CRISC Exam Dumps - Reliable Way to Pass and Get Certified

CRISC Exam Dumps – Reliable Way to Pass and Get Certified

Category:

Comments:

0 Comments

Post Date:

February 21, 2025

If you are looking for a reliable and comprehensive way to prepare for your CRISC certification exam, look no further than CRISC exam questions. These CRISC exam dumps questions are designed to help you assess your knowledge, identify your strengths and weaknesses, and improve your chances of passing the exam on the first try. These CRISC dumps questions cover all the topics and concepts that are essential for the CRISC exam, so you can be sure that you are fully prepared. Test ISACA CRISC free dumps below.

Page 1 of 48

1. When of the following 15 MOST important when developing a business case for a proposed security investment?

identification of control requirements

Alignment to business objectives

Consideration of new business strategies

inclusion of strategy for regulatory compliance

2. Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise's brand on Internet sites?

Utilizing data loss prevention (DLP) technology

Monitoring the enterprise's use of the Internet

Scanning the Internet to search for unauthorized usage

Developing training and awareness campaigns

3. Which of the following BEST reduces the probability of laptop theft?

Cable lock

Acceptable use policy

Data encryption

Asset tag with GPS

4. Which of the following methods is the BEST way to measure the effectiveness of automated information security controls prior to going live?

Testing in a non-production environment

Performing a security control review

Reviewing the security audit report

Conducting a risk assessment

5. A risk practitioner wants to identify potential risk events that affect the continuity of a critical business process.

Which of the following should the risk practitioner do FIRST?

Evaluate current risk management alignment with relevant regulations.

Determine if business continuity procedures are reviewed and updated on a regular basis.

Review the methodology used to conduct the business impact analysis (BIA).

Conduct a benchmarking exercise against industry peers.

6. Senior management has asked a risk practitioner to develop technical risk scenarios related to a recently developed enterprise resource planning (ERP) system. These scenarios will be owned by the system manager.

Which of the following would be the BEST method to use when developing the scenarios?

Cause-and-effect diagram

Delphi technique

Bottom-up approach

Top-down approach

7. Which of the following is MOST helpful in developing key risk indicator (KRl) thresholds?

Loss expectancy information

Control performance predictions

IT service level agreements (SLAs)

Remediation activity progress

8. Which of the following would be the GREATEST risk associated with a new implementation of single sign-on?

Complex security administration

Single point of failure

Inability to access key information

User resistance to single sign-on

9. Which of the following is the BEST way to identify changes to the risk landscape?

Internal audit reports

Access reviews

Threat modeling

Root cause analysis

10. Which of the following is a risk practitioner's BEST recommendation to help reduce IT risk associated with scheduling overruns when starting a new application development project?

Implement a tool to track the development team's deliverables.

Review the software development life cycle.

Involve the development team in planning.

Assign more developers to the project team.

Page 2 of 48

11. The GREATEST benefit of including low-probability, high-impact events in a risk assessment is the ability to:

develop a comprehensive risk mitigation strategy

develop understandable and realistic risk scenarios

identify root causes for relevant events

perform an aggregated cost-benefit analysis

12. Which of the following BEST facilitates the development of relevant risk scenarios?

Perform quantitative risk analysis of historical data.

Adopt an industry-recognized risk framework.

Use qualitative risk assessment methodologies.

Conduct brainstorming sessions with key stakeholders.

13. Reviewing which of the following BEST helps an organization gam insight into its overall risk profile''

Risk register

Risk appetite

Threat landscape

Risk metrics

14. The MOST essential content to include in an IT risk awareness program is how to:

populate risk register entries and build a risk profile for management reporting.

prioritize IT-related actions by considering risk appetite and risk tolerance.

define the IT risk framework for the organization.

comply with the organization's IT risk and information security policies.

15. Which of the following is the GREATEST concern if user acceptance testing (UAT) is not conducted when implementing a new application?

The probability of application defects will increase

Data confidentiality could be compromised

Increase in the use of redundant processes

The application could fail to meet defined business requirements

16. The objective of aligning mitigating controls to risk appetite is to ensure that:

exposures are reduced to the fullest extent

exposures are reduced only for critical business systems

insurance costs are minimized

the cost of controls does not exceed the expected loss.

17. Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization's risk appetite?

Establishing a series of key risk indicators (KRIs).

Adding risk triggers to entries in the risk register.

Implementing key performance indicators (KPIs).

Developing contingency plans for key processes.

18. Which of the following risk activities is BEST facilitated by enterprise architecture (EA)?

Aligning business unit risk responses to organizational priorities

Determining attack likelihood per business unit

Adjusting business unit risk tolerances

Customizing incident response plans for each business unit

19. Which of the following is the MOST important consideration for protecting data assets m a Business application system?

Application controls are aligned with data classification lutes

Application users are periodically trained on proper data handling practices

Encrypted communication is established between applications and data servers

Offsite encrypted backups are automatically created by the application

20. Which of the following outcomes of disaster recovery planning is MOST important to enable the initiation of necessary actions during a disaster?

Definition of disaster recovery plan (DRP) scope and key stakeholders

Recovery time and maximum acceptable data loss thresholds

A checklist including equipment, location of data backups, and backup sites

A list of business areas and critical functions subject to risk analysis

Page 3 of 48

21. Which of the following is the MOST important consideration for a risk practitioner when making a system implementation go-live recommendation?

Completeness of system documentation

Results of end user acceptance testing

Variances between planned and actual cost

availability of in-house resources

22. An upward trend in which of the following metrics should be of MOST concern?

A. Number of business change management requests

B. Number of revisions to security policy

C. Number of security policy exceptions approved

D. Number of changes to firewall rules

23. An internal audit report reveals that not all IT application databases have encryption in place.

Which of the following information would be MOST important for assessing the risk impact?

The number of users who can access sensitive data

A list of unencrypted databases which contain sensitive data

The reason some databases have not been encrypted

The cost required to enforce encryption

24. IT risk assessments can BEST be used by management:

for compliance with laws and regulations

as a basis for cost-benefit analysis.

as input for decision-making

to measure organizational success.

25. The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:

ensure policy and regulatory compliance.

assess the proliferation of new threats.

verify Internet firewall control settings.

identify vulnerabilities in the system.

26. An organization has outsourced its billing function to an external service provider.

Who should own the risk of customer data leakage caused by the service provider?

The service provider

Vendor risk manager

Legal counsel

Business process owner

27. The PRIMARY goal of a risk management program is to:

facilitate resource availability.

help ensure objectives are met.

safeguard corporate assets.

help prevent operational losses.

28. Which of the following BEST helps to balance the costs and benefits of managing IT risk?

Prioritizing risk responses

Evaluating risk based on frequency and probability

Considering risk factors that can be quantified

Managing the risk by using controls

29. When developing a risk awareness training program, which of the following training topics would BEST facilitate a thorough understanding of risk scenarios?

Mapping threats to organizational objectives

Reviewing past audits

Analyzing key risk indicators (KRIs)

Identifying potential sources of risk

30. An organization wants to assess the maturity of its internal control environment. The FIRST step should be to:

validate control process execution.

determine if controls are effective.

identify key process owners.

conduct a baseline assessment.

Page 4 of 48

31. A global organization has implemented an application that does not address all privacy requirements across multiple jurisdictions.

Which of the following risk responses has the organization adopted with regard to privacy requirements?

Risk avoidance

Risk transfer

Risk mitigation

Risk acceptance

32. Continuous monitoring of key risk indicators (KRIs) will:

ensure that risk will not exceed the defined risk appetite of the organization.

provide an early warning so that proactive action can be taken.

provide a snapshot of the risk profile.

ensure that risk tolerance and risk appetite are aligned.

33. During the initial risk identification process for a business application, it is MOST important to include which of the following stakeholders?

Business process owners

Business process consumers

Application architecture team

Internal audit

34. Which of the following is a KEY outcome of risk ownership?

Risk responsibilities are addressed.

Risk-related information is communicated.

Risk-oriented tasks are defined.

Business process risk is analyzed.

35. Which of the following is the PRIMARY purpose of periodically reviewing an organization's risk profile?

Align business objectives with risk appetite.

Enable risk-based decision making.

Design and implement risk response action plans.

Update risk responses in the risk register

36. Which of the following is MOST important to ensure when continuously monitoring the performance of a client-facing application?

Objectives are confirmed with the business owner.

Control owners approve control changes.

End-user acceptance testing has been conducted.

Performance information in the log is encrypted.

37. To reduce costs, an organization is combining the second and third tines of defense in a new department that reports to a recently appointed C-level executive.

Which of the following is the GREATEST concern with this situation?

The risk governance approach of the second and third lines of defense may differ.

The independence of the internal third line of defense may be compromised.

Cost reductions may negatively impact the productivity of other departments.

The new structure is not aligned to the organization's internal control framework.

38. Which of the following is the GREATEST benefit of updating the risk register to include outcomes from a risk assessment?

It maintains evidence of compliance with risk policy.

It facilitates timely risk-based decisions.

It validates the organization's risk appetite.

It helps to mitigate internal and external risk factors.

39. Which of the following is the PRIMARY reason to establish the root cause of an IT security incident?

Prepare a report for senior management.

Assign responsibility and accountability for the incident.

Update the risk register.

Avoid recurrence of the incident.

40. Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?

Enhance the security awareness program.

Increase the frequency of incident reporting.

Purchase cyber insurance from a third party.

Conduct a control assessment.

Page 5 of 48

41. Which of the following is the GREATEST concern when establishing key risk indicators (KRIs)?

High percentage of lagging indicators

Nonexistent benchmark analysis

Incomplete documentation for KRI monitoring

Ineffective methods to assess risk

42. A key risk indicator (KRI) is reported to senior management on a periodic basis as exceeding thresholds, but each time senior management has decided to take no action to reduce the risk.

Which of the following is the MOST likely reason for senior management's response?

The underlying data source for the KRI is using inaccurate data and needs to be corrected.

The KRI is not providing useful information and should be removed from the KRI inventory.

The KRI threshold needs to be revised to better align with the organization s risk appetite

Senior management does not understand the KRI and should undergo risk training.

43. A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls.

The BEST course of action would be to:

obtain management approval for policy exception.

develop an improved password software routine.

select another application with strong password controls.

continue the implementation with no changes.

44. An unauthorized individual has socially engineered entry into an organization's secured physical premises.

Which of the following is the BEST way to prevent future occurrences?

Employ security guards.

Conduct security awareness training.

Install security cameras.

Require security access badges.

