(Jan-2024) Get professional help from our CRISC Dumps PDF
Give You Free Regular Updates on CRISC Exam Questions
Exam Syllabus
The ISACA CRISC exam is aimed at those professionals who want to build a career in the field of IT and, in particular, in the risk management domain. The test validates that the candidates possess the basic knowledge and skills in the area of risk and information systems control. The topics covered in the exam are highlighted below:
Information Technology Risk Identification: 27%
- Identify the domain of IT risk and contribute to the IT risk management strategy execution to support the business objectives while aligning with the enterprise risk management strategy;
- Recognize risk appetite and tolerance as defined by the key stakeholders and senior leadership to align with the business objectives.
- Partner in developing a risk awareness program and carry out the required training to educate the stakeholders on the risk potential and promote the organizational risk-aware culture;
NEW QUESTION # 577
Which of the following should be included in a risk assessment report to BEST facilitate senior management's understanding of the results?
- A. Benchmarking parameters likely to affect the results
- B. A risk heat map with a summary of risk identified and assessed
- C. Tools and techniques used by risk owners to perform the assessments
- D. The possible impact of internal and external risk factors on the assessment results
Answer: B
NEW QUESTION # 578
The BEST criteria when selecting a risk response is the:
- A. capability to implement the response
- B. alignment of response to industry standards
- C. importance of IT risk within the enterprise
- D. effectiveness of risk response options
Answer: D
NEW QUESTION # 579
Which of the following techniques examines the degree to which organizational strengths offset
threats and opportunities that may serve to overcome weaknesses?
- A. Explanation:
SWOT analysis is a strategic planning method used to evaluate the Strengths, Weaknesses, Opportunities, and Threats involved in a project or in a business venture. It involves specifying the objective of the business venture or project and identifying the internal and external factors that are favorable and unfavorable to achieving that objective. - B. Delphi
- C. Expert Judgment
- D. Brainstorming
- E. SWOT Analysis
Answer: E
Explanation:
and B are incorrect. Brainstorming and Delphi techniques are used to identify risks in a project through consensus. Delphi differs in that as the members of the team do not know each other. Answer: D is incorrect. In this technique, risks can be identified directly by experts with relevant experience of similar projects or business areas.
NEW QUESTION # 580
A teaming agreement is an example of what type of risk response?
- A. Mitigation
- B. Share
- C. Acceptance
- D. Transfer
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Teaming agreements are often comes under sharing risk response, as they involves joint ventures to realize an opportunity that an organization would not be able to seize otherwise.
Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.
Incorrect Answers:
A: Acceptance is a risk response that is appropriate for positive or negative risk events. It does not pursue the risk, but documents the event and allows the risk to happen. Often acceptance is used for low probability and low impact risk events.
B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together.
C: Transference is a negative risk response where the project manager hires a third party to own the risk event.
NEW QUESTION # 581
Which of the following statements BEST describes risk appetite?
- A. Acceptable variation between risk thresholds and business objectives
- B. The effective management of risk and internal control environments
- C. The acceptable variation relative to the achievement of objectives
- D. The amount of risk an organization is willing to accept
Answer: D
Explanation:
Section: Volume D
NEW QUESTION # 582
The MAIN reason for creating and maintaining a risk register is to:
- A. define the risk assessment methodology.
- B. account for identified key risk factors.
- C. assess effectiveness of different projects.
- D. ensure assets have low residual risk.
Answer: B
NEW QUESTION # 583
A change management process has recently been updated with new testing procedures. What is the NEXT course of action?
- A. Communicate to those who test and promote changes.
- B. Conduct a cost-benefit analysis to justify the cost of the control.
- C. Monitor processes to ensure recent updates are being followed.
- D. Assess the maturity of the change management process.
Answer: C
NEW QUESTION # 584
Which of the following should be the PRIMARY focus of a risk owner once a decision is made to mitigate a risk?
