ISACA CRISC Übungsprüfungen
Zuletzt aktualisiert am 30.04.2026- Prüfungscode: CRISC
- Prüfungsname: Certified in Risk and Information Systems Control
- Zertifizierungsanbieter: ISACA
- Zuletzt aktualisiert am: 30.04.2026
Which of the following is the BEST way to determine the value of information assets for risk management purposes?
- A . Assess the loss impact if the information is inadvertently disclosed.
- B . Calculate the overhead required to keep the information secure throughout its life cycle.
- C . Calculate the replacement cost of obtaining the information from alternate sources.
- D . Assess the market value offered by consumers of the information.
Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?
- A . Configuration updates do not follow formal change control.
- B . Operational staff perform control self-assessments.
- C . Controls are selected without a formal cost-benefit
- D . analysis-Management reviews security policies once every two years.
Which of the following is the MOST useful indicator to measure the efficiency of an identity and access management process?
- A . Number of tickets for provisioning new accounts
- B . Average time to provision user accounts
- C . Password reset volume per month
- D . Average account lockout time
Well-developed, data-driven risk measurements should be:
- A . reflective of the lowest organizational level.
- B . a data feed taken directly from operational production systems.
- C . reported to management the same day data is collected.
- D . focused on providing a forward-looking view.
Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findings.
What type of measure has been established?
- A . Service level agreement (SLA)
- B . Critical success factor (CSF)
- C . Key risk indicator (KRI)
- D . Key performance indicator (KPI)
Which of the following is the BEST way to help ensure risk will be managed properly after a business process has been re-engineered?
- A . Reassessing control effectiveness of the process
- B . Conducting a post-implementation review to determine lessons learned
- C . Reporting key performance indicators (KPIs) for core processes
- D . Establishing escalation procedures for anomaly events
A PRIMARY advantage of involving business management in evaluating and managing risk is that management:
- A . better understands the system architecture.
- B . is more objective than risk management.
- C . can balance technical and business risk.
- D . can make better-informed business decisions.
Which of the following is the PRIMARY purpose of periodically reviewing an organization’s risk profile?
- A . Align business objectives with risk appetite.
- B . Enable risk-based decision making.
- C . Design and implement risk response action plans.
- D . Update risk responses in the risk register
An organization is adopting block chain for a new financial system.
Which of the following should be the GREATEST concern for a risk practitioner evaluating the system’s production readiness?
- A . Limited organizational knowledge of the underlying technology
- B . Lack of commercial software support
- C . Varying costs related to implementation and maintenance
- D . Slow adoption of the technology across the financial industry
Which of the following is the MOST important consideration when selecting either a qualitative or quantitative risk analysis?
- A . Expertise in both methodologies
- B . Maturity of the risk management program
- C . Time available for risk analysis
- D . Resources available for data analysis