45. An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program.

The PRIMARY goal of this program should be to:

reduce the risk to an acceptable level.

communicate the consequences for violations.

implement industry best practices.

reduce the organization's risk appetite

46. Risk appetite should be PRIMARILY driven by which of the following?

Enterprise security architecture roadmap

Stakeholder requirements

Legal and regulatory requirements

Business impact analysis (BIA)

47. A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security.

Which of the following observations would be MOST relevant to escalate to senior management?

An increase in attempted distributed denial of service (DDoS) attacks

An increase in attempted website phishing attacks

A decrease in achievement of service level agreements (SLAs)

A decrease in remediated web security vulnerabilities

48. During the creation of an organization's IT risk management program, the BEST time to identify key risk indicators (KRIs) is while:

interviewing data owners.

reviewing risk response plans with internal audit.

developing a risk monitoring process.

reviewing an external risk assessment.

49. What should a risk practitioner do FIRST when vulnerability assessment results identify a weakness in an application?

Review regular control testing results.

Recommend a penetration test.

Assess the risk to determine mitigation needed.

Analyze key performance indicators (KPIs).

50. What is the MAIN benefit of using a top-down approach to develop risk scenarios?

It describes risk events specific to technology used by the enterprise.

It establishes the relationship between risk events and organizational objectives.

It uses hypothetical and generic risk events specific to the enterprise.

It helps management and the risk practitioner to refine risk scenarios.

Page 6 of 48

51. The implementation of a risk treatment plan will exceed the resources originally allocated for the risk response.

Which of the following should be the risk owner's NEXT action?

Perform a risk assessment.

Accept the risk of not implementing.

Escalate to senior management.

Update the implementation plan.

52. Which of the following is MOST important to review when an organization needs to transition the majority of its employees to remote work during a crisis?

Customer notification plans

Capacity management

Access management

Impacts on IT project delivery

53. Which of the following is a risk practitioner's BEST recommendation to address an organization's need to secure multiple systems with limited IT resources?

Apply available security patches.

Schedule a penetration test.

Conduct a business impact analysis (BIA)

Perform a vulnerability analysis.

54. it was determined that replication of a critical database used by two business units failed.

Which of the following should be of GREATEST concern1?

The underutilization of the replicated Iink

The cost of recovering the data

The lack of integrity of data

The loss of data confidentiality

55. After undertaking a risk assessment of a production system, the MOST appropriate action is for the risk manager to:

recommend a program that minimizes the concerns of that production system.

inform the development team of the concerns, and together formulate risk reduction measures.

inform the process owner of the concerns and propose measures to reduce them

inform the IT manager of the concerns and propose measures to reduce them.

56. Which of the following is the BEST way to identify changes in the risk profile of an organization?

Monitor key risk indicators (KRIs).

Monitor key performance indicators (KPIs).

Interview the risk owner.

Conduct a gap analysis

57. When defining thresholds for control key performance indicators (KPIs). it is MOST helpful to align:

information risk assessments with enterprise risk assessments.

key risk indicators (KRIs) with risk appetite of the business.

the control key performance indicators (KPIs) with audit findings.

control performance with risk tolerance of business owners.

58. It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:

perform a business impact analysis.

identify potential sources of risk.

establish risk guidelines.

understand control design.

59. A large organization needs to report risk at all levels for a new centralized visualization project to reduce cost and improve performance.

Which of the following would MOST effectively represent the overall risk of the project to senior management?

Aggregated key performance indicators (KPls)

Key risk indicators (KRIs)

Centralized risk register

Risk heat map

60. During an internal IT audit, an active network account belonging to a former employee was identified.

Which of the following is the BEST way to prevent future occurrences?

Conduct a comprehensive review of access management processes.

Declare a security incident and engage the incident response team.

Conduct a comprehensive awareness session for system administrators.

Evaluate system administrators' technical skills to identify if training is required.

Page 7 of 48

61. The GREATEST concern when maintaining a risk register is that:

impacts are recorded in qualitative terms.

executive management does not perform periodic reviews.

IT risk is not linked with IT assets.

significant changes in risk factors are excluded.

62. Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Using an aggregated view of organizational risk

Ensuring relevance to organizational goals

Relying on key risk indicator (KRI) data Including

Trend analysis of risk metrics

63. When performing a risk assessment of a new service to support a core business process, which of the following should be done FIRST to ensure continuity of operations?

Define metrics for restoring availability.

Identify conditions that may cause disruptions.

Review incident response procedures.

Evaluate the probability of risk events.

64. Of the following, whose input is ESSENTIAL when developing risk scenarios for the implementation of a third-party mobile application that stores customer data?

Information security manager

IT vendor manager

Business process owner

IT compliance manager

65. Which of the following is the MOST important information to cover a business continuity awareness Ira nine, program for all employees of the organization?

Recovery time objectives (RTOs)

Segregation of duties

Communication plan

Critical asset inventory

66. Which of the following should be a risk practitioner's NEXT step upon learning the impact of an organization's noncompliance with a specific legal regulation?

Identify risk response options.

Implement compensating controls.

Invoke the incident response plan.

Document the penalties for noncompliance.

67. Which of the following is the BEST course of action when an organization wants to reduce likelihood in order to reduce a risk level?

Monitor risk controls.

Implement preventive measures.

Implement detective controls.

Transfer the risk.

68. An organization learns of a new ransomware attack affecting organizations worldwide.

Which of the following should be done FIRST to reduce the likelihood of infection from the attack?

Identify systems that are vulnerable to being exploited by the attack.

Confirm with the antivirus solution vendor whether the next update will detect the attack.

Verify the data backup process and confirm which backups are the most recent ones available.

Obtain approval for funding to purchase a cyber insurance plan.

69. Which of the following would BEST facilitate the implementation of data classification requirements?

Assigning a data owner

Implementing technical control over the assets

Implementing a data loss prevention (DLP) solution

Scheduling periodic audits

70. A recent vulnerability assessment of a web-facing application revealed several weaknesses.

Which of the following should be done NEXT to determine the risk exposure?

Code review

Penetration test

Gap assessment

Business impact analysis (BIA)

Page 8 of 48

71. Determining if organizational risk is tolerable requires:

mapping residual risk with cost of controls

comparing against regulatory requirements

comparing industry risk appetite with the organizations.

understanding the organization's risk appetite.

72. Which of the following would be of GREATEST assistance when justifying investment in risk response strategies?

Total cost of ownership

Resource dependency analysis

Cost-benefit analysis

Business impact analysis

73. The MOST important characteristic of an organization s policies is to reflect the organization's:

risk assessment methodology.

risk appetite.

capabilities

asset value.

74. Which of the following activities is PRIMARILY the responsibility of senior management?

Bottom-up identification of emerging risks

Categorization of risk scenarios against a standard taxonomy

Prioritization of risk scenarios based on severity

Review of external loss data

75. Which of the following is MOST important requirement to include in a Software as a Service (SaaS) vendor contract to ensure data is protected?

The vendor must provide periodic independent assurance reports.

The vendor must host data in a specific geographic location.

The vendor must be held liable for regulatory fines for failure to protect data.

The vendor must participate in an annual vendor performance review.

76. The BEST reason to classify IT assets during a risk assessment is to determine the:

priority in the risk register.

business process owner.

enterprise risk profile.

appropriate level of protection.

77. Which of the following is MOST important to identify when developing generic risk scenarios?

The organization’s vision and mission

Resources required for risk mitigation

Impact to business objectives

Risk-related trends within the industry

78. Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented.

Which risk treatment has been selected?

Avoidance

Transfer

Mitigation

Acceptance

79. Which of the following is the BEST way to protect sensitive data from administrators within a public

cloud?

Use an encrypted tunnel lo connect to the cloud.

Encrypt the data in the cloud database.

Encrypt physical hard drives within the cloud.

Encrypt data before it leaves the organization.

80. Which of the following is the BEST method for identifying vulnerabilities?

Batch job failure monitoring

Periodic network scanning

Annual penetration testing

Risk assessments

Page 9 of 48

81. Which of the following is the PRIMARY role of the board of directors in corporate risk governance?

Approving operational strategies and objectives

Monitoring the results of actions taken to mitigate risk

Ensuring the effectiveness of the risk management program

Ensuring risk scenarios are identified and recorded in the risk register

82. Periodically reviewing and updating a risk register with details on identified risk factors PRIMARILY helps to:

minimize the number of risk scenarios for risk assessment.

aggregate risk scenarios identified across different business units.

build a threat profile of the organization for management review.

provide a current reference to stakeholders for risk-based decisions.

83. Which of the following should be the PRIMARY focus of an IT risk awareness program?

Ensure compliance with the organization's internal policies

Cultivate long-term behavioral change.

Communicate IT risk policy to the participants.

Demonstrate regulatory compliance.

84. An organization is implementing encryption for data at rest to reduce the risk associated with unauthorized access.

Which of the following MUST be considered to assess the residual risk?

Data retention requirements

Data destruction requirements

Cloud storage architecture

Key management

85. Which of the following activities is a responsibility of the second line of defense?

Challenging risk decision making

Developing controls to manage risk scenarios

Implementing risk response plans

Establishing organizational risk appetite

86. Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board''

A summary of risk response plans with validation results

A report with control environment assessment results

A dashboard summarizing key risk indicators (KRIs)

A summary of IT risk scenarios with business cases

87. An organization has adopted an emerging technology without following proper processes.

Which of the following is the risk practitioner's BEST course of action to address this risk?

Accept the risk because the technology has already been adopted.

Propose a transfer of risk to a third party with subsequent monitoring.

Conduct a risk assessment to determine risk exposure.

Recommend to senior management to decommission the technology.

88. An organization has used generic risk scenarios to populate its risk register.

Which of the following presents the GREATEST challenge to assigning of the associated risk entries?

The volume of risk scenarios is too large

Risk aggregation has not been completed

Risk scenarios are not applicable

The risk analysts for each scenario is incomplete

89. Which of the following is the PRIMARY objective for automating controls?

Improving control process efficiency

Facilitating continuous control monitoring

Complying with functional requirements

Reducing the need for audit reviews

90. An organization has received notification that it is a potential victim of a cybercrime that may have compromised sensitive customer data.

What should be The FIRST course of action?

Invoke the incident response plan.

Determine the business impact.

Conduct a forensic investigation.

Invoke the business continuity plan (BCP).

Page 10 of 48

91. Which of the following is the MOST important benefit of implementing a data classification program?

Reduction in data complexity

Reduction in processing times

Identification of appropriate ownership

Identification of appropriate controls

92. An organization has introduced risk ownership to establish clear accountability for each process.

To ensure effective risk ownership, it is MOST important that:

senior management has oversight of the process.

process ownership aligns with IT system ownership.

segregation of duties exists between risk and process owners.

risk owners have decision-making authority.

