Free ISACA CRISC Übungsprüfungen - Seite 26 von 65

Question #251

During a risk treatment plan review, a risk practitioner finds the approved risk action plan has not been completed However, there were other risk mitigation actions implemented.

Which of the fallowing is the BEST course of action?

A . Review the cost-benefit of mitigating controls
B . Mark the risk status as unresolved within the risk register
C . Verify the sufficiency of mitigating controls with the risk owner
D . Update the risk register with implemented mitigating actions

Lösung einblenden Lösung ausblenden

Question #252

Which of the following BEST enables a risk practitioner to understand management’s approach to organizational risk?

A . Organizational structure and job descriptions
B . Risk appetite and risk tolerance
C . Industry best practices for risk management
D . Prior year’s risk assessment results

Lösung einblenden Lösung ausblenden

Question #253

Which of the following is a risk practitioner’s BEST course of action upon learning that regulatory authorities have concerns with an emerging technology the organization is considering?

A . Redesign key risk indicators (KRIs).
B . Update risk responses.
C . Conduct a SWOT analysis.
D . Perform a threat assessment.

Lösung einblenden Lösung ausblenden

Question #254

When performing a risk assessment of a new service to support a ewe Business process.

Which of the following should be done FRST10 ensure continuity of operations?

A . a identity conditions that may cause disruptions
B . Review incident response procedures
C . Evaluate the probability of risk events
D . Define metrics for restoring availability

Lösung einblenden Lösung ausblenden

Question #255

Which of the following is MOST likely to introduce risk for financial institutions that use blockchain?

A . Cost of implementation
B . Implementation of unproven applications
C . Disruption to business processes
D . Increase in attack surface area

Lösung einblenden Lösung ausblenden

Question #256

The BEST key performance indicator (KPI) for monitoring adherence to an organization’s user accounts provisioning practices is the percentage of:

A . accounts without documented approval
B . user accounts with default passwords
C . active accounts belonging to former personnel
D . accounts with dormant activity.

Lösung einblenden Lösung ausblenden

Richtige Antwort: A
A

Explanation:

User accounts provisioning is the process of creating, managing, and modifying user accounts within a system or an application, based on the user’s roles, responsibilities, and requirements. User accounts provisioning is an essential part of identity and access management (IAM), which aims to ensure the confidentiality, integrity, and availability of the system or the application, and the information or resources that it handles or supports1.

The best key performance indicator (KPI) for monitoring adherence to an organization’s user accounts provisioning practices is the percentage of accounts without documented approval, because it can help to measure how well the organization follows the policies, standards, and procedures for user accounts provisioning, and how effectively the organization controls and audits the user accounts provisioning activities. The percentage of accounts without documented approval can indicate:

The level of compliance and accountability of the user accounts provisioning process, and the extent to which the user accounts provisioning requests and actions are authorized and verified by the appropriate parties, such as managers, IT staff, or security officers

The level of risk and exposure of the user accounts provisioning process, and the likelihood and impact of unauthorized or inappropriate user accounts provisioning, such as granting excessive or unnecessary access privileges, creating duplicate or fraudulent accounts, or violating legal or regulatory requirements

The level of quality and efficiency of the user accounts provisioning process, and the ability and capacity of the organization to manage and maintain the user accounts provisioning records and documents, such as forms, logs, or reports23

The other options are not the best KPIs for monitoring adherence to an organization’s user accounts provisioning practices, but rather some of the factors or outcomes of it. User accounts with default passwords are user accounts that have not changed their passwords from the initial or default values that are assigned by the system or the application. User accounts with default passwords are a factor that can increase the risk of unauthorized or malicious access to the system or the application, as the default passwords may be easily guessed or compromised by attackers. Active accounts belonging to former personnel are user accounts that have not been deactivated or deleted after the users have left the organization. Active accounts belonging to former personnel are an outcome of ineffective or inefficient user accounts deprovisioning, which is the process of revoking or removing the user accounts and access privileges when they are no longer needed or valid. Accounts with dormant activity are user accounts that have not been used or accessed for a long period of time. Accounts with dormant activity are an outcome of poor or inconsistent user accounts management, which is the process of updating or modifying the user accounts and access privileges according to the changes or needs of the users or the organization4.

Reference: =

User Provisioning for SaaS Apps: Top 10 Best Practices | Resmo Top Identity and Access Management Metrics

KPI-driven approach to Identity & Access Management – Elimity [CRISC Review Manual, 7th Edition]

Question #257

Which of the following activities should be performed FIRST when establishing IT risk management processes?

A . Collect data of past incidents and lessons learned.
B . Conduct a high-level risk assessment based on the nature of business.
C . Identify the risk appetite of the organization.
D . Assess the goals and culture of the organization.

Lösung einblenden Lösung ausblenden

Question #258

An organization is considering the adoption of an aggressive business strategy to achieve desired growth From a risk management perspective what should the risk practitioner do NEXT?

A . Identify new threats resorting from the new business strategy
B . Update risk awareness training to reflect current levels of risk appetite and tolerance
C . Inform the board of potential risk scenarios associated with aggressive business strategies
D . Increase the scale for measuring impact due to threat materialization

Lösung einblenden Lösung ausblenden

Question #259

Which of the following BEST indicates the risk appetite and tolerance level (or the risk associated with business interruption caused by IT system failures?

A . Mean time to recover (MTTR)
B . IT system criticality classification
C . Incident management service level agreement (SLA)
D . Recovery time objective (RTO)

Lösung einblenden Lösung ausblenden

Question #260

Which of the following is the GREATEST risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider?

A . More complex test restores
B . Inadequate service level agreement (SLA) with the provider
C . More complex incident response procedures
D . Inadequate data encryption

Lösung einblenden Lösung ausblenden