- A. Determining processes for monitoring the effectiveness of the controls
- B. Ensuring that control design reduces risk to an acceptable level
- C. Confirming to management the controls reduce the likelihood of the risk
- D. Updating the risk register to include the risk mitigation plan
Answer: B
NEW QUESTION # 585
You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. Choose three.
- A. It helps in taking risk response decisions
- B. It helps in determination of the cost of protecting what is important
- C. It helps in providing a monetary impact view of risk
- D. It helps making smart choices based on potential risk mitigation costs and losses
Answer: B,C,D
NEW QUESTION # 586
Which of the following should be the HIGHEST priority when developing a risk response?
- A. The risk response is based on a cost-benefit analysis.
- B. The risk response aligns with the organization's risk appetite.
- C. The risk response addresses the risk with a holistic view.
- D. The risk response is accounted for in the budget.
Answer: B
NEW QUESTION # 587
Which of the following BEST enables the identification of trends in risk levels?
- A. Qualitative definitions for key risk indicators (KRIs) are used.
- B. Quantitative measurements are used for key risk indicators (KRIs).
- C. Measurements for key risk indicators (KRIs) are repeatable
- D. Correlation between risk levels and key risk indicators (KRIs) is positive.
Answer: B
NEW QUESTION # 588
An IT control gap has been identified in a key process. Who would be the MOST appropriate owner of the risk associated with this gap?
- A. Chief information security officer (CISO)
- B. Operational risk manager
- C. Key control owner
- D. Business process owner
Answer: D
NEW QUESTION # 589
You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole. What approach can you use to achieve this goal of improving the project's performance through risk analysis with your project stakeholders?
- A. Use qualitative risk analysis to quickly assess the probability and impact of risk events
- B. Involve the stakeholders for risk identification only in the phases where the project directly affects them
- C. Involve subject matter experts in the risk analysis activities
- D. Explanation:
By focusing on the high-priority of risk events through qualitative risk analysis you can improve the project's performance. Qualitative analysis is the definition of risk factors in terms of high/medium/low or a numeric scale (1 to 10). Hence it determines the nature of risk on a relative scale. Some of the qualitative methods of risk analysis are: Scenario analysis- This is a forward-looking process that can reflect risk for a given point in time. Risk Control Self -assessment (RCSA) - RCSA is used by enterprises (like banks) for the identification and evaluation of operational risk exposure. It is a logical first step and assumes that business owners and managers are closest to the issues and have the most expertise as to the source of the risk. RCSA is a constructive process in compelling business owners to contemplate, and then explain, the issues at hand with the added benefit of increasing their accountability. - E. Focus on the high-priority risks through qualitative risk analysis
Answer: D,E
Explanation:
is incorrect. Subject matter experts can help the qualitative risk assessment, but by focusing on high-priority risks the project's performance can improve by addressing these risk events. Answer: B is incorrect. Stakeholders should be involved throughout the project as situations within the project demand their input to risk identification and analysis. Answer: C is incorrect. Qualitative analysis does use a fast approach of analyzing project risks, but it's not the best answer for this
NEW QUESTION # 590
You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?
- A. Resource Management Plan
- B. is incorrect. The stakeholder management strategy does not address risk
communications. - C. Stakeholder management strategy
- D. is incorrect. The Risk Management Plan defines risk identification, analysis, response,
and monitoring. - E. Communications Management Plan
- F. Risk Management Plan
- G. Explanation:
The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets
the communication structure for the project. This structure provides guidance forcommunication
throughout the project's life and is updated as communication needs change. The Communication
Managements Plan identifies and defines the roles of persons concerned with the project. It
includes a matrix known as the communication matrix to map the communication requirements of
the project.
Answer: B,D,E,G
Explanation:
is incorrect. The Resource Management Plan does not define risk communications.
NEW QUESTION # 591
Which of the following is the MOST critical element to maximize the potential for a successful security implementation?
- A. The organization's culture
- B. The organization's knowledge
- C. Ease of implementation
- D. industry-leading security tools
Answer: A
NEW QUESTION # 592
Which of the following is MOST important for a risk practitioner to verify when evaluating the effectiveness of an organization's existing controls?