93. What is MOST important for the risk practitioner to understand when creating an initial IT risk register?

Enterprise architecture (EA)

Control environment

IT objectives

Organizational objectives

94. Which of the following would MOST likely result in updates to an IT risk appetite statement?

External audit findings

Feedback from focus groups

Self-assessment reports

Changes in senior management

95. Which of the following activities should only be performed by the third line of defense?

Operating controls for risk mitigation

Testing the effectiveness and efficiency of internal controls

Providing assurance on risk management processes

Recommending risk treatment options

96. Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?

The risk register has been updated.

The risk tolerance has been recalibrated.

The risk has been mitigated to the intended level.

The risk owner has reviewed the outcomes.

97. During a recent security framework review, it was discovered that the marketing department implemented a non-fungible token asset program. This was done without following established risk procedures.

Which of the following should the risk practitioner do FIRST?

Report the infraction.

Perform a risk assessment.

Conduct risk awareness training.

Discontinue the process.

98. An organization must make a choice among multiple options to respond to a risk. The stakeholders cannot agree and decide to postpone the decision.

Which of the following risk responses has the organization adopted?

Transfer

Mitigation

Avoidance

Acceptance

99. A control owner identifies that the organization's shared drive contains personally identifiable information (Pll) that can be accessed by all personnel.

Which of the following is the MOST effective risk response?

Protect sensitive information with access controls.

Implement a data loss prevention (DLP) solution.

Re-communicate the data protection policy.

Implement a data encryption solution.

100. Which of the following would BEST facilitate the implementation of data classification requirements?

Implementing a data toss prevention (DLP) solution

Assigning a data owner

Scheduling periodic audits

Implementing technical controls over the assets

Page 11 of 48

101. A risk practitioner is performing a risk assessment of recent external advancements in quantum computing.

Which of the following would pose the GREATEST concern for the risk practitioner?

The organization has incorporated blockchain technology in its operations.

The organization has not reviewed its encryption standards.

The organization has implemented heuristics on its network firewall.

The organization has not adopted Infrastructure as a Service (laaS) for its operations.

102. Which of the following approaches to bring your own device (BYOD) service delivery provides the BEST protection from data loss?

Enable data wipe capabilities

Penetration testing and session timeouts

Implement remote monitoring

Enforce strong passwords and data encryption

103. A risk practitioner's BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:

A. based on industry trends.

B. mapped to incident response plans.

C. related to probable events.

D. aligned with risk management capabilities.

104. Which of the following is the BEST way to prevent the loss of highly sensitive data when disposing of storage media?

Physical destruction

Degaussing

Data anonymization

Data deletion

105. An organization is participating in an industry benchmarking study that involves providing customer transaction records for analysis.

Which of the following is the MOST important control to ensure the privacy of customer information?

Nondisclosure agreements (NDAs)

Data anonymization

Data cleansing

Data encryption

106. Which of the following is the PRIMARY objective of maintaining an information asset inventory?

To provide input to business impact analyses (BIAs)

To protect information assets

To facilitate risk assessments

To manage information asset licensing

107. Which of the following would be MOST helpful to a risk practitioner when ensuring that mitigated risk remains within acceptable limits?

Building an organizational risk profile after updating the risk register

Ensuring risk owners participate in a periodic control testing process

Designing a process for risk owners to periodically review identified risk

Implementing a process for ongoing monitoring of control effectiveness

108. A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls.

Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?

Identify previous data breaches using the startup company’s audit reports.

Have the data privacy officer review the startup company’s data protection policies.

Classify and protect the data according to the parent company's internal standards.

Implement a firewall and isolate the environment from the parent company's network.

109. Which of the following is the BEST way to detect zero-day malware on an end user's workstation?

An antivirus program

Database activity monitoring

Firewall log monitoring

File integrity monitoring

110. Which of the following would MOST likely require a risk practitioner to update the risk register?

An alert being reported by the security operations center.

Development of a project schedule for implementing a risk response

Completion of a project for implementing a new control

Engagement of a third party to conduct a vulnerability scan

Page 12 of 48

111. The MOST important consideration when selecting a control to mitigate an identified risk is whether:

the cost of control exceeds the mitigation value

there are sufficient internal resources to implement the control

the mitigation measures create compounding effects

the control eliminates the risk

112. An organization has been experiencing an increasing number of spear phishing attacks.

Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?

Update firewall configuration

Require strong password complexity

implement a security awareness program

Implement two-factor authentication

113. A department allows multiple users to perform maintenance on a system using a single set of credentials. A risk practitioner determined this practice to be high-risk.

Which of the following is the MOST effective way to mitigate this risk?

Single sign-on

Audit trail review

Multi-factor authentication

Data encryption at rest

114. An information security audit identified a risk resulting from the failure of an automated control.

Who is responsible for ensuring the risk register is updated accordingly?

The risk practitioner

The risk owner

The control owner

The audit manager

115. Which of the following is the FIRST step in managing the risk associated with the leakage of confidential data?

Maintain and review the classified data inventor.

Implement mandatory encryption on data

Conduct an awareness program for data owners and users.

Define and implement a data classification policy

116. Which of the following is the BEST method to identify unnecessary controls?

Evaluating the impact of removing existing controls

Evaluating existing controls against audit requirements

Reviewing system functionalities associated with business processes

Monitoring existing key risk indicators (KRIs)

117. It is MOST appropriate for changes to be promoted to production after they are:

communicated to business management

tested by business owners.

approved by the business owner.

initiated by business users.

118. Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?

Risk policy review

Business impact analysis (B1A)

Control catalog

Risk register

119. Which of the following conditions presents the GREATEST risk to an application?

Application controls are manual.

Application development is outsourced.

Source code is escrowed.

Developers have access to production environment.

120. A risk practitioner is preparing a business case for purchasing a cyber insurance policy.

Which of the following is the MOST useful and comprehensive information to include in the business case to obtain management buy-in?

Business impact analysis (BIA)

Cost-benefit analysis

Control gap analysis

Scenario analysis

Page 13 of 48

121. Which of the following is PRIMARILY a risk management responsibly of the first line of defense?

Implementing risk treatment plans

Validating the status of risk mitigation efforts

Establishing risk policies and standards

Conducting independent reviews of risk assessment results

122. Several newly identified risk scenarios are being integrated into an organization's risk register.

The MOST appropriate risk owner would be the individual who:

is in charge of information security.

is responsible for enterprise risk management (ERM)

can implement remediation action plans.

is accountable for loss if the risk materializes.

123. Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable information (Pll)?

Costs and benefits

Local laws and regulations

Security features and support

Business strategies and needs

124. For a large software development project, risk assessments are MOST effective when performed:

before system development begins.

at system development.

at each stage of the system development life cycle (SDLC).

during the development of the business case.

125. Which of the following has the GREATEST influence on an organization's risk appetite?

Threats and vulnerabilities

Internal and external risk factors

Business objectives and strategies

Management culture and behavior

126. Which of the following is the MOST important reason to validate that risk responses have been executed as outlined in the risk response plan''

To ensure completion of the risk assessment cycle

To ensure controls arc operating effectively

To ensure residual risk Is at an acceptable level

To ensure control costs do not exceed benefits

127. Which of the following will provide the BEST measure of compliance with IT policies?

Evaluate past policy review reports.

Conduct regular independent reviews.

Perform penetration testing.

Test staff on their compliance responsibilities.

128. When updating the risk register after a risk assessment, which of the following is MOST important to include?

Historical losses due to past risk events

Cost to reduce the impact and likelihood

Likelihood and impact of the risk scenario

Actor and threat type of the risk scenario

129. Which of the following is the BEST way to validate the results of a vulnerability assessment?

Perform a penetration test.

Review security logs.

Conduct a threat analysis.

Perform a root cause analysis.

130. A risk practitioner has reviewed new international regulations and realizes the new regulations will affect the organization.

Which of the following should be the risk practitioner's NEXT course of action?

Conduct a peer response assessment.

Update risk scenarios in the risk register.

Reevaluate the risk management program.

Ensure applications are compliant.

Page 14 of 48

131. An organization has recently updated its disaster recovery plan (DRP).

Which of the following would be the GREATEST risk if the new plan is not tested?

External resources may need to be involved.

Data privacy regulations may be violated.

Recovery costs may increase significantly.

Service interruptions may be longer than anticipated.

132. Reviewing which of the following would provide the MOST useful information when preparing to evaluate the effectiveness of existing controls?

A. Previous audit reports

B. Control objectives

C. Risk responses in the risk register

D. Changes in risk profiles

133. Which of the following would BEST help to ensure that suspicious network activity is identified?

Analyzing intrusion detection system (IDS) logs

Analyzing server logs

Using a third-party monitoring provider

Coordinating events with appropriate agencies

134. While evaluating control costs, management discovers that the annual cost exceeds the annual loss expectancy (ALE) of the risk. This indicates the:

control is ineffective and should be strengthened

risk is inefficiently controlled.

risk is efficiently controlled.

control is weak and should be removed.

135. Which of the following presents the GREATEST risk to change control in business application development over the complete life cycle?

Emphasis on multiple application testing cycles

Lack of an integrated development environment (IDE) tool

Introduction of requirements that have not been approved

Bypassing quality requirements before go-live

136. Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?

Conduct a simulated phishing attack.

Update spam filters

Revise the acceptable use policy

Strengthen disciplinary procedures

137. Which of the following changes would be reflected in an organization's risk profile after the failure of a critical patch implementation?

Risk appetite is decreased.

Inherent risk is increased.

Risk tolerance is decreased.

Residual risk is increased.

138. An organization has built up its cash reserves and has now become financially able to support additional risk while meeting its objectives.

What is this change MOST likely to impact?

Risk profile

Risk capacity

Risk indicators

Risk tolerance

139. Which of the following BEST enforces access control for an organization that uses multiple cloud technologies?

Senior management support of cloud adoption strategies

Creation of a cloud access risk management policy

Adoption of a cloud access security broker (CASB) solution

Expansion of security information and event management (SIEM) to cloud services

140. Which of the following provides the MOST useful information when developing a risk profile for management approval?

Residual risk and risk appetite

Strength of detective and preventative controls

Effectiveness and efficiency of controls

Inherent risk and risk tolerance

Page 15 of 48

141. A risk practitioner is reviewing a vendor contract and finds there is no clause to control privileged access to the organization's systems by vendor employees.

Which of the following is the risk practitioner's BEST course of action?

Contact the control owner to determine if a gap in controls exists.

Add this concern to the risk register and highlight it for management review.

Report this concern to the contracts department for further action.

Document this concern as a threat and conduct an impact analysis.

142. The MOST important reason for implementing change control procedures is to ensure:

only approved changes are implemented

timely evaluation of change events

an audit trail exists.

that emergency changes are logged.

