2021 100% Free CRISC Daily Practice Exam With 930 Questions
CRISC exam torrent ISACA study guide
ISACA Certified in Risk and Information Systems Control Consultants CRISC Exam
ISACA Certified in Risk and Information Systems Control Consultants CRISC Exam is related to the Certified in Risk and Information Systems Control Certification. This CRISC Exam validates the ability to identify potential threats and vulnerabilities to the organization’s people, processes and technology to enable IT Risk Analysis. It also tests the candidate skills to develop a complete set of IT risk scenarios based on available information to determine the potential impact on business objectives and operations. It also deals with the ability to Analyze risk scenarios based an organizational criterion to determine the likelihood and impact an identified risk and ensure that risk ownership is assigned at the proper level to establish clear lines of accountability. IT Risk Administrators Staff Risk and Control Monitoring Administrators and Reporting Personal usually hold or pursue this certification and you can expect the same job role after completion of this certification.
NEW QUESTION 115
Which of the following is MOST important for maintaining the effectiveness of an IT risk register?
- A. Recording and tracking the status of risk response plans within the register
- B. Removing entries from the register after the risk has been treated
- C. Performing regular reviews and updates to the register
- D. Communicating the register to key stakeholders
Answer: C
NEW QUESTION 116
An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following is the risk practitioner s BEST course of action?
- A. Mitigate the risk with compensating controls enforced by the third-party cloud provider.
- B. Remove the associated risk scenario from the risk register due to avoidance.
- C. Accept the risk and document contingency plans for data disruption.
- D. Validate the transfer of risk and update the register to reflect the change.
Answer: A
NEW QUESTION 117
What should be the PRIMARY driver for periodically reviewing and adjusting key risk indicators (KRIs)?
- A. Risk appropriate
- B. Risk likelihood
- C. Control self-assessments (CSAs)
- D. Risk impact
Answer: B
NEW QUESTION 118
Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?
- A. Internal audit director
- B. Chief information officer
- C. Chief financial officer
- D. Information security director
Answer: B
NEW QUESTION 119
You work as a Project Manager for www.company.com Inc. You have to measure the probability, impact, and risk exposure. Then, you have to measure how the selected risk response can affect the probability and impact of the selected risk event. Which of the following tools will help you to accomplish the task?
- A. Decision tree analysis
- B. Cause-and-effect diagrams
- C. Project network diagrams
- D. Delphi technique
- E. Explanation:
Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and oppourtunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.
Answer: A
Explanation:
is incorrect. Cause-and-effect diagrams are useful for identifying root causes and risk identification, but they are not the most effective ones for risk response planning. Answer: A is incorrect. Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning. Answer: B is incorrect. The Delphi technique can be used in risk identification, but generally is not used in risk response planning. The Delphi technique uses rounds of anonymous surveys to identify risks.
NEW QUESTION 120
A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?
- A. An increase in attempted website phishing attacks
- B. A decrease in remediated web security vulnerabilities
- C. An increase in attempted distributed denial of service (DDoS) attacks
- D. A decrease in achievement of service level agreements (SLAs)
Answer: C
Explanation:
Section: Volume D
Explanation
NEW QUESTION 121
A control for mitigating risk in a key business area cannot be implemented immediately. Which of the following is the risk practitioner's BEST course of action when a compensating control needs to be applied?
- A. Record the risk as accepted in the risk register.
- B. Inform senior management.
- C. Obtain the risk owner's approval.
- D. update the risk response plan.
Answer: C
NEW QUESTION 122
An organization's control environment is MOST effective when
- A. controls operate efficiently.
- B. controls perform as intended.
- C. controls are implemented consistent
- D. control designs are reviewed periodically
Answer: D
NEW QUESTION 123
John is the project manager of the NHQ Project for his company. His project has 75 stakeholders, some of which are external to the organization. John needs to make certain that he communicates about risk in the most appropriate method for the external stakeholders. Which project management plan will be the best guide for John to communicate to the external stakeholders?
