Updated Jan 29, 2022 Test Engine to Practice Test for CRISC Valid and Updated Dumps
Exam Questions for CRISC Updated Versions With Test Engine
NEW QUESTION 210
What is the process for selecting and implementing measures to impact risk called?
- A. Risk Treatment
- B. Risk Management
- C. Control
- D. Risk Assessment
Answer: A
Explanation:
Section: Volume A
Explanation:
The process for selecting and implementing measures for impacting risk in the environment is called risk treatment.
Incorrect Answers:
C: The process of analyzing and evaluating risk is called risk assessment.
D: Risk management is the coordinated activities for directing and controlling the treatment of risk in the organization.
NEW QUESTION 211
Which of the following should be of GREATEST concern lo a risk practitioner reviewing the implementation of an emerging technology?
- A. Lack of alignment to best practices
- B. Lack of risk assessment
- C. Lack of management approval
- D. Lack of risk and control procedures
Answer: B
NEW QUESTION 212
Jeff works as a Project Manager for www.company.com Inc. He and his team members are involved in the identify risk process. Which of the following tools & techniques will Jeff use in the identify risk process?
Each correct answer represents a complete solution. (Choose three.)
- A. Risk categorization
- B. Documentation reviews
- C. Checklist analysis
- D. Information gathering technique
Answer: B,C,D
Explanation:
Section: Volume B
Explanation
Explanation:
The various tools & techniques used in the identify risk process are as follows:
* Documentation reviews
* Information gathering technique
* Checklist analysis
* Assumption analysis
* Diagramming techniques
* SWOT analysis
* Expert judgment
NEW QUESTION 213
Which of the following elements of a risk register is MOST likely to change as a result of change in management's risk appetite?
- A. Risk likelihood and impact
- B. Key risk indicator (KRI) thresholds
- C. Inherent risk
- D. Risk velocity
Answer: B
NEW QUESTION 214
Which of the following issues found during the review of a newly created disaster recovery plan (DRP) should be of MOST concern?
- A. The chief information security officer (CISO) has not approved the plan
- B. The plan is not based on an internationally recognized framework
- C. Several recovery activities will be outsourced
- D. Some critical business applications are not included in the plan
Answer: D
NEW QUESTION 215
A peer review of a risk assessment finds that a relevant threat community was not included. Mitigation of the risk will require substantial changes to a software application. Which of the following is the BEST course of action?
- A. Build a business case to remediate the fix.
- B. Determine the impact of the missing threat.
- C. Research the types of attacks the threat can present.
- D. Ask the business to make a budget request to remediate the problem.
Answer: B
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 216
Which of the following will BEST help to ensure the continued effectiveness of the IT risk management function within an organization experiencing high employee turnover?
- A. An IT strategy committee
- B. Change and release management
- C. Well documented policies and procedures
- D. Risk and issue tracking
Answer: D
NEW QUESTION 217
Which of the following is the MOST important data attribute of key risk indicators (KRIs)?
- A. The data is automatically produced.
- B. The data is measurable.
- C. The data is calculated continuously.
- D. The data is relevant.
Answer: D
NEW QUESTION 218
Which of the following processes is described in the statement below?
"It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project."
- A. Perform Qualitative Risk Analysis
- B. Identify Risks
- C. Perform Quantitative Risk Analysis
- D. Monitor and Control Risks
Answer: D
Explanation:
Section: Volume C
Explanation:
Monitor and Control Risk is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project.
It can involve choosing alternative strategies, executing a contingency or fallback plan, taking corrective action, and modifying the project management plan.
Incorrect Answers:
B: This is the process of numerically analyzing the effect of identified risks on overall project objectives.
C: This is the process of determining which risks may affect the project and documenting their characteristics.
D: This is the process of prioritizing risks for further analysis or action by accessing and combining their probability of occurrence and impact.
NEW QUESTION 219
An organization's chief technology officer (CTO) has decided to accept the risk associated with the potential loss from a denial-of-service (DoS) attack. In this situation, the risk practitioner's BEST course of action is to:
- A. update the risk register with the selected risk response.
- B. recommend that the CTO revisit the risk acceptance decision.
- C. validate the CTO's decision wish the business process owner.
- D. identify key risk indicators (KRIs) for ongoing monitoring.
Answer: C
Explanation:
Section: Volume D
NEW QUESTION 220
Winch of the following key control indicators (KCIs) BEST indicates whether security requirements are identified and managed throughout a project He cycle?
- A. Number of projects going live without a security review
- B. Number of security projects started in core departments
- C. Number of security-related status reports submitted by project managers
- D. Number of employees completing project-specific security training
Answer: C
NEW QUESTION 221
Who should be accountable for monitoring the control environment to ensure controls are effective?