143. Which of the following is MOST important to determine as a result of a risk assessment?

Process ownership

Risk appetite statement

Risk tolerance levels

Risk response options

144. The MAIN purpose of having a documented risk profile is to:

comply with external and internal requirements.

enable well-informed decision making.

prioritize investment projects.

keep the risk register up-to-date.

145. For no apparent reason, the time required to complete daily processing for a legacy application is approaching a risk threshold.

Which of the following activities should be performed FIRST?

Temporarily increase the risk threshold.

Suspend processing to investigate the problem.

Initiate a feasibility study for a new application.

Conduct a root-cause analysis.

146. Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

A. Monitoring user activity using security logs

B. Revoking access for users changing roles

C. Granting access based on least privilege

D. Conducting periodic reviews of authorizations granted

147. Which of The following BEST represents the desired risk posture for an organization?

Inherent risk is lower than risk tolerance.

Operational risk is higher than risk tolerance.

Accepted risk is higher than risk tolerance.

Residual risk is lower than risk tolerance.

148. A management team is on an aggressive mission to launch a new product to penetrate new markets and overlooks IT risk factors, threats, and vulnerabilities.

This scenario BEST demonstrates an organization's risk:

management.

tolerance.

culture.

analysis.

149. Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?

A. Chief financial officer

B. Information security director

C. Internal audit director

D. Chief information officer

150. Winch of the following key control indicators (KCIs) BEST indicates whether security requirements are identified and managed throughout a project He cycle?

Number of projects going live without a security review

Number of employees completing project-specific security training

Number of security projects started in core departments

Number of security-related status reports submitted by project managers

Page 16 of 48

151. The PRIMARY objective of a risk identification process is to:

evaluate how risk conditions are managed.

determine threats and vulnerabilities.

estimate anticipated financial impact of risk conditions.

establish risk response options.

152. Which of the following provides the BEST assurance of the effectiveness of vendor security controls?

Review vendor control self-assessments (CSA).

Review vendor service level agreement (SLA) metrics.

Require independent control assessments.

Obtain vendor references from existing customers.

153. An effective control environment is BEST indicated by controls that:

minimize senior management's risk tolerance.

manage risk within the organization's risk appetite.

reduce the thresholds of key risk indicators (KRIs).

are cost-effective to implement

154. Within the three lines of defense model, the accountability for the system of internal control resides with:

the chief information officer (CIO).

the board of directors

enterprise risk management

the risk practitioner

155. Which of the following activities should be performed FIRST when establishing IT risk management processes?

Collect data of past incidents and lessons learned.

Conduct a high-level risk assessment based on the nature of business.

Identify the risk appetite of the organization.

Assess the goals and culture of the organization.

156. Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise's brand on Internet sites?

Utilizing data loss prevention (DLP) technology

Monitoring the enterprise's use of the Internet

Scanning the Internet to search for unauthorized usage

Developing training and awareness campaigns

157. Which of the following would be the GREATEST concern for an IT risk practitioner when an employees.....

The organization's structure has not been updated

Unnecessary access permissions have not been removed.

Company equipment has not been retained by IT

Job knowledge was not transferred to employees m the former department

158. Which of the following criteria is MOST important when developing a response to an attack that would compromise data?

The recovery time objective (RTO)

The likelihood of a recurring attack

The organization's risk tolerance

The business significance of the information

159. Which of the following BEST reduces the likelihood of fraudulent activity that occurs through use of a digital wallet?

Require multi-factor authentication (MFA) to access the digital wallet.

Use a digital key to encrypt the contents of the wallet.

Enable audit logging on the digital wallet's device.

Require public key infrastructure (PKI) to authorize transactions.

160. Which of the following situations presents the GREATEST challenge to creating a comprehensive IT risk profile of an organization?

Manual vulnerability scanning processes

Organizational reliance on third-party service providers

Inaccurate documentation of enterprise architecture (EA)

Risk-averse organizational risk appetite

Page 17 of 48

161. The MAIN purpose of selecting a risk response is to.

ensure compliance with local regulatory requirements

demonstrate the effectiveness of risk management practices.

ensure organizational awareness of the risk level

mitigate the residual risk to be within tolerance

162. Which of the following is the BEST response when a potential IT control deficiency has been identified?

Remediate and report the deficiency to the enterprise risk committee.

Verify the deficiency and then notify the business process owner.

Verify the deficiency and then notify internal audit.

Remediate and report the deficiency to senior executive management.

163. Which of the following BEST helps to identify significant events that could impact an organization? Vulnerability analysis

Control analysis

Scenario analysis

Heat map analysis

164. An IT organization is replacing the customer relationship management (CRM) system.

Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?

Chief information security officer

Business process owner

Chief risk officer

IT controls manager

165. Which of the following should be a risk practitioner's NEXT step after learning of an incident that has affected a competitor?

Activate the incident response plan.

Implement compensating controls.

Update the risk register.

Develop risk scenarios.

166. An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack.

Which of the following is the MOST effective control to support this policy?

Conducting periodic vulnerability scanning

Creating immutable backups

Performing required patching

Implementing continuous intrusion detection monitoring

167. Which of the following is the PRIMARY purpose of a risk register?

To assign control ownership of risk

To provide a centralized view of risk

To identify opportunities to transfer risk

To mitigate organizational risk

168. Who is BEST suited to provide information to the risk practitioner about the effectiveness of a technical control associated with an application?

System owner

Internal auditor

Process owner

Risk owner

169. Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

To validate the quality of defined deliverables for the program

To detect increases in program costs

To ensure program risk events are mitigated in a timely manner

To provide timely reporting to the governance steering committee

170. A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss exposure.

The result is that the control is:

mature

ineffective.

optimized.

inefficient.

Page 18 of 48

171. An organization maintains independent departmental risk registers that are not automatically aggregated.

Which of the following is the GREATEST concern?

Management may be unable to accurately evaluate the risk profile.

Resources may be inefficiently allocated.

The same risk factor may be identified in multiple areas.

Multiple risk treatment efforts may be initiated to treat a given risk.

172. After identifying new risk events during a project, the project manager s NEXT step should be to:

determine if the scenarios need 10 be accepted or responded to.

record the scenarios into the risk register.

continue with a qualitative risk analysis.

continue with a quantitative risk analysis.

173. Which of the following is the MOST effective control to ensure user access is maintained on a least-privilege basis?

User authorization

User recertification

Change log review

Access log monitoring

174. Which of the following BEST mitigates the risk of violating privacy laws when transferring personal information lo a supplier?

Encrypt the data while in transit lo the supplier

Contractually obligate the supplier to follow privacy laws.

Require independent audits of the supplier's control environment

Utilize blockchain during the data transfer

175. Which of the following is the GREATEST impact of implementing a risk mitigation strategy?

Improved alignment with business goals.

Reduction of residual risk.

Increased costs due to control implementation.

Decreased overall risk appetite.

176. Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?

Compliance manager

Data architect

Data owner

Chief information officer (CIO)

177. A risk manager has determined there is excessive risk with a particular technology.

Who is the BEST person to own the unmitigated risk of the technology?

IT system owner

Chief financial officer

Chief risk officer

Business process owner

178. Which of the following is BEST measured by key control indicators (KCIs)?

Historical trends of the organizational risk profile.

Cost efficiency of risk treatment plan projects.

Comprehensiveness of risk assessment procedures.

Effectiveness of organizational defense in depth.

179. Of the following, who is accountable for ensuing the effectiveness of a control to mitigate risk?

Control owner

Risk manager

Control operator

Risk treatment owner

180. What should be the PRIMARY driver for periodically reviewing and adjusting key risk indicators (KRIs)?

Risk impact

Risk likelihood

Risk appropriate

Control self-assessments (CSAs)

Page 19 of 48

181. Which stakeholders are PRIMARILY responsible for determining enterprise IT risk appetite?

Audit and compliance management

The chief information officer (CIO) and the chief financial officer (CFO)

Enterprise risk management and business process owners

Executive management and the board of directors

182. Which of the following is the PRIMARY benefit of consistently recording risk assessment results in the risk register?

Assessment of organizational risk appetite

Compliance with best practice

Accountability for loss events

Accuracy of risk profiles

183. Which of the following is BEST used to aggregate data from multiple systems to identify abnormal behavior?

A. Cyber threat intelligence

B. Anti-malware software

C. Endpoint detection and response (EDR)

D. SIEM systems

184. When testing the security of an IT system, il is MOST important to ensure that;

tests are conducted after business hours.

operators are unaware of the test.

external experts execute the test.

agreement is obtained from stakeholders.

185. A risk assessment has revealed that the probability of a successful cybersecurity attack is increasing. The potential loss could exceed the organization's risk appetite.

Which of the following ould be the MOST effective course of action?

Re-evaluate the organization's risk appetite.

Outsource the cybersecurity function.

Purchase cybersecurity insurance.

Review cybersecurity incident response procedures.

186. A risk practitioner discovers that an IT operations team manager bypassed web filtering controls by using a mobile device, in violation of the network security policy.

Which of the following should the risk practitioner do FIRST?

Report the incident.

Plan a security awareness session.

Assess the new risk.

Update the risk register.

187. A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk to acceptable levels.

Which of the following should the risk practitioner do FIRST?

Initiate disciplinary action against the risk owner.

Reassess the risk and review the underlying controls.

Review organizational ethics policies.

Report the activity to the supervisor.

188. In response to the threat of ransomware, an organization has implemented cybersecurity awareness activities. The risk practitioner's BEST recommendation to further reduce the impact of ransomware attacks would be to implement:

two-factor authentication.

continuous data backup controls.

encryption for data at rest.

encryption for data in motion.

189. Which of the following BEST prevents control gaps in the Zero Trust model when implementing in the environment?

Relying on multiple solutions for Zero Trust

Utilizing rapid development during implementation

Establishing a robust technical architecture

Starting with a large initial scope

190. A risk practitioner notices a risk scenario associated with data loss at the organization's cloud provider is assigned to the provider who should the risk scenario be reassigned to.

Senior management

Chief risk officer (CRO)

Vendor manager

Data owner

Page 20 of 48

191. Which of the following will BEST help in communicating strategic risk priorities?

Heat map

Business impact analysis (BIA)

Balanced Scorecard

Risk register

192. A violation of segregation of duties is when the same:

user requests and tests the change prior to production.

user authorizes and monitors the change post-implementation.

programmer requests and tests the change prior to production.

programmer writes and promotes code into production.

193. An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers.

Which of the following should be the MOST important consideration for a risk-based review of the user requirements?

