Isaca Certified in Risk and Information Systems Control CRISC Exam Questions

Answer : D

The ultimate objective of utilizing key control indicators (KCIs) in the risk management process is to provide early warning signs of a potential change in risk level, as they indicate the performance and adequacy of the controls, and alert the stakeholders to any control gaps or deficiencies that may affect the risk exposure and impact. The other options are not the ultimate objectives, as they are more related to the insight, basis, or benchmark of the risk managementprocess, respectively, rather than the early warning sign of the risk management process. Reference = CRISC Review Manual, 7th Edition, page 110.

Answer : A

The risk register element that is most likely to be updated if the attack surface or exposure of an asset is reduced is the likelihood rating, as this reflects the probability or frequency of a risk event occurring. The attack surface or exposure of an asset is the measure of the extent and accessibility of the asset to potential threats or attackers. If the attack surface or exposure of an asset is reduced, the likelihood of the asset being compromised or damaged by a risk event is also reduced. Therefore, the likelihood rating of the risk should be updated accordingly. Theother options are not the risk register elements that are most likely to be updated if the attack surface or exposure of an asset is reduced, although they may be affected or influenced by it. Control effectiveness is the measure of how well the risk controls reduce the risk level or achieve the control objectives. Assessment approach is the method or technique used to identify, analyze, and evaluate the risks. Impact rating is the measure of the magnitude or severity of the consequences of a risk event on the asset or the organization.Reference= Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 54.

Answer : B

RPOdefines themaximum tolerable data lossin case of a disruption --- i.e., how much data the enterprise can afford to lose between the last backup and an incident.

ISACA's business continuity and CRISC guidance:

''The recovery point objective (RPO) is based on the amount of acceptable data loss determined by business requirements.''

A, C, Dare logistical concerns; onlyBdefines the RPO itself.

CRISC Reference:Domain 3 -- Risk Response and Mitigation, Topic: Business Continuity Objectives (RTO/RPO).

Answer : D

Participation in the risk assessment may constitute a conflict of interest, because it may create a situation where the risk practitioner's personal or professional interests or relationships interfere with their objectivity, independence, or impartiality in conducting the risk assessment. A conflict of interest is a type of risk that may compromise the integrity, quality, or validity of the risk assessment process and outcomes, and may damage the reputation or trust of the risk practitioner or the organization. A conflict of interest may arise when the risk practitioner has a direct or indirect connection or involvement with the subject or stakeholder of the risk assessment, such as a previous or current role, responsibility, or relationship, that may influence or bias theirjudgment or decision. Participation in the risk assessment may constitute a conflict of interest, as the risk practitioner may have a prior or residual interest or loyalty to the financialprocess team or the new critical application, and may not be able to assess the risk in a fair and unbiased manner.

The risk assessment team being overly confident of its ability to identify issues, the risk practitioner being unfamiliar with recent application and process changes, and the risk practitioner still having access rights to the financial system are all possible concerns with the request, but they are not the greatest concern, as they do not necessarily imply a conflict of interest, and they may be mitigated or resolved by other means, such as training, documentation, or review.

Answer : D

Deviation from a mitigation action plan's completion date should be determined by the risk owner as determined by risk management processes, because the risk owner is the person or entity who has the accountability and authority to manage the risk and its associated mitigation actions. The risk owner should monitor and report the progress and status of the mitigation action plan, and determine if there is any deviation from the expected completion date, based on the risk management processes and criteria. The other options are not the ones who should determine the deviation, because:

Option A: Change management as determined by a change control board is a process that ensures that any changes to the project scope, schedule, cost, or quality are controlled and approved, but it does not determine the deviation from the mitigation action plan's completion date, which is a risk management activity.

Option B: Benchmarking analysis with similar completed projects is a technique that compares the performance and practices of the current project with those of similar or successful projects, but it does not determine the deviation from the mitigation action plan's completion date, which is a risk management activity.

Option C: Project governance criteria as determined by the project office is a set of rules and standards that define the roles, responsibilities, and authority of the project stakeholders, but it does notdetermine the deviation from the mitigation action plan's completion date, which is a risk management activity.Reference= Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 122.

Answer : A

The greatest concern associated with the transmission of healthcare data across the internet is unencrypted data, as this exposes the data to unauthorized access, interception, modification, or disclosure, which may compromise the confidentiality, integrity, and availability of the data. Healthcare data is sensitive and personal information that may include medical records, diagnoses, treatments, prescriptions, insurance claims, and biometric data. Healthcare data is subject to various legal and regulatory requirements, such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States, that mandate the protection and privacy of the data. Encryption is a method of transforming the data into an unreadable format that can only be accessed or restored by authorized parties who have the decryption key. Encryption helps to prevent or reduce the risk of data breaches, identity theft, fraud, or other malicious attacks. The other options are not the greatest concerns associated with the transmission of healthcare dataacross the internet, although they may pose some challenges or issues. Lack of redundant circuits is a concern for the reliability and continuity of the data transmission, but it does notaffect the security or privacy of the data. Low bandwidth connections is a concern for the speed andefficiency of the data transmission, but it does not affect the security or privacy of the data. Data integrity is a concern for the accuracy and completeness of the data, but it does not necessarily depend on the encryption of the data.Reference= Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 156.

Answer : C

The greatest benefit of having a mature enterprise architecture (EA) in place is efficient operations, as EA provides a holistic view of the organization's business processes, information systems, and technology infrastructure, and enables alignment, integration, and optimization of these components. Standards-based policies, audit readiness, and regulatory compliance are also benefits of EA, but they are not the greatest benefit.Reference= CRISC Review Manual, 7th Edition, page 145.