ISACA CRISC Übungsprüfungen
Zuletzt aktualisiert am 06.09.2025- Prüfungscode: CRISC
- Prüfungsname: Certified in Risk and Information Systems Control
- Zertifizierungsanbieter: ISACA
- Zuletzt aktualisiert am: 06.09.2025
The PRIMARY purpose of vulnerability assessments is to:
- A . provide clear evidence that the system is sufficiently secure.
- B . determine the impact of potential threats.
- C . test intrusion detection systems (IDS) and response procedures.
- D . detect weaknesses that could lead to system compromise.
An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack.
Which of the following is the MOST effective control to support this policy?
- A . Conducting periodic vulnerability scanning
- B . Creating immutable backups
- C . Performing required patching
- D . Implementing continuous intrusion detection monitoring
Which of the following is the PRIMARY purpose for ensuring senior management understands the organization’s risk universe in relation to the IT risk management program?
- A . To define effective enterprise IT risk appetite and tolerance levels
- B . To execute the IT risk management strategy in support of business objectives
- C . To establish business-aligned IT risk management organizational structures
- D . To assess the capabilities and maturity of the organization’s IT risk management efforts
Which of the following criteria is MOST important when developing a response to an attack that would compromise data?
- A . The recovery time objective (RTO)
- B . The likelihood of a recurring attack
- C . The organization’s risk tolerance
- D . The business significance of the information
Which of the following BEST facilitates the development of effective IT risk scenarios?
- A . Utilization of a cross-functional team
- B . Participation by IT subject matter experts
- C . Integration of contingency planning
- D . Validation by senior management
Which of the following is BEST used to aggregate data from multiple systems to identify abnormal behavior?
- A . Cyber threat intelligence
- B . Anti-malware software
- C . Endpoint detection and response (EDR)
- D . SIEM systems
Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?
- A . Solutions for eradicating emerging threats
- B . Cost to mitigate the risk resulting from threats
- C . Indicators for detecting the presence of threatsl)
- D . Source and identity of attackers
Which of the following BEST measures the efficiency of an incident response process?
- A . Number of incidents escalated to management
- B . Average time between changes and updating of escalation matrix
- C . Average gap between actual and agreed response times
- D . Number of incidents lacking responses
Which of the following is the GREATEST benefit of a three lines of defense structure?
- A . An effective risk culture that empowers employees to report risk
- B . Effective segregation of duties to prevent internal fraud
- C . Clear accountability for risk management processes
- D . Improved effectiveness and efficiency of business operations
Which of the following is the MOST effective way to help ensure an organization’s current risk scenarios are relevant?
- A . Adoption of industry best practices
- B . Involvement of stakeholders in risk assessment
- C . Review of risk scenarios by independent parties
- D . Documentation of potential risk in business cases