Number of claims affected by the user requirements

Number of customers impacted

Impact to the accuracy of claim calculation

Level of resources required to implement the user requirements

194. Which of the following is the MOST effective way to integrate risk and compliance management?

Embedding risk management into compliance decision-making

Designing corrective actions to improve risk response capabilities

Embedding risk management into processes that are aligned with business drivers

Conducting regular self-assessments to verify compliance

195. Which of the following would be the GREATEST concern related to data privacy when implementing an Internet of Things (loT) solution that collects personally identifiable information (Pll)?

A privacy impact assessment has not been completed.

Data encryption methods apply to a subset of Pll obtained.

The data privacy officer was not consulted.

Insufficient access controls are used on the loT devices.

196. Which of the following should be determined FIRST when a new security vulnerability is made public?

Whether the affected technology is used within the organization

Whether the affected technology is Internet-facing

What mitigating controls are currently in place

How pervasive the vulnerability is within the organization

197. Which type of cloud computing deployment provides the consumer the GREATEST degree of control over the environment?

Community cloud

Private cloud

Hybrid cloud

Public cloud

198. Which of the following is MOST important to compare against the corporate risk profile?

Industry benchmarks

Risk tolerance

Risk appetite

Regulatory compliance

199. What is the MOST important consideration when selecting key performance indicators (KPIs) for control monitoring?

Source information is acquired at stable cost.

Source information is tailored by removing outliers.

Source information is readily quantifiable.

Source information is consistently available.

200. Which of the following provides The BEST information when determining whether to accept residual risk of a critical system to be implemented?

Single loss expectancy (SLE)

Cost of the information system

Availability of additional compensating controls

Potential business impacts are within acceptable levels

Page 21 of 48

201. Which of the following would provide the MOST useful information to a risk owner when reviewing the progress of risk mitigation?

Key audit findings

Treatment plan status

Performance indicators

Risk scenario results

202. Which of the following will BEST ensure that information security risk factors are mitigated when developing in-house applications?

Identify information security controls in the requirements analysis

Identify key risk indicators (KRIs) as process output.

Design key performance indicators (KPIs) for security in system specifications.

Include information security control specifications in business cases.

203. Which of the following information is MOST useful to a risk practitioner for developing IT risk scenarios?

Published vulnerabilities relevant to the business

Threat actors that can trigger events

Events that could potentially impact the business

IT assets requiring the greatest investment

204. An organization recently implemented a cybersecurity awareness program that includes phishing simulation exercises for all employees.

What type of control is being utilized?

Preventive

Compensating

Deterrent

Detective

205. The risk associated with an asset before controls are applied can be expressed as:

a function of the likelihood and impact

the magnitude of an impact

a function of the cost and effectiveness of control.

the likelihood of a given threat

206. Which of the following is the MOST important step to ensure regulatory requirements are

adequately addressed within an organization?

Obtain necessary resources to address regulatory requirements

Develop a policy framework that addresses regulatory requirements

Perform a gap analysis against regulatory requirements.

Employ IT solutions that meet regulatory requirements.

207. When an organization’s disaster recovery plan (DRP) has a reciprocal agreement, which of the following risk treatment options is being applied?

Acceptance

Mitigation

Transfer

Avoidance

208. Which of the following should be the risk practitioner s FIRST course of action when an organization has decided to expand into new product areas?

Identify any new business objectives with stakeholders.

Present a business case for new controls to stakeholders.

Revise the organization's risk and control policy.

Review existing risk scenarios with stakeholders.

209. A bank is experiencing an increasing incidence of customer identity theft.

Which of the following is the BEST way to mitigate this risk?

Implement monitoring techniques.

Implement layered security.

Outsource to a local processor.

Conduct an awareness campaign.

210. When developing risk scenario using a list of generic scenarios based on industry best practices, it is

MOST imported to:

Assess generic risk scenarios with business users.

Validate the generic risk scenarios for relevance.

Select the maximum possible risk scenarios from the list.

Identify common threats causing generic risk scenarios

Page 22 of 48

211. Which of the following would be a risk practitioner’s BEST recommendation upon learning of an updated cybersecurity regulation that could impact the organization?

Perform a gap analysis

Conduct system testing

Implement compensating controls

Update security policies

212. A multinational organization is considering implementing standard background checks to' all new employees A KEY concern regarding this approach

fail to identity all relevant issues.

be too costly

violate laws in other countries

be too line consuming

213. A risk heat map is MOST commonly used as part of an IT risk analysis to facilitate risk:

communication

identification.

treatment.

assessment.

214. Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?

User acceptance testing (UAT)

Database activity monitoring

Source code review

Vulnerability analysis

215. Which of the following tasks should be completed prior to creating a disaster recovery plan (DRP)?

Conducting a business impact analysis (BIA)

Identifying the recovery response team

Procuring a recovery site

Assigning sensitivity levels to data

216. An organization's decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:

The region in which the organization operates.

Established business culture.

Risk appetite set by senior management.

Identified business process controls.

217. Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Monitoring risk responses

Applying risk treatments

Providing assurance of control effectiveness

Implementing internal controls

218. Which of the following provides the MOST useful information to assess the magnitude of identified deficiencies in the IT control environment?

Peer benchmarks

Internal audit reports

Business impact analysis (BIA) results

Threat analysis results

219. Which of the following BEST supports ethical IT risk management practices?

Robust organizational communication channels

Mapping of key risk indicators (KRIs) to corporate strategy

Capability maturity models integrated with risk management frameworks

Rigorously enforced operational service level agreements (SLAs)

220. Which of the following situations reflects residual risk?

Risk that is present before risk acceptance has been finalized

Risk that is removed after a risk acceptance has been finalized

Risk that is present before mitigation controls have been applied

Risk that remains after mitigation controls have been applied

Page 23 of 48

221. Which of the following should be done FIRST when information is no longer required to support business objectives?

Archive the information to a backup database.

Protect the information according to the classification policy.

Assess the information against the retention policy.

Securely and permanently erase the information

222. A robotic process automation (RPA) project has implemented new robots to enhance the efficiency of a sales business process.

Which of the following provides the BEST evidence that the new controls have been implemented successfully?

A post-implementation review has been conducted by key personnel.

A qualified independent party assessed the new controls as effective.

Senior management has signed off on the design of the controls.

Robots have operated without human interference on a daily basis.

223. The PRIMARY benefit of maintaining an up-to-date risk register is that it helps to:

implement uniform controls for common risk scenarios.

ensure business unit risk is uniformly distributed.

build a risk profile for management review.

quantify the organization's risk appetite.

224. A recent regulatory requirement has the potential to affect an organization's use of a third party to supply outsourced business services.

Which of the following is the BEST course of action?

Conduct a gap analysis.

Terminate the outsourcing agreement.

Identify compensating controls.

Transfer risk to the third party.

225. An information system for a key business operation is being moved from an in-house application to a Software as a Service (SaaS) vendor.

Which of the following will have the GREATEST impact on the ability to monitor risk?

Reduced ability to evaluate key risk indicators (KRIs)

Reduced access to internal audit reports

Dependency on the vendor's key performance indicators (KPIs)

Dependency on service level agreements (SLAs)

226. A company has recently acquired a customer relationship management (CRM) application from a certified software vendor.

Which of the following will BE ST help lo prevent technical vulnerabilities from being exploded?

implement code reviews and Quality assurance on a regular basis

Verity me software agreement indemnifies the company from losses

Review the source coda and error reporting of the application

Update the software with the latest patches and updates

227. Which of the following is a detective control?

Limit check

Periodic access review

Access control software

Rerun procedures

228. An organization has outsourced a critical process involving highly regulated data to a third party with servers located in a foreign country.

Who is accountable for the confidentiality of this data?

Third-party data custodian

Data custodian

Regional office executive

Data owner

229. Which of the following is the BEST way to help ensure risk will be managed properly after a business process has been re-engineered?

Reassessing control effectiveness of the process

Conducting a post-implementation review to determine lessons learned

Reporting key performance indicators (KPIs) for core processes

Establishing escalation procedures for anomaly events

230. Which of the following is a crucial component of a key risk indicator (KRI) to ensure appropriate action is taken to mitigate risk?

Management intervention

Risk appetite

Board commentary

Escalation triggers

Page 24 of 48

231. Reviewing which of the following provides the BEST indication of an organizations risk tolerance?

Risk sharing strategy

Risk transfer agreements

Risk policies

Risk assessments

232. Which of the following is the MOST important reason to restrict access to the risk register on a need-to-know basis?

It contains vulnerabilities and threats.

The risk methodology is intellectual property.

Contents may be used as auditable findings.

Risk scenarios may be misinterpreted.

233. Senior management has requested more information regarding the risk associated with introducing a new application into the environment.

Which of the following should be done FIRST?

Perform an audit.

Conduct a risk analysis.

Develop risk scenarios.

Perform a cost-benefit analysis.

234. An assessment of information security controls has identified ineffective controls.

Which of the following should be the risk practitioner's FIRST course of action?

Determine whether the impact is outside the risk appetite.

Report the ineffective control for inclusion in the next audit report.

Request a formal acceptance of risk from senior management.

Deploy a compensating control to address the identified deficiencies.

235. Which of the following issues found during the review of a newly created disaster recovery plan (DRP) should be of MOST concern?

Some critical business applications are not included in the plan

Several recovery activities will be outsourced

The plan is not based on an internationally recognized framework

The chief information security officer (CISO) has not approved the plan

236. Which of the following would provide the BEST guidance when selecting an appropriate risk treatment plan?

Risk mitigation budget

Business Impact analysis

Cost-benefit analysis

Return on investment

237. Which of the following helps ensure compliance with a nonrepudiation policy requirement for electronic transactions?

Digital signatures

Encrypted passwords

One-time passwords

Digital certificates

238. In a public company, which group is PRIMARILY accountable for ensuring sufficient attention and resources are applied to the risk management process?

Board of directors

Risk officers

Line management

Senior management

239. Which of the following would be a risk practitioner’s GREATEST concern related to the monitoring of key risk indicators (KRIs)?

Logs are retained for longer than required.

Logs are reviewed annually.

Logs are stored in a multi-tenant cloud environment.

Logs are modified before analysis is conducted.

240. Who should be responsible for determining which stakeholders need to be involved in the development of a risk scenario?

Risk owner

Risk practitioner

Compliance manager

Control owner

Page 25 of 48

241. Which of the following deficiencies identified during a review of an organization's cybersecurity policy should be of MOST concern?

The policy lacks specifics on how to secure the organization's systems from cyberattacks.

The policy has gaps against relevant cybersecurity standards and frameworks.

The policy has not been reviewed by the cybersecurity team in over a year.

The policy has not been approved by the organization's board.

242. Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management's action plan?

Survey device owners.

Rescan the user environment.

Require annual end user policy acceptance.

