ISACA New 2023 CRISC Sample Questions Reliable CRISC Test Engine [Q666-Q682]

Rate this post

ISACA New 2023 CRISC Sample Questions Reliable CRISC Test Engine

Feel ISACA CRISC Dumps PDF Will likely be The best Option

QUESTION 666
Which of the following controls will BEST detect unauthorized modification of data by a database administrator?

Reviewing database access rights

Reviewing database activity logs

Comparing data to input records

Reviewing changes to edit checks

QUESTION 667
Which of the following is NOT true for risk management capability maturity level 1?

There is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk

Decisions involving risk lack credible information

Risk appetite and tolerance are applied only during episodic risk assessments

Risk management skills exist on an ad hoc basis, but are not actively developed

QUESTION 668
Which of the following is true for risk management frameworks, standards and practices?
Each correct answer represents a part of the solution. Choose three.

They act as a guide to focus efforts of variant teams.

They result in increase in cost of training, operation and performance improvement.

They provide a systematic view of “things to be considered” that could harm clients or an enterprise.

They assist in achieving business objectives quickly and easily.

QUESTION 669
A risk practitioner learns that the organization s industry is experiencing a trend of rising security incidents.
Which of the following is the BEST course of action?

Evaluate the relevance of the evolving threats.

Review past internal audit results.

Respond to organizational security threats.

Research industry published studies.

QUESTION 670
Which of the following IS processes provide indirect information?
Each correct answer represents a complete solution. Choose three.

Post-implementation reviews of program changes

Security log monitoring

Problem management

Recovery testing

Explanation:
Security log monitoring, Post-implementation reviews of program changes, and Problem management provide indirect information. Security log monitoring provide indirect information about certain controls in the security environment, particularly when used to analyze the source of failed access attempts. Post-implementation reviews of program changes provide indirect information about the effectiveness of internal controls over the development process. Problem management provide indirect information about the effectiveness of several different IS processes that may ultimately be determined to be the source of incidents.

QUESTION 671
When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?

Risk management strategy planning

Risk monitoring and control

Risk identification

Risk response planning

QUESTION 672
Which of the following is the MOST important reason to test new controls?

To verify controls work as intended.

To justify the cost of control investment.

To identify exceptions that elevate risk.

To ensure an accurate and up-to-date controls register.

QUESTION 673
Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?

A decrease in the number of key controls

Changes in control design

An increase in residual risk

Changes in control ownership

QUESTION 674
Which of the following is the STRONGEST indication that controls implemented as part of a risk action plan are not effective?

A security breach occurs.

Internal audit identifies recurring exceptions.

Changes are put into production without management approval.

A sample is used to validate the action plan.

QUESTION 675
Which of the following techniques examines the degree to which organizational strengths offset
threats and opportunities that may serve to overcome weaknesses?

SWOT Analysis

Delphi

Brainstorming

Expert Judgment

Explanation:
SWOT analysis is a strategic planning method used to evaluate the Strengths, Weaknesses, Opportunities, and Threats involved in a project or in a business venture. It involves specifying the objective of the business venture or project and identifying the internal and external factors that are favorable and unfavorable to achieving that objective.

QUESTION 676
Upon learning that the number of failed back-up attempts continually exceeds the current risk threshold, the risk practitioner should:

inquire about the status of any planned corrective actions

keep monitoring the situation as there is evidence that this is normal

adjust the risk threshold to better reflect actual performance

initiate corrective action to address the known deficiency

QUESTION 677
During an acquisition, which of the following would provide the MOST useful input to the parent company’s risk practitioner when developing risk scenarios for the post-acquisition phase?

Risk management framework adopted by each company

Risk registers of both companies

IT balanced scorecard of each company

Most recent internal audit findings from both companies

QUESTION 678
Which of the following establishes mandatory rules, specifications and metrics used to measure compliance against quality, value, etc.?

Framework

Legal requirements

Standard

Practices

QUESTION 679
Which of the following should be the HIGHEST priority when developing a risk response?

The risk response addresses the risk with a holistic view.

The risk response is based on a cost-benefit analysis.

The risk response is accounted for in the budget.

The risk response aligns with the organization’s risk appetite.

QUESTION 680
Your project has several risks that may cause serious financial impact if they occur. You have studied the risk events and made some potential risk responses for the risk events but management wants you to do more. They’d like you to create some type of a chart that identified the risk probability and impact with a financial amount for each risk event. What is the likely outcome of creating this type of chart?

Risk response plan

Contingency reserve

Risk response

Quantitative analysis

QUESTION 681
An organization has decided to commit to a business activity with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner’s MOST important action related to this decision?

Recommend risk remediation

Change the level of risk appetite

Document formal acceptance of the risk

Reject the business initiative

QUESTION 682
Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST:

reallocate risk response resources

review the key risk indicators

conduct a risk analysis

update the risk register