- A. Project Management Plan
- B. Risk Response Plan
- C. Risk Management Plan
- D. Communications Management Plan
Answer: D
Explanation:
Section: Volume D
Explanation:
The Communications Management Plan will direct John on the information to be communicated, when to communicate, and how to communicate with external stakeholders.
The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project.
Incorrect Answers:
A: The Risk Response Plan identifies how risks will be responded to.
C: The Project Management Plan is the parent of all subsidiary management plans and it is not the most accurate choice for this question D: The Risk Management Plan defines how risks will be identified, analyzed, responded to, and controlled throughout the project.
NEW QUESTION 124
A maturity model will BEST indicate:
- A. availability and reliability.
- B. effectiveness and efficiency.
- C. certification and accreditation.
- D. confidentiality and integrity.
Answer: B
NEW QUESTION 125
Which of the following is the PRIMARY benefit of using an entry in the risk register to track the aggregate risk associated with server failure?
- A. It provides a cost-benefit analysis on control options available for implementation.
- B. It provides a comprehensive view of the impact should the servers simultaneously fail.
- C. It provides a view on where controls should be applied to maximize the uptime of servers.
- D. It provides historical information about the impact of individual servers malfunctioning.
Answer: B
NEW QUESTION 126
You are the project manager of GHT project. You have identified a risk event on your project that could save
$100,000 in project costs if it occurs. Which of the following statements BEST describes this risk event?
- A. This is a risk event that should be accepted because the rewards outweigh the threat to the project.
- B. This risk event should be avoided to take full advantage of the potential savings.
- C. This risk event is an opportunity to the project and should be exploited.
- D. This risk event should be mitigated to take advantage of the savings.
Answer: C
Explanation:
Section: Volume A
Explanation:
This risk event has the potential to save money on project costs, so it is an opportunity, and the appropriate strategy to use in this case is the exploit strategy. The exploit response is one of the strategies to negate risks or threats appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.
Incorrect Answers:
A, C: Mitigation and avoidance risk response is used in case of negative risk events, and not in positive risk events. Here in this scenario, as it is stated that the event could save $100,000, hence it is a positive risk event. Therefore should not be mitigated or avoided.
B: To accept risk means that no action is taken relative to a particular risk; loss is accepted if it occurs. But as this risk event bring an opportunity, it should me exploited and not accepted.
NEW QUESTION 127
You are the project manager of GRT project. You discovered that by bringing on more qualified resources or by providing even better quality than originally planned, could result in reducing the amount of time required to complete the project. If your organization seizes this opportunity, it would be an example of what risk response?
- A. Accept
- B. Share
- C. Exploit
- D. Enhance
Answer: C
Explanation:
Section: Volume D
Explanation:
Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.
Incorrect Answers:
A: The enhance strategy closely watches the probability or impact of the risk event to assure that the organization realizes the benefits. The primary point of this strategy is to attempt to increase the probability and/or impact of positive C: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs.
D: The share strategy is similar as transfer because in this a portion of the risk is shared with an external organization or another internal entity.
NEW QUESTION 128
Which of the following processes is described in the statement below?
"It is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions."
- A. Risk communication
- B. Risk response planning
- C. Risk governance
- D. Risk identification
Answer: A
Explanation:
Section: Volume A
Explanation:
Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.
Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders. Risk communication can be explained more clearly with the help of the following definitions:
* It defines the issue of what a group does, not just what it says.
* It must take into account the valuable element in user's perceptions of risk.
* It will be more valuable if it is thought of as conversation, not instruction.
Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.
Incorrect Answers:
C: A risk response ensures that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is process of selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost and benefit of the particular risk response option.
Risk response ensures that management is providing accurate reports on:
* The level of risk faced by the enterprise
* The incidents' type that have occurred
* Any alteration in the enterprise's risk profile based on changes in the risk environment
NEW QUESTION 129
Which of the following is MOST important for an organization to have in place when developing a risk management framework?