Review awareness training assessment results

243. An organization recently implemented new technologies that enable the use of robotic process automation.

Which of the following is MOST important to reassess?

Risk profile

Risk tolerance

Risk capacity

Risk appetite

244. An organization has established a single enterprise-wide risk register that records high-level risk scenarios. The IT risk department has created its own register to record more granular scenarios applicable to IT.

Which of the following is the BEST way to ensure alignment between these two registers?

Map the granular risk scenarios to the high-level risk register items.

List application and server vulnerabilities in the IT risk register.

Identify overlapping risk scenarios between the two registers.

Maintain both high-level and granular risk scenarios in a single register.

245. Mitigating technology risk to acceptable levels should be based PRIMARILY upon:

organizational risk appetite.

business sector best practices.

business process requirements.

availability of automated solutions

246. When presenting risk, the BEST method to ensure that the risk is measurable against the organization's risk appetite is through the use of a:

risk map

cause-and-effect diagram

maturity model

technology strategy plan.

247. Management has required information security awareness training to reduce the risk associated with credential compromise.

What is the BEST way to assess the effectiveness of the training?

Conduct social engineering testing.

Audit security awareness training materials.

Administer an end-of-training quiz.

Perform a vulnerability assessment.

248. Which of the following is the MOST important consideration when communicating the risk associated with technology end-of-life to business owners?

Cost and benefit

Security and availability

Maintainability and reliability

Performance and productivity

249. Which of the following is MOST important for mitigating ethical risk when establishing accountability for control ownership?

Ensuring processes are documented to enable effective control execution

Ensuring regular risk messaging is Included in business communications from leadership

Ensuring schedules and deadlines for control-related deliverables are strictly monitored

Ensuring performance metrics balance business goals with risk appetite

250. Which of the following is MOST important to understand when developing key risk indicators (KRIs)?

KRI thresholds

Integrity of the source data

Control environment

Stakeholder requirements

Page 26 of 48

251. Which of the following is the MOST effective way to validate organizational awareness of cybersecurity risk?

Conducting security awareness training

Updating the information security policy

Implementing mock phishing exercises

Requiring two-factor authentication

252. Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Monitoring risk responses

Applying risk treatments

Implementing internal controls

Providing assurance of control effectiveness

253. An organization is adopting block chain for a new financial system.

Which of the following should be the GREATEST concern for a risk practitioner evaluating the system's production readiness?

Limited organizational knowledge of the underlying technology

Lack of commercial software support

Varying costs related to implementation and maintenance

Slow adoption of the technology across the financial industry

254. Which of the following is the MOST important update for keeping the risk register current?

A. Modifying organizational structures when lines of business merge

B. Adding new risk assessment results annually

C. Retiring risk scenarios that have been avoided

D. Changing risk owners due to employee turnover

255. Which of the following BEST indicates that an organization has implemented IT performance requirements?

Service level agreements (SLA)

Vendor references

Benchmarking data

Accountability matrix

256. Which of the following would be MOST helpful when estimating the likelihood of negative events?

Business impact analysis

Threat analysis

Risk response analysis

Cost-benefit analysis

257. Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?

To ensure IT risk appetite is communicated across the organization

To ensure IT risk impact can be compared to the IT risk appetite

To ensure IT risk ownership is assigned at the appropriate organizational level

To ensure IT risk scenarios are consistently assessed within the organization

258. During a risk treatment plan review, a risk practitioner finds the approved risk action plan has not been completed However, there were other risk mitigation actions implemented.

Which of the fallowing is the BEST course of action?

Review the cost-benefit of mitigating controls

Mark the risk status as unresolved within the risk register

Verify the sufficiency of mitigating controls with the risk owner

Update the risk register with implemented mitigating actions

259. Which of the following is the MOST reliable validation of a new control?

Approval of the control by senior management

Complete and accurate documentation of control objectives

Control owner attestation of control effectiveness

Internal audit review of control design

260. An IT license audit has revealed that there are several unlicensed copies of co be to:

immediately uninstall the unlicensed software from the laptops

centralize administration rights on laptops so that installations are controlled

report the issue to management so appropriate action can be taken.

procure the requisite licenses for the software to minimize business impact.

Page 27 of 48

261. An organization uses a biometric access control system for authentication and access to its server room.

Which control type has been implemented?

Detective.

Deterrent.

Preventive.

Corrective.

262. Business management is seeking assurance from the CIO that IT has a plan in place for early identification of potential issues that could impact the delivery of a new application.

Which of the following is the BEST way to increase the chances of a successful delivery'?

Implement a release and deployment plan

Conduct comprehensive regression testing.

Develop enterprise-wide key risk indicators (KRls)

Include business management on a weekly risk and issues report

263. A software developer has administrative access to a production application.

Which of the following should be of GREATEST concern to a risk practitioner?

The administrative access does not allow for activity log monitoring.

The administrative access does not follow password management protocols.

The administrative access represents a deviation from corporate policy.

The administrative access represents a segregation of duties conflict.

264. An IT department originally planned to outsource the hosting of its data center at an overseas location to reduce operational expenses. After a risk assessment, the department has decided to keep the data center in-house.

How should the risk treatment response be reflected in the risk register?

Risk mitigation

Risk avoidance

Risk acceptance

Risk transfer

265. Which of the following events is MOST likely to trigger the need to conduct a risk assessment?

A. An incident resulting in data loss

B. Changes in executive management

C. Updates to the information security policy

D. Introduction of a new product line

266. An organization recently implemented a cybersecurity awareness program that includes phishing simulation exercises for all employees.

What type of control is being utilized?

Preventive

Compensating

Deterrent

Detective

267. When creating a program to manage data privacy risk, which of the following is MOST important to ensure that the program is successful?

Adoption of mission and vision statements

Alignment with applicable legal and regulatory requirements

Compliance with industry frameworks

Approval of mitigating and compensating controls

268. What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner's business impact analysis (BIA)?

Include the application in the business continuity plan (BCP).

Determine the business purpose of the application.

Segregate the application from the network.

Report the finding to management.

269. Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?

To provide insight into the effectiveness of the internal control environment

To provide a basis for determining the criticality of risk mitigation controls

To provide benchmarks for assessing control design effectiveness against industry peers

To provide early warning signs of a potential change in risk level

270. Which of the following would be a risk practitioner’s GREATEST concern related to the monitoring of key risk indicators (KRIs)?

Logs are retained for longer than required.

Logs are reviewed annually.

Logs are stored in a multi-tenant cloud environment.

Logs are modified before analysis is conducted.

Page 28 of 48

271. An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes.

Which of the following would be the BEST metric to determine if the program is performing as expected?

Decrease in the time to move changes to production

Ratio of emergency fixes to total changes

Ratio of system changes to total changes

Decrease in number of changes without a fallback plan

272. Which of the following would BEST help identify the owner for each risk scenario in a risk register?

Determining which departments contribute most to risk

Allocating responsibility for risk factors equally to asset owners

Mapping identified risk factors to specific business processes

Determining resource dependency of assets

273. Which of the following is the BEST metric to demonstrate the effectiveness of an organization's change management process?

Increase in the frequency of changes

Percent of unauthorized changes

Increase in the number of emergency changes

Average time to complete changes

274. Which of the following would BEST help secure online financial transactions from improper users?

Review of log-in attempts

multi-level authorization

Periodic review of audit trails

multi-factor authentication

275. A business impact analysis (BIA) has documented the duration of maximum allowable outage for each of an organization's applications.

Which of the following MUST be aligned with the maximum allowable outage?

Mean time to restore (MTTR)

Recovery time objective (RTO)

Recovery point objective (RPO)

Mean time to detect (MTTD)

276. Which of the following should be the risk practitioner s PRIMARY focus when determining whether controls are adequate to mitigate risk?

Sensitivity analysis

Level of residual risk

Cost-benefit analysis

Risk appetite

277. Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?

Percentage of projects with key risk accepted by the project steering committee

Reduction in risk policy noncompliance findings

Percentage of projects with developed controls on scope creep

Reduction in audits involving external risk consultants

278. Which of the following should be a risk practitioner's PRIMARY focus when tasked with ensuring organization records are being retained for a sufficient period of time to meet legal obligations?

Data duplication processes

Data archival processes

Data anonymization processes

Data protection processes

279. A newly incorporated enterprise needs to secure its information assets From a governance perspective which of the following should be done FIRST?

Define information retention requirements and policies

Provide information security awareness training

Establish security management processes and procedures

Establish an inventory of information assets

280. A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite.

Which of the following is the risk practitioner's BEST course of action?

Conduct a risk assessment with stakeholders.

Conduct third-party resilience tests.

Update the risk register with the process changes.

Review risk related to standards and regulations.

Page 29 of 48

281. What is the BEST information to present to business control owners when justifying costs related to controls?

Loss event frequency and magnitude

The previous year's budget and actuals

Industry benchmarks and standards

Return on IT security-related investments

282. Which of the following is MOST important when developing key risk indicators (KRIs)?

Alignment with regulatory requirements

Availability of qualitative data

Properly set thresholds

Alignment with industry benchmarks

283. Which of the following BEST enables effective risk-based decision making?

Performing threat modeling to understand the threat landscape

Minimizing the number of risk scenarios for risk assessment

Aggregating risk scenarios across a key business unit

Ensuring the risk register is updated to reflect changes in risk factors

284. Which of the following is MOST important when developing key performance indicators (KPIs)?

Alignment to risk responses

Alignment to management reports

Alerts when risk thresholds are reached

Identification of trends

285. Of the following, who is responsible for approval when a change in an application system is ready for release to production?

Information security officer

IT risk manager

Business owner

Chief risk officer (CRO)

286. To communicate the risk associated with IT in business terms, which of the following MUST be defined?

Compliance objectives

Risk appetite of the organization

Organizational objectives

Inherent and residual risk

287. One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities.

Which of the following would be the risk practitioner's BEST recommendation?

Additional mitigating controls should be identified.

The system should not be used until the application is changed

The organization's IT risk appetite should be adjusted.

The associated IT risk should be accepted by management.

288. Which of the following is MOST useful input when developing risk scenarios?

Common attacks in other industries

Identification of risk events

Impact on critical assets

Probability of disruptive risk events

289. Who is BEST suited to determine whether a new control properly mitigates data loss risk within a system?

Data owner

Control owner

Risk owner

System owner

290. Risk mitigation procedures should include:

buying an insurance policy.

acceptance of exposures

deployment of counter measures.

enterprise architecture implementation.

Page 30 of 48

291. Which of the following is necessary to enable an IT risk register to be consolidated with the rest of

the organization’s risk register?

Risk taxonomy

Risk response

Risk appetite

Risk ranking

292. An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years.

Of the following, who should be notified of this new information FIRST.

