ISACA CRISC Übungsprüfungen
Zuletzt aktualisiert am 30.04.2026- Prüfungscode: CRISC
- Prüfungsname: Certified in Risk and Information Systems Control
- Zertifizierungsanbieter: ISACA
- Zuletzt aktualisiert am: 30.04.2026
Which of the following risk scenarios would be the GREATEST concern as a result of a single sign-on implementation?
- A . User access may be restricted by additional security.
- B . Unauthorized access may be gained to multiple systems.
- C . Security administration may become more complex.
- D . User privilege changes may not be recorded.
Which of the following is the BEST Key control indicator KCO to monitor the effectiveness of patch management?
- A . Percentage of legacy servers out of support
- B . Percentage of severs receiving automata patches
- C . Number of unpremeditated vulnerabilities
- D . Number of intrusion attempts
Of the following, whose input is ESSENTIAL when developing risk scenarios for the implementation of a third-party mobile application that stores customer data?
- A . Information security manager
- B . IT vendor manager
- C . Business process owner
- D . IT compliance manager
Which of the following will help ensure the elective decision-making of an IT risk management committee?
- A . Key stakeholders are enrolled as members
- B . Approved minutes ate forwarded to senior management
- C . Committee meets at least quarterly
- D . Functional overlap across the business is minimized
Which of the following is the MOST important factor affecting risk management in an organization?
- A . The risk manager’s expertise
- B . Regulatory requirements
- C . Board of directors‘ expertise
- D . The organization’s culture
An organization’s internal audit department is considering the implementation of robotics process automation (RPA) to automate certain continuous auditing tasks.
Who would own the risk associated with ineffective design of the software bots?
- A . Lead auditor
- B . Project manager
- C . Chief audit executive (CAE)
- D . Chief information officer (CIO)
It was discovered that a service provider’s administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (laaS) model.
Which of the following would BEST protect against a future recurrence?
- A . Data encryption
- B . Intrusion prevention system (IPS)
- C . Two-factor authentication
- D . Contractual requirements
Which of the following is the MOST important technology control to reduce the likelihood of fraudulent payments committed internally?
- A . Automated access revocation
- B . Daily transaction reconciliation
- C . Rule-based data analytics
- D . Role-based user access model
The PRIMARY goal of a risk management program is to:
- A . facilitate resource availability.
- B . help ensure objectives are met.
- C . safeguard corporate assets.
- D . help prevent operational losses.
Risk mitigation procedures should include:
- A . buying an insurance policy.
- B . acceptance of exposures
- C . deployment of counter measures.
- D . enterprise architecture implementation.