- A. Senior management has approved the control design.
- B. Costs for control maintenance are reasonable.
- C. Inherent risk has been reduced from original levels.
- D. Residual risk remains within acceptable levels.
Answer: D
NEW QUESTION # 593
Jane is the project manager of the NHJ Project for his company. He has identified several positive risk events within his project and he thinks these events can save the project time and money. Positive risk events, such as these within the NHJ Project are referred to as?
- A. Residual risk
- B. Benefits
- C. Contingency risks
- D. Opportunities
Answer: D
Explanation:
Section: Volume B
Explanation:
A positive risk event is also known as an opportunity. Opportunities within the project to save time and money must be evaluated, analyzed, and responded to.
Incorrect Answers:
A: A contingency risk is not a valid risk management term.
B: Benefits are the good outcomes of a project endeavor. Benefits usually have a cost factor associated with them.
C: Residual risk is the risk that remains after applying controls. It is not feasible to eliminate all risks from an organization. Instead, measures can be taken to reduce risk to an acceptable level. The risk that is left is residual risk.
NEW QUESTION # 594
Which of the following is the MOST important reason to revisit a previously accepted risk?
- A. To ensure controls are still operating effectively
- B. To ensure risk levels have not changed
- C. To update risk ownership
- D. To review the risk acceptance with new stakeholders
Answer: B
NEW QUESTION # 595
Following a review of a third-party vendor, it is MOST important for an organization to ensure:
- A. results of the review are validated by internal audit.
- B. identified findings are approved by the vendor.
- C. identified findings are reviewed by the organization.
- D. results of the review are accurately reported to management.
Answer: D
NEW QUESTION # 596
Which of the following is the BEST way of managing risk inherent to wireless network?
- A. Enabling auditing on every host that connects to a wireless network
- B. Enable auditing on every connection to the wireless network
- C. Require private, key-based encryption to connect to the wireless network
- D. Require that every host that connect to this network have a well-tested recovery plan
Answer: C
Explanation:
Section: Volume D
Explanation:
As preventive control and prevention is preferred over detection and recovery, therefore, private and key-based encryption should be adopted for managing risks.
Incorrect Answers:
A, C, D: As explained in above section preventive control and prevention is preferred over detection and recovery, hence these are less preferred way.
NEW QUESTION # 597
You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. Choose three.
- A. It helps in taking risk response decisions
- B. It helps in determination of the cost of protecting what is important
- C. It helps in providing a monetary impact view of risk
- D. It helps making smart choices based on potential risk mitigation costs and losses
Answer: B,C,D
NEW QUESTION # 598
Which of the following BEST reduces the probability of laptop theft?
- A. Cable lock
- B. Acceptable use policy
- C. Data encryption
- D. Asset tag with GPS
Answer: A
NEW QUESTION # 599
You are the project manager of GHT project. You have initiated the project and conducted the feasibility study. What result would you get after conducting feasibility study?
Each correct answer represents a complete solution. (Choose two.)
- A. Project management plan
- B. Risk response plan
- C. Results of criteria analyzed, like costs, benefits, risk, resources required and organizational impact
- D. Recommend alternatives and course of action
Answer: C,D
Explanation:
Explanation/Reference:
Explanation:
The completed feasibility study results should include a cost/benefit analysis report that:
Provides the results of criteria analyzed (e.g., costs, benefits, risk, resources required and
organizational impact)
Recommends one of the alternatives and a course of action
Incorrect Answers:
B, C: Project management plan and risk response plan are the results of plan project management and plan risk response, respectively. They are not the result of feasibility study.
NEW QUESTION # 600
......
Achieve the CRISC Exam Best Results with Help from ISACA Certified Experts: https://www.pass4suresvce.com/CRISC-pass4sure-vce-dumps.html
Provide CRISC Practice Test Engine for Preparation: https://drive.google.com/open?id=1FEBx_bdvhCmH42KMOHaRLqq8pJv4z0kZ