The risk owner who also owns the business service enabled by this infrastructure

The data center manager who is also employed under the managed hosting services contract

The site manager who is required to provide annual risk assessments under the contract

The chief information officer (CIO) who is responsible for the hosted services

293. What is the PRIMARY benefit of risk monitoring?

It reduces the number of audit findings.

It provides statistical evidence of control efficiency.

It facilitates risk-aware decision making.

It facilitates communication of threat levels.

294. Which of the following is the BEST indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees?

A reduction in the number of help desk calls

An increase in the number of identified system flaws

A reduction in the number of user access resets

An increase in the number of incidents reported

295. Which of the following should be the HIGHEST priority when developing a risk response?

The risk response addresses the risk with a holistic view.

The risk response is based on a cost-benefit analysis.

The risk response is accounted for in the budget.

The risk response aligns with the organization's risk appetite.

296. Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization's risk register?

Limit access to senior management only.

Encrypt the risk register.

Implement role-based access.

Require users to sign a confidentiality agreement.

297. An organization has decided to implement an emerging technology and incorporate the new capabilities into its strategic business plan. Business operations for the technology will be outsourced.

What will be the risk practitioner's PRIMARY role during the change?

Managing third-party risk

Developing risk scenarios

Managing the threat landscape

Updating risk appetite

298. Which of the following is the BEST method for assessing control effectiveness?

Ad hoc control reporting

Control self-assessment

Continuous monitoring

Predictive analytics

299. An organization automatically approves exceptions to security policies on a recurring basis.

This practice is MOST likely the result of:

a lack of mitigating actions for identified risk

decreased threat levels

ineffective service delivery

ineffective IT governance

300. Which of the following should a risk practitioner recommend FIRST when an increasing trend of risk events and subsequent losses has been identified?

Conduct root cause analyses for risk events.

Educate personnel on risk mitigation strategies.

Integrate the risk event and incident management processes.

Implement controls to prevent future risk events.

Page 31 of 48

301. The PRIMARY purpose of using control metrics is to evaluate the:

amount of risk reduced by compensating controls.

amount of risk present in the organization.

variance against objectives.

number of incidents.

302. An organization's stakeholders are unable to agree on appropriate risk responses.

Which of the following would be the BEST course of action?

Escalate to senior management.

Identify a risk transfer option.

Reassess risk scenarios.

Benchmark with similar industries.

303. Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?

Proportion of end users having more than one account

Percentage of accounts disabled within the service level agreement (SLA)

Proportion of privileged to non-privileged accounts

Percentage of accounts that have not been activated

304. When performing a risk assessment of a new service to support a ewe Business process.

Which of the following should be done FRST10 ensure continuity of operations?

a identity conditions that may cause disruptions

Review incident response procedures

Evaluate the probability of risk events

Define metrics for restoring availability

305. An organization uses one centralized single sign-on (SSO) control to cover many applications.

Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?

Initiate a retest of the full control

Retest the control using the new application as the only sample.

Review the corresponding change control documentation

Re-evaluate the control during (he next assessment

306. Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?

Cost of offsite backup premises

Cost of downtime due to a disaster

Cost of testing the business continuity plan

Response time of the emergency action plan

307. Which of the following is the BEST evidence that risk management is driving business decisions in an organization?

Compliance breaches are addressed in a timely manner.

Risk ownership is identified and assigned.

Risk treatment options receive adequate funding.

Residual risk is within risk tolerance.

308. Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented.

Which risk treatment has been selected?

Avoidance

Acceptance

Mitigation

Transfer

309. Which of the following roles should be assigned accountability for monitoring risk levels?

Risk practitioner

Business manager

Risk owner

Control owner

310. Which of the following would be MOST relevant to stakeholders regarding ineffective control

implementation?

Threat to IT

Number of control failures

Impact on business

Risk ownership

Page 32 of 48

311. When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?

Risk action plans and associated owners

Recent audit and self-assessment results

Potential losses compared to treatment cost

A list of assets exposed to the highest risk

312. When reviewing a risk response strategy, senior management's PRIMARY focus should be placed on the:

cost-benefit analysis.

investment portfolio.

key performance indicators (KPIs).

alignment with risk appetite.

313. An organization has implemented a system capable of comprehensive employee monitoring.

Which of the following should direct how the system is used?

Organizational strategy

Employee code of conduct

Industry best practices

Organizational policy

314. Which of the following BEST mitigates the risk of sensitive personal data leakage from a software development environment?

Tokenized personal data only in test environments

Data loss prevention tools (DLP) installed in passive mode

Anonymized personal data in non-production environments

Multi-factor authentication for access to non-production environments

315. Which of the following BEST enables a risk practitioner to understand management's approach to organizational risk?

Organizational structure and job descriptions

Risk appetite and risk tolerance

Industry best practices for risk management

Prior year's risk assessment results

316. Which of the following should a risk practitioner do FIRST when an organization decides to use a cloud service?

Review the vendor selection process and vetting criteria.

Assess whether use of service falls within risk tolerance thresholds.

Establish service level agreements (SLAs) with the vendor.

Check the contract for appropriate security risk and control provisions.

317. Which of the following is the MAIN benefit of involving stakeholders in the selection of key risk indicators (KRIs)?

Improving risk awareness

Obtaining buy-in from risk owners

Leveraging existing metrics

Optimizing risk treatment decisions

318. When of the following standard operating procedure (SOP) statements BEST illustrates appropriate risk register maintenance?

Remove risk that has been mitigated by third-party transfer

Remove risk that management has decided to accept

Remove risk only following a significant change in the risk environment

Remove risk when mitigation results in residual risk within tolerance levels

319. Which of the following is the BEST method for determining an enterprise's current appetite for risk?

Comparative analysis of peer companies

Reviews of brokerage firm assessments

Interviews with senior management

Trend analysis using prior annual reports

320. An organization requires a third party for processing customer personal data.

Which of the following is the BEST approach when sharing data over a public network?

Include a nondisclosure agreement (NDA) for personal data in the contract.

Implement a digital rights protection tool to monitor data.

Use a virtual private network (VPN) to communicate data.

Transfer a read-only version of the data.

Page 33 of 48

321. Which of the following is MOST helpful in aligning IT risk with business objectives?

Introducing an approved IT governance framework

Integrating the results of top-down risk scenario analyses

Performing a business impact analysis (BlA)

Implementing a risk classification system

322. Which of the following should be the starting point when performing a risk analysis for an asset?

Assess risk scenarios.

Update the risk register.

Evaluate threats.

Assess controls.

323. Which of the following would offer the MOST insight with regard to an organization's risk culture?

Risk management procedures

Senior management interviews

Benchmark analyses

Risk management framework

324. What information is MOST helpful to asset owners when classifying organizational assets for risk assessment?

Potential loss to tie business due to non-performance of the asset

Known emerging environmental threats

Known vulnerabilities published by the asset developer

Cost of replacing the asset with a new asset providing similar services

325. Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

KRIs assist in the preparation of the organization's risk profile.

KRIs signal that a change in the control environment has occurred.

KRIs provide a basis to set the risk appetite for an organization

KRIs provide an early warning that a risk threshold is about to be reached.

326. An organization's decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:

The region in which the organization operates.

Established business culture.

Risk appetite set by senior management.

Identified business process controls.

327. Which of the following is the GREATEST risk associated with the misclassification of data?

inadequate resource allocation

Data disruption

Unauthorized access

Inadequate retention schedules

328. Analyzing trends in key control indicators (KCIs) BEST enables a risk practitioner to proactively identify impacts on an organization's:

risk classification methods

risk-based capital allocation

risk portfolio

risk culture

329. Which of the following facilitates a completely independent review of test results for evaluating control effectiveness?

Segregation of duties

Three lines of defense

Compliance review

Quality assurance review

330. A recent audit identified high-risk issues in a business unit though a previous control self-assessment (CSA) had good results.

Which of the following is the MOST likely reason for the difference?

The audit had a broader scope than the CS

The CSA was not sample-based.

The CSA did not test control effectiveness.

The CSA was compliance-based, while the audit was risk-based.

Page 34 of 48

331. Which of the following is the BEST indication of an effective risk management program?

Risk action plans are approved by senior management.

Residual risk is within the organizational risk appetite

Mitigating controls are designed and implemented.

Risk is recorded and tracked in the risk register

332. Who is ULTIMATELY accountable for risk treatment?

Risk owner

Enterprise risk management (ERM)

Risk practitioner

Control owner

333. A risk practitioner has been notified that an employee sent an email in error containing customers' personally identifiable information (Pll).

Which of the following is the risk practitioner's BEST course of action?

Report it to the chief risk officer.

Advise the employee to forward the email to the phishing team.

follow incident reporting procedures.

Advise the employee to permanently delete the email.

334. An organization has established a policy prohibiting ransom payments if subjected to a ransomware attack.

Which of the following is the MOST effective control to support this policy?

Conducting periodic vulnerability scanning

Creating immutable backups

Performing required patching

Implementing continuous intrusion detection monitoring

335. Which of the following is the MOST important consideration for prioritizing risk treatment plans when faced with budget limitations?

Inherent risk and likelihood

Management action plans associated with audit findings

Residual risk relative to appetite and tolerance

Key risk indicator (KRI) trends

336. Which of the following is the BEST course of action to help reduce the probability of an incident recurring?

Perform a risk assessment.

Perform root cause analysis.

Initiate disciplinary action.

Update the incident response plan.

337. The BEST key performance indicator (KPI) to measure the effectiveness of a backup process would be the number of:

resources to monitor backups

restoration monitoring reports

backup recovery requests

recurring restore failures

338. Which of the following is the PRIMARY purpose of creating and documenting control procedures?

To facilitate ongoing audit and control testing

To help manage risk to acceptable tolerance levels

To establish and maintain a control inventory

To increase the likelihood of effective control operation

339. Who is accountable for risk treatment?

Enterprise risk management team

Risk mitigation manager

Business process owner

Risk owner

340. Which of the following scenarios is MOST likely to cause a risk practitioner to request a formal risk acceptance sign-off?

Residual risk in excess of the risk appetite cannot be mitigated.

Inherent risk is too high, resulting in the cancellation of an initiative.

Risk appetite has changed to align with organizational objectives.

Residual risk remains at the same level over time without further mitigation.

Page 35 of 48

341. Which of the following is of GREATEST concern when uncontrolled changes are made to the control environment?

A decrease in control layering effectiveness

An increase in inherent risk

An increase in control vulnerabilities

An increase in the level of residual risk

342. Which of the following will BEST ensure that controls adequately support business goals and objectives?

Using the risk management process

Enforcing strict disciplinary procedures in case of noncompliance

Reviewing results of the annual company external audit

Adopting internationally accepted controls

343. An organization's capability to implement a risk management framework is PRIMARILY influenced by the:

guidance of the risk practitioner.

competence of the staff involved.

approval of senior management.

maturity of its risk culture.