- A. Security monitoring operations
- B. Risk owner
- C. System owner
- D. Impacted data owner
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 222
Which of the following baselines identifies the specifications required by the resource that meet the approved requirements?
- A. Functional baseline
- B. is incorrect. Functional baseline identifies the initial specifications before any changes
are made. - C. Explanation:
Allocated baseline identifies the specifications that meet the approved requirements. - D. Product baseline
- E. Developmental baseline
- F. Allocated baseline
- G. is incorrect. Product baseline identifies the minimal specification required by the
resource to meet business outcomes.
Answer: F
Explanation:
is incorrect. Developmental baseline identifies the state of the resources as it is
developed to meet or exceed expectations and requirements.
NEW QUESTION 223
You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?
- A. Project network diagrams
- B. Explanation:
Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and oppourtunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility. - C. Cause-and-effect analysis
- D. Delphi Technique
- E. Decision tree analysis
Answer: E
Explanation:
is incorrect. Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus. Answer: A is incorrect. Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning. Answer: B is incorrect. Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning.
This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.
NEW QUESTION 224
A monthly payment report is generated from the enterprise resource planning (ERP) software to validate data against the old and new payroll systems. What is the BEST way to mitigate the risk associated with data integrity loss in the new payroll system after data migration?
- A. Compare encrypted data with checksums.
- B. Compare new system reports with functional requirements.
- C. Compare results of user acceptance testing (UAT) with the testing criteria.
- D. Compare processing output from both systems using the previous month's data.
Answer: D
NEW QUESTION 225
What are the requirements of effectively communicating risk analysis results to the relevant stakeholders?
Each correct answer represents a part of the solution. Choose three.
- A. Provide decision makers with an understanding of worst-case and most probable scenarios
- B. Communicate only the negative risk impacts of events in order to drive response decisions
- C. The results should be reported in terms and formats that are useful to support business decisions
- D. Communicate the risk-return context clearly
Answer: A,C,D
Explanation:
Explanation/Reference:
Explanation:
The result of risk analysis process is being communicated to relevant stakeholders. The steps that are involved in communication are:
The results should be reported in terms and formats that are useful to support business decisions.
Coordinate additional risk analysis activity as required by decision makers, like report rejection and
scope adjustment.
Communicate the risk-return context clearly, which include probabilities of loss and/or gain, ranges, and
confidence levels (if possible) that enable management to balance risk-return.
Identify the negative impacts of events that drive response decisions as well as positive impacts of
events that represent opportunities which should channel back into the strategy and objective setting process.
Provide decision makers with an understanding of worst-case and most probable scenarios, due
diligence exposures and significant reputation, legal or regulatory considerations.
Incorrect Answers:
B: Both the negative and positive risk impacts are being communicated to relevant stakeholders. Identify the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process.
NEW QUESTION 226
Which of the following is the MOST important consideration when identifying stakeholders to review risk scenarios developed by a risk analyst? The reviewers are:
- A. accountable for the affected processes.
- B. members of senior management.
- C. independent from the business operations.
- D. authorized to select risk mitigation options.
Answer: A
NEW QUESTION 227
An organization operates in an environment where reduced time-to-market for new software products is a top business priority. Which of the following should be the risk practitioner's GREATEST concern?
- A. Customer support help desk staff does not have adequate training
- B. Sufficient resources are not assigned to IT development projects
- C. The corporate email system does not identify and store phishing emails
- D. Email infrastructure does not have proper rollback plans
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 228
Which of the following is the PRIMARY responsibility of the first line of defense related to computer-enabled fraud?
- A. Providing oversight of risk management processes
- B. Implementing processes to detect and deter fraud
- C. Ensuring that risk and control assessments consider fraud
- D. Monitoring the results of actions taken to mitigate fraud
Answer: C
NEW QUESTION 229
A trusted third party service provider has determined that the risk of a client's systems being hacked is low.
Which of the following would be the client's BEST course of action?
- A. Perform their own risk assessment.
- B. Implement additional controls to address the risk.
- C. Accept the risk based on the third party's risk assessment.
- D. Perform an independent audit of the third party.
Answer: D
Explanation:
Section: Volume D
NEW QUESTION 230
To effectively support business decisions, an IT risk register MUST:
- A. effectively support a business maturity model.
- B. be reviewed by the IT steering committee.
- C. reflect the results of risk assessments.
- D. be available to operational groups.
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 231
......
CRISC Exam Dumps - Free Demo & 365 Day Updates: https://www.trainingdump.com/ISACA/CRISC-practice-exam-dumps.html
Pass CRISC Exam with Updated CRISC Exam Dumps PDF: https://drive.google.com/open?id=1fif7B2XfOnIOXazETfcPmuaXiLKsqfuk