Free ISACA CRISC Übungsprüfungen - Seite 23 von 65

Question #221

A risk practitioner has been notified of a social engineering attack using artificial intelligence (AI) technology to impersonate senior management personnel.

Which of the following would BEST mitigate the impact of such attacks?

A . Subscription to data breach monitoring sites
B . Suspension and takedown of malicious domains or accounts
C . Increased monitoring of executive accounts
D . Training and awareness of employees for increased vigilance

Lösung einblenden Lösung ausblenden

Question #222

Which of the following is the MOST effective way to integrate risk and compliance management?

A . Embedding risk management into compliance decision-making
B . Designing corrective actions to improve risk response capabilities
C . Embedding risk management into processes that are aligned with business drivers
D . Conducting regular self-assessments to verify compliance

Lösung einblenden Lösung ausblenden

Question #223

Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?

A . To determine the inherent risk level
B . To determine the acceptable risk level
C . To determine the current risk level
D . To determine the desired risk level

Lösung einblenden Lösung ausblenden

Richtige Antwort: C
C

Explanation:

During an initial risk assessment, it is crucial to consider existing controls primarily to determine the current risk level. Here’s a detailed explanation:

Understanding Existing Controls:

Existing controls are measures already in place to mitigate risks. These controls can include technical, administrative, and physical safeguards designed to protect organizational assets.

Knowing what controls are currently in place helps to understand the organization’s current defense mechanisms against potential threats.

Assessing the Current Risk Level:

The current risk level is the risk that remains after considering the effectiveness of existing controls, often referred to as residual risk.

By evaluating these controls, one can determine how much risk is actually mitigated and what level of risk remains.

For instance, if an organization has implemented firewalls and intrusion detection systems, these controls would reduce the risk of cyber attacks. The effectiveness of these controls will determine the residual risk level.

Differentiating Between Risk Types:

Inherent Risk: This is the level of risk that exists before any controls are applied. It’s the raw risk associated with a particular asset or process.

Residual Risk: This is the risk that remains after existing controls have been applied. It’s the actual risk that an organization faces after mitigation efforts.

Current Risk: This term is often used interchangeably with residual risk but focuses on the risk level at the present moment, considering the existing controls. Primary Objective in Initial Risk Assessment:

The primary objective of considering existing controls during the initial risk assessment is to gain an accurate picture of the current risk landscape. This allows risk practitioners to understand what additional controls or modifications might be needed to further reduce risk to acceptable levels. Without considering existing controls, the assessment would only reflect the inherent risk, which doesn’t provide a realistic view of the organization’s risk exposure.

Reference:

The CRISC Review Manual emphasizes the importance of understanding the current risk level by assessing existing controls (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.9.3 Current Risk).

Question #224

An organization has asked an IT risk practitioner to conduct an operational risk assessment on an initiative to outsource the organization’s customer service operations overseas.

Which of the following would MOST significantly impact management’s decision?

A . Time zone difference of the outsourcing location
B . Ongoing financial viability of the outsourcing company
C . Cross-border information transfer restrictions in the outsourcing country
D . Historical network latency between the organization and outsourcing location

Lösung einblenden Lösung ausblenden

Question #225

A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet.

What should be the risk practitioner’s FIRST course of action?

A . invoke the established incident response plan.
B . Inform internal audit.
C . Perform a root cause analysis
D . Conduct an immediate risk assessment

Lösung einblenden Lösung ausblenden

Question #226

An organization is making significant changes to an application. At what point should the application risk profile be updated?

A . After user acceptance testing (UAT)
B . Upon release to production
C . During backlog scheduling
D . When reviewing functional requirements

Lösung einblenden Lösung ausblenden

Question #227

An organization has outsourced its backup and recovery procedures to a third-party cloud provider.

Which of the following is the risk practitioner s BEST course of action?

A . Accept the risk and document contingency plans for data disruption.
B . Remove the associated risk scenario from the risk register due to avoidance.
C . Mitigate the risk with compensating controls enforced by the third-party cloud provider.
D . Validate the transfer of risk and update the register to reflect the change.

Lösung einblenden Lösung ausblenden

Question #228

Which of the following would provide the MOST objective assessment of the effectiveness of an organization’s security controls?

A . An internal audit
B . Security operations center review
C . Internal penetration testing
D . A third-party audit

Lösung einblenden Lösung ausblenden

Question #229

Which of the following would BEST facilitate the implementation of data classification requirements?

A . Assigning a data owner
B . Implementing technical control over the assets
C . Implementing a data loss prevention (DLP) solution
D . Scheduling periodic audits

Lösung einblenden Lösung ausblenden

Question #230

A global organization is planning to collect customer behavior data through social media advertising.

Which of the following is the MOST important business risk to be considered?

A . Regulatory requirements may differ in each country.
B . Data sampling may be impacted by various industry restrictions.
C . Business advertising will need to be tailored by country.
D . The data analysis may be ineffective in achieving objectives.

Lösung einblenden Lösung ausblenden