ISACA CRISC Übungsprüfungen
Zuletzt aktualisiert am 05.05.2025- Prüfungscode: CRISC
- Prüfungsname: Certified in Risk and Information Systems Control
- Zertifizierungsanbieter: ISACA
- Zuletzt aktualisiert am: 05.05.2025
Which of the following should be included in a risk scenario to be used for risk analysis?
- A . Risk appetite
- B . Threat type
- C . Risk tolerance
- D . Residual risk
A risk practitioner is performing a risk assessment of recent external advancements in quantum computing.
Which of the following would pose the GREATEST concern for the risk practitioner?
- A . The organization has incorporated blockchain technology in its operations.
- B . The organization has not reviewed its encryption standards.
- C . The organization has implemented heuristics on its network firewall.
- D . The organization has not adopted Infrastructure as a Service (laaS) for its operations.
A company has located its computer center on a moderate earthquake fault.
Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?
- A . The contingency plan provides for backup media to be taken to the alternative site.
- B . The contingency plan for high priority applications does not involve a shared cold site.
- C . The alternative site is a hot site with equipment ready to resume processing immediately.
- D . The alternative site does not reside on the same fault no matter how far the distance apart.
A global organization is considering the acquisition of a competitor. Senior management has requested a review of the overall risk profile from the targeted organization.
Which of the following components of this review would provide the MOST useful information?
- A . Risk appetite statement
- B . Enterprise risk management framework
- C . Risk management policies
- D . Risk register
A risk practitioner is preparing a business case for purchasing a cyber insurance policy.
Which of the following is the MOST useful and comprehensive information to include in the business case to obtain management buy-in?
- A . Business impact analysis (BIA)
- B . Cost-benefit analysis
- C . Control gap analysis
- D . Scenario analysis
The PRIMARY reason for periodically monitoring key risk indicators (KRIs) is to:
- A . rectify errors in results of KRIs.
- B . detect changes in the risk profile.
- C . reduce costs of risk mitigation controls.
- D . continually improve risk assessments.
Reviewing historical risk events is MOST useful for which of the following processes within the risk management life cycle?
- A . Risk monitoring
- B . Risk mitigation
- C . Risk aggregation
- D . Risk assessment
Which of the following is MOST important for the organization to consider before implementing a new in-house developed artificial intelligence (Al) solution?
- A . Industry trends in Al
- B . Expected algorithm outputs
- C . Data feeds
- D . Alert functionality
Which of the following should be a risk practitioner’s PRIMARY focus when tasked with ensuring organization records are being retained for a sufficient period of time to meet legal obligations?
- A . Data duplication processes
- B . Data archival processes
- C . Data anonymization processes
- D . Data protection processes
The BEST indicator of the risk appetite of an organization is the
- A . regulatory environment of the organization
- B . risk management capability of the organization
- C . board of directors‘ response to identified risk factors
- D . importance assigned to IT in meeting strategic goals