- A. A control function within the risk management team
- B. An organization-wide risk awareness training program
- C. A strategic approach to risk including an established risk appetite
- D. A risk-based internal audit plan for the organization
Answer: C
NEW QUESTION 130
Which of the following statements is NOT true regarding the risk management plan?
- A. The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.
- B. The risk management plan is an output of the Plan Risk Management process.
- C. The risk management plan includes a description of the risk responses and triggers.
- D. The risk management plan is an input to all the remaining risk-planning processes.
Answer: C
Explanation:
Section: Volume C
Explanation:
The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. The risk management plan does not include responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.
Incorrect Answers:
A, B, D: These all statements are true for risk management plan. The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. It includes thresholds, scoring and interpretation methods, responsible parties, and budgets. It also acts as input to all the remaining risk-planning processes.
NEW QUESTION 131
Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?
- A. Increased number of incidents.
- B. Trends in IT resource usage.
- C. Trends in IT maintenance costs.
- D. Increased resource availability.
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 132
Which of the following should be done FIRST when a new risk scenario has been identified?
- A. Assess the risk awareness program
- B. Estimate the residual risk
- C. Identify the risk owner
- D. Assess the risk training program
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 133
Which of the following is the BEST recommendation to senior management when the results of a risk and control assessment indicate a risk scenario can only be partially mitigated?
- A. Implement a key performance indicator (KPI) to monitor the existing control performance.
- B. Implement controls to bring the risk to a level within appetite and accept the residual risk.
- C. Separate the risk into multiple components and avoid the risk components that cannot be mitigated.
- D. Accept the residual risk in its entirety and obtain executive management approval.
Answer: D
NEW QUESTION 134
Which of the following would MOST effectively enable a business operations manager to identify events exceeding risk thresholds?
- A. Transaction logging
- B. A control self-assessment
- C. Benchmarking against peers
- D. Continuous monitoring
Answer: D
NEW QUESTION 135
Which of the following is the BEST approach for determining whether a risk action plan is effective?
- A. Assessing changes in residual risk
- B. Assessing the inherent risk
- C. Monitoring changes of key performance indicators
- D. Comparing the remediation cost against budget
Answer: A
NEW QUESTION 136
What is the PRIMARY need for effectively assessing controls?
- A. Control's objective achievement
- B. Control's operating effectiveness
- C. Control's alignment with operating environment
- D. Control's design effectiveness
Answer: A
Explanation:
Section: Volume A
Explanation:
Controls can be effectively assessed only by determining how accurately the control objective is achieved within the environment in which they are operating. No conclusion can be reached as to the strength of the control until the control has been adequately tested.
Incorrect Answers:
A: Alignment of control with the operating environment is essential but after the control's accuracy in achieving objective. In other words, achieving objective is the top most priority in assessing controls.
B: Control's design effectiveness is also considered but is latter considered after achieving objectives.
D: Control's operating effectiveness is considered but after its accuracy in objective achievement.
NEW QUESTION 137
......
ISACA CRISC Exam Certification Details:
| Passing Score | 450/800 |
| Exam Code | CRISC |
| Books / Training | Virtual Instructor-Led Training In-Person Training & Conferences Customized, On-Site Corporate Training CRISC Planning Guide |
| Schedule Exam | Exam Registration |
| Sample Questions | ISACA CRISC Sample Questions |
| Exam Name | ISACA Certified in Risk and Information Systems Control (CRISC) |
| Exam Price ISACA Nonmember | $760 (USD) |
| Exam Price ISACA Member | $575 (USD) |
| Number of Questions | 150 |
| Duration | 240 mins |
Use Valid New CRISC Test Notes & CRISC Valid Exam Guide: https://www.testsimulate.com/CRISC-study-materials.html