You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. Choose three.
- A. It helps making smart choices based on potential risk mitigation costs and losses
- B. It helps in taking risk response decisions
- C. It helps in determination of the cost of protecting what is important
- D. It helps in providing a monetary impact view of risk
Answer: A,C,D
Explanation:
Section: Volume C
Explanation/Reference:
NEW QUESTION 425
The BEST way to determine the likelihood of a system availability risk scenario is by assessing the:
- A. redundancy of technical infrastructure
- B. availability of fault tolerant software
- C. strategic plan for business growth
- D. vulnerability scan results of critical systems
Answer: A
NEW QUESTION 426
Who should be PRIMARILY responsible for establishing an organization's IT risk culture?
- A. Executive management
- B. IT management
- C. Business process owner
- D. Risk management
Answer: A
NEW QUESTION 427
Which of the following provides the MOST useful information when developing a risk profile for management approval?
- A. Inherent risk and risk tolerance
- B. Strength of detective and preventative controls
- C. Effectiveness and efficiency of controls
- D. Residual risk and risk appetite
Answer: D
NEW QUESTION 428
You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?
- A. Decision tree analysis
- B. Project network diagrams
- C. Delphi Technique
- D. Cause-and-effect analysis
Answer: A
Explanation:
Section: Volume C
Explanation
Explanation:
Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.
Incorrect Answers:
A: Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning.
B: Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning. This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.
D: Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus.
NEW QUESTION 429
You are the project manager of GHT project. Your project utilizes a machine for production of goods. This machine has the specification that if its temperature would rise above 450 degree Fahrenheit then it may result in burning of windings. So, there is an alarm which blows when machine's temperature reaches 430 degree Fahrenheit and the machine is shut off for 1 hour.
What role does alarm contribute here?
- A. Of risk indicator
- B. Explanation:
Here in this scenario alarm indicates the potential risk that the rising temperature of machine can cause, hence it is enacting as a risk indicator. Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks. - C. Of risk response
- D. Of risk trigger
- E. Of risk identification
Answer: A
Explanation:
is incorrect. The temperature 430 degree in scenario is the risk trigger. A risk trigger is a warning sign or condition that a risk event is about to happen. As in this scenario the 430 degree temperature is the indication of upcoming risks, hence 430 degree temperature is a risk trigger. Answer:D is incorrect. Risk response is the action taken to reduce the risk event occurrence. Hence here risk response is shutting off of machine. Answer:B is incorrect. The first thing we must do in risk management is to identify the areas of the project where the risks can occur. This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
NEW QUESTION 430
......
Free CRISC Test Questions Real Practice Test Questions: https://www.trainingdump.com/ISACA/CRISC-practice-exam-dumps.html
CRISC Dumps Updated Mar 21, 2023 WIith 1014 Questions: https://drive.google.com/open?id=1uvLbjpMHDxukpJ0vfBhHEM-vsNXchEup