Free ISACA CRISC Übungsprüfungen - Seite 55 von 65

Question #541

What is senior management’s role in the RACI model when tasked with reviewing monthly status reports provided by risk owners?

A . Accountable
B . Informed
C . Responsible
D . Consulted

Lösung einblenden Lösung ausblenden

Question #542

Which of the following is the BEST way to identify changes to the risk landscape?

A . Internal audit reports
B . Access reviews
C . Threat modeling
D . Root cause analysis

Lösung einblenden Lösung ausblenden

Richtige Antwort: C
C

Explanation:

The risk landscape is the set of internal and external factors and conditions that may affect the organization’s objectives and operations, and create or influence the risks that the organization faces. The risk landscape is dynamic and complex, and it may change over time due to various drivers or events, such as technological innovations, market trends, regulatory changes, customer preferences, competitor actions, environmental issues, etc.

The best way to identify changes to the risk landscape is threat modeling, which is the process of identifying, analyzing, and prioritizing the potential threats or sources of harm that may exploit the vulnerabilities or weaknesses in the organization’s assets, processes, or systems, and cause adverse impacts or consequences for the organization. Threat modeling can help the organization to anticipate and prepare for the changes in the risk landscape, and to design and implement appropriate controls or countermeasures to mitigate or prevent the threats.

Threat modeling can be performed using various techniques, such as brainstorming, scenario analysis, attack trees, STRIDE, DREAD, etc. Threat modeling can also be integrated with the risk management process, and aligned with the organization’s objectives and risk appetite.

The other options are not the best ways to identify changes to the risk landscape, because they do not provide the same level of proactivity, comprehensiveness, and effectiveness of identifying and addressing the potential threats or sources of harm that may affect the organization.

Internal audit reports are the documents that provide the results and findings of the internal audits that are performed to assess and evaluate the adequacy and effectiveness of the organization’s governance, risk management, and control functions. Internal audit reports can provide useful information and recommendations on the current state and performance of the organization, and identify the issues or gaps that need to be addressed or improved, but they are not the best way to identify changes to the risk landscape, because they are usually retrospective and reactive, and they may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Access reviews are the processes of verifying and validating the access rights and privileges that are granted to the users or entities that interact with the organization’s assets, processes, or systems, and ensuring that they are appropriate and authorized. Access reviews can provide useful information and feedback on the security and compliance of the organization’s access management, and identify and revoke any unauthorized or unnecessary access rights or privileges, but they are not the best way to identify changes to the risk landscape, because they are usually periodic and specific, and they may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Root cause analysis is the process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. Root cause analysis can provide useful insights and solutions on the origin and nature of the problem or incident, and prevent or reduce its recurrence or impact, but it is not the best way to identify changes to the risk landscape, because it is usually retrospective and reactive, and it may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 167 CRISC Practice Quiz and Exam Prep

Question #542

Which of the following is the BEST way to identify changes to the risk landscape?

A . Internal audit reports
B . Access reviews
C . Threat modeling
D . Root cause analysis

Lösung einblenden Lösung ausblenden

Richtige Antwort: C
C

Explanation:

The risk landscape is the set of internal and external factors and conditions that may affect the organization’s objectives and operations, and create or influence the risks that the organization faces. The risk landscape is dynamic and complex, and it may change over time due to various drivers or events, such as technological innovations, market trends, regulatory changes, customer preferences, competitor actions, environmental issues, etc.

The best way to identify changes to the risk landscape is threat modeling, which is the process of identifying, analyzing, and prioritizing the potential threats or sources of harm that may exploit the vulnerabilities or weaknesses in the organization’s assets, processes, or systems, and cause adverse impacts or consequences for the organization. Threat modeling can help the organization to anticipate and prepare for the changes in the risk landscape, and to design and implement appropriate controls or countermeasures to mitigate or prevent the threats.

Threat modeling can be performed using various techniques, such as brainstorming, scenario analysis, attack trees, STRIDE, DREAD, etc. Threat modeling can also be integrated with the risk management process, and aligned with the organization’s objectives and risk appetite.

The other options are not the best ways to identify changes to the risk landscape, because they do not provide the same level of proactivity, comprehensiveness, and effectiveness of identifying and addressing the potential threats or sources of harm that may affect the organization.

Internal audit reports are the documents that provide the results and findings of the internal audits that are performed to assess and evaluate the adequacy and effectiveness of the organization’s governance, risk management, and control functions. Internal audit reports can provide useful information and recommendations on the current state and performance of the organization, and identify the issues or gaps that need to be addressed or improved, but they are not the best way to identify changes to the risk landscape, because they are usually retrospective and reactive, and they may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Access reviews are the processes of verifying and validating the access rights and privileges that are granted to the users or entities that interact with the organization’s assets, processes, or systems, and ensuring that they are appropriate and authorized. Access reviews can provide useful information and feedback on the security and compliance of the organization’s access management, and identify and revoke any unauthorized or unnecessary access rights or privileges, but they are not the best way to identify changes to the risk landscape, because they are usually periodic and specific, and they may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Root cause analysis is the process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. Root cause analysis can provide useful insights and solutions on the origin and nature of the problem or incident, and prevent or reduce its recurrence or impact, but it is not the best way to identify changes to the risk landscape, because it is usually retrospective and reactive, and it may not cover all the relevant or emerging threats or sources of harm that may affect the organization.

Reference: = ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63 ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 167 CRISC Practice Quiz and Exam Prep

Question #544

A contract associated with a cloud service provider MUST include:

A . ownership of responsibilities.
B . a business recovery plan.
C . provision for source code escrow.
D . the providers financial statements.

Lösung einblenden Lösung ausblenden

Question #545

Which of the following is the BEST control for a large organization to implement to effectively mitigate risk related to fraudulent transactions?

A . Segregation of duties
B . Monetary approval limits
C . Clear roles and responsibilities
D . Password policies

Lösung einblenden Lösung ausblenden

Question #546

Which of the following is the BEST way to determine whether new controls mitigate security gaps in a business system?

A . Complete an offsite business continuity exercise.
B . Conduct a compliance check against standards.
C . Perform a vulnerability assessment.
D . Measure the change in inherent risk.

Lösung einblenden Lösung ausblenden

Question #547

Which of the following statements BEST illustrates the relationship between key performance indicators (KPIs) and key control indicators (KCIs)?

A . KPIs measure manual controls, while KCIs measure automated controls.
B . KPIs and KCIs both contribute to understanding of control effectiveness.
C . A robust KCI program will replace the need to measure KPIs.
D . KCIs are applied at the operational level while KPIs are at the strategic level.

Lösung einblenden Lösung ausblenden

Richtige Antwort: B
B

Explanation:

Key performance indicators (KPIs) are metrics or measures that provide information on the progress and performance of an organization or a team toward an intended result or objective. KPIs can help to monitor and evaluate the achievement of strategic, operational, or tactical goals, and to support

the decision making and improvement of the organization or the team1.

Key control indicators (KCIs) are metrics or measures that provide information on the status and effectiveness of the controls or safeguards that are implemented to manage the risks or threats that an organization or a team faces. KCIs can help to identify and assess the strengths and weaknesses of the controls or safeguards, and to ensure the compliance and accountability of the organization or the team2.

The statement that best illustrates the relationship between KPIs and KCIs is that KPIs and KCIs both contribute to understanding of control effectiveness, because they can help to:

Measure and compare the actual and expected outcomes and impacts of the controls or safeguards, and to determine the gaps or deviations

Analyze and understand the causes and consequences of the gaps or deviations, and to identify the root problems or issues

Evaluate and report the performance and compliance of the controls or safeguards, and to communicate the results and feedback to the stakeholders

Improve and optimize the design and implementation of the controls or safeguards, and to enhance the efficiency and effectiveness of the risk management process34

The other statements do not illustrate the relationship between KPIs and KCIs accurately, but rather some of the differences or misconceptions between them. KPIs measure manual controls, while KCIs measure automated controls is a difference between KPIs and KCIs, but not a general one. KPIs and KCIs can measure both manual and automated controls, depending on the type and nature of the controls or safeguards. A robust KCI program will replace the need to measure KPIs is a misconception about KPIs and KCIs, as they are not mutually exclusive or substitutable. KPIs and KCIs complement and support each other, as they provide different but related information on the performance and risk management of the organization or the team. KCIs are applied at the operational level while KPIs are at the strategic level is a difference between KPIs and KCIs, but not a universal one. KPIs and KCIs can be applied at different levels of the organization or the team, depending on the scope and purpose of the measurement and evaluation.

Reference: =

Key Performance Indicator (KPI): Definition, Types, and Examples Key Control Indicators – ISACA

Key Control Indicators: What They Are and How to Use Them

Key Performance Indicators vs. Key Control Indicators: What’s the Difference?

[CRISC Review Manual, 7th Edition]

Question #548

The PRIMARY objective for selecting risk response options is to:

A . reduce risk 10 an acceptable level.
B . identify compensating controls.
C . minimize residual risk.
D . reduce risk factors.

Lösung einblenden Lösung ausblenden

Question #549

Which of the following provides the MOST useful information when determining if a specific control should be implemented?

A . Business impact analysis (BIA)
B . Cost-benefit analysis
C . Attribute analysis
D . Root cause analysis

Lösung einblenden Lösung ausblenden

Question #550

Which of the following provides the BEST evidence that robust risk management practices are in place within an organization?

A . A management-approved risk dashboard
B . A current control framework
C . A regularly updated risk register
D . Regularly updated risk management procedures

Lösung einblenden Lösung ausblenden