344. Which of the following provides the MOST helpful information in identifying risk in an organization?

Risk registers

Risk analysis

Risk scenarios

Risk responses

345. When reviewing the business continuity plan (BCP) of an online sales order system, a risk practitioner notices that the recovery time objective (RTO) has a shorter lime than what is defined in the disaster recovery plan (DRP).

Which of the following is the BEST way for the risk practitioner to address this concern?

Adopt the RTO defined in the BCR

Update the risk register to reflect the discrepancy.

Adopt the RTO defined in the DR

Communicate the discrepancy to the DR manager for follow-up.

346. Which of the following presents the GREATEST privacy risk related to personal data processing for a global organization?

Privacy risk awareness training has not been conducted across the organization.

The organization has not incorporated privacy into its risk management framework.

The organization allows staff with access to personal data to work remotely.

Personal data processing occurs in an offshore location with a data sharing agreement.

347. An organization recently received an independent security audit report of its cloud service provider that indicates significant control weaknesses.

What should be done NEXT in response to this report?

Migrate all data to another compliant service provider.

Analyze the impact of the provider's control weaknesses to the business.

Conduct a follow-up audit to verify the provider's control weaknesses.

Review the contract to determine if penalties should be levied against the provider.

348. Risk management strategies are PRIMARILY adopted to:

take necessary precautions for claims and losses.

achieve acceptable residual risk levels.

avoid risk for business and IT assets.

achieve compliance with legal requirements.

349. Effective risk communication BEST benefits an organization by:

helping personnel make better-informed decisions

assisting the development of a risk register.

improving the effectiveness of IT controls.

increasing participation in the risk assessment process.

350. Which of the following is the BEST recommendation when a key risk indicator (KRI) is generating an excessive volume of events?

Reevaluate the design of the KRIs.

Develop a corresponding key performance indicator (KPI).

Monitor KRIs within a specific timeframe.

Activate the incident response plan.

Page 36 of 48

351. A risk practitioner has just learned about new malware that has severely impacted industry peers worldwide data loss?

Customer database manager

Customer data custodian

Data privacy officer

Audit committee

352. Which of the following aspects of an IT risk and control self-assessment would be MOST important to include in a report to senior management?

Changes in control design

A decrease in the number of key controls

Changes in control ownership

An increase in residual risk

353. A bank recently incorporated Blockchain technology with the potential to impact known risk within

the organization.

Which of the following is the risk practitioner’s BEST course of action?

Determine whether risk responses are still adequate.

Analyze and update control assessments with the new processes.

Analyze the risk and update the risk register as needed.

Conduct testing of the control that mitigate the existing risk.

354. An organization has allowed its cyber risk insurance to lapse while seeking a new insurance provider.

The risk practitioner should report to management that the risk has been:

transferred

mitigated.

accepted

avoided

355. Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?

The business case for the use of loT

The loT threat landscape

Policy development for loT

The network that loT devices can access

356. A risk practitioner observes that hardware failure incidents have been increasing over the last few months. However, due to built-in redundancy and fault-tolerant architecture, there have been no interruptions to business operations.

The risk practitioner should conclude that:

a root cause analysis is required

controls are effective for ensuring continuity

hardware needs to be upgraded

no action is required as there was no impact

357. Which of the following is the MOST important foundational element of an effective three lines of defense model for an organization?

A robust risk aggregation tool set

Clearly defined roles and responsibilities

A well-established risk management committee

Well-documented and communicated escalation procedures

358. The PRIMARY benefit of using a maturity model is that it helps to evaluate the:

capability to implement new processes

evolution of process improvements

degree of compliance with policies and procedures

control requirements.

359. Which of the following is the MOST effective way to mitigate identified risk scenarios?

Assign ownership of the risk response plan

Provide awareness in early detection of risk.

Perform periodic audits on identified risk.

areas Document the risk tolerance of the organization.

360. An enterprise has taken delivery of software patches that address vulnerabilities in its core business software.

Prior to implementation, which of the following is the MOST important task to be performed?

Assess the impact of applying the patches on the production environment.

Survey other enterprises regarding their experiences with applying these patches.

Seek information from the software vendor to enable effective application of the patches.

Determine in advance an off-peak period to apply the patches.

Page 37 of 48

361. An organization is planning to move its application infrastructure from on-premises to the cloud.

Which of the following is the BEST course of the actin to address the risk associated with data transfer if the relationship is terminated with the vendor?

Meet with the business leaders to ensure the classification of their transferred data is in place

Ensure the language in the contract explicitly states who is accountable for each step of the data transfer process

Collect requirements for the environment to ensure the infrastructure as a service (IaaS) is configured appropriately.

Work closely with the information security officer to ensure the company has the proper security controls in place.

362. Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization's risk appetite?

Establishing a series of key risk indicators (KRIs)

Adding risk triggers to entries in the risk register

Implementing key performance indicators (KPIs)

Developing contingency plans for key processes

363. A risk practitioner identifies an increasing trend of employees copying company information unrelated to their job functions to USB drives.

Which of the following elements of the risk register should be updated to reflect this observation?

Risk impact

Key risk indicator (KRI)

Risk appetite

Risk likelihood

364. Which of the following is the MOST important consideration when prioritizing risk response?

Requirements for regulatory obligations

Cost of control implementation

Effectiveness of risk treatment

Number of risk response options

365. The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

identify specific project risk.

obtain a holistic view of IT strategy risk.

understand risk associated with complex processes.

incorporate subject matter expertise.

366. Recent penetration testing of an organization's software has identified many different types of security risks.

Which of the following is the MOST likely root cause for the identified risk?

SIEM software is producing faulty alerts.

Threat modeling was not utilized in the software design process.

The configuration management process is not applied consistently during development.

An identity and access management (IAM) tool has not been properly integrated into the software.

367. When communicating changes in the IT risk profile, which of the following should be included to BEST enable stakeholder decision making?

List of recent incidents affecting industry peers

Results of external attacks and related compensating controls

Gaps between current and desired states of the control environment

Review of leading IT risk management practices within the industry

368. Which of the following is the BEST approach to mitigate the risk associated with a control deficiency?

Perform a business case analysis

Implement compensating controls.

Conduct a control sell-assessment (CSA)

Build a provision for risk

369. Which of the following is the MOST likely reason an organization would engage an independent reviewer to assess its IT risk management program?

To ensure IT risk management is focused on mitigating emerging risk

To confirm that IT risk assessment results are expressed in quantitative terms

To evaluate threats to the organization's operations and strategy

To identify gaps in the alignment of IT risk management processes and strategy

370. A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation.

Which ot the following is the risk practitioner's BEST course of action?

Collaborate with the risk owner to determine the risk response plan.

Document the gap in the risk register and report to senior management.

Include a right to audit clause in the service provider contract.

Advise the risk owner to accept the risk.

Page 38 of 48

371. What is the PRIMARY reason an organization should include background checks on roles with elevated access to production as part of its hiring process?

Reduce internal threats

Reduce exposure to vulnerabilities

Eliminate risk associated with personnel

Ensure new hires have the required skills

372. An organization has identified a risk exposure due to weak technical controls in a newly implemented HR system. The risk practitioner is documenting the risk in the risk register.

The risk should be owned by the:

chief risk officer.

project manager.

chief information officer.

business process owner.

373. Which of the following is the GREATEST concern associated with the use of artificial intelligence (AI) language models?

The model could be hacked or exploited.

The model could be used to generate inaccurate content.

Staff could become overly reliant on the model.

It could lead to biased recommendations.

374. Which of the following BEST indicates the effective implementation of a risk treatment plan?

A. Inherent risk is managed within an acceptable level.

B. Residual risk is managed within appetite and tolerance.

C. Risk treatments are aligned with industry peers.

D. Key controls are identified and documented.

375. An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers.

Which of the following should be of GREATEST concern to the risk practitioner?

Data minimization

Accountability

Accuracy

Purpose limitation

376. Real-time monitoring of security cameras implemented within a retail store is an example of which type of control?

Preventive

Deterrent

Compensating

Detective

377. Which of the following is the MOST important consideration for effectively maintaining a risk register?

An IT owner is assigned for each risk scenario.

The register is updated frequently.

The register is shared with executive management.

Compensating controls are identified.

378. An organization’s board of directors is concerned about recent data breaches in the news and wants to assess its exposure to similar scenarios.

Which of the following is the BEST course of action?

Evaluate the organization's existing data protection controls.

Reassess the risk appetite and tolerance levels of the business.

Evaluate the sensitivity of data that the business needs to handle.

Review the organization’s data retention policy and regulatory requirements.

379. Which of the following is a specific concern related to machine learning algorithms?

Low software quality

Lack of access controls

Data breaches

Data bias

380. Which of the following will BEST quantify the risk associated with malicious users in an organization?

Business impact analysis

Risk analysis

Threat risk assessment

Vulnerability assessment

Page 39 of 48

381. A recent risk workshop has identified risk owners and responses for newly identified risk scenarios.

Which of the following should be the risk practitioner's NEXT step?

Develop a mechanism for monitoring residual risk.

Update the risk register with the results.

Prepare a business case for the response options.

Identify resources for implementing responses.

382. A company has located its computer center on a moderate earthquake fault.

Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?

The contingency plan provides for backup media to be taken to the alternative site.

The contingency plan for high priority applications does not involve a shared cold site.

The alternative site is a hot site with equipment ready to resume processing immediately.

The alternative site does not reside on the same fault no matter how far the distance apart.

383. Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

Conducting periodic reviews of authorizations granted

Revoking access for users changing roles

Monitoring user activity using security logs

Granting access based on least privilege

384. Which of the following will BEST help to ensure implementation of corrective action plans?

Contracting to third parties

Establishing employee awareness training

Setting target dates to complete actions

Assigning accountability to risk owners

385. Which of the following is the PRIMARY reason for a risk practitioner to review an organization's IT asset inventory?

To plan for the replacement of assets at the end of their life cycles

To assess requirements for reducing duplicate assets

To understand vulnerabilities associated with the use of the assets

To calculate mean time between failures (MTBF) for the assets

386. Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?

Solutions for eradicating emerging threats

Cost to mitigate the risk resulting from threats

Indicators for detecting the presence of threatsl)

Source and identity of attackers

387. An organization has updated its acceptable use policy to mitigate the risk of employees disclosing confidential information.

Which of the following is the BEST way to reinforce the effectiveness of this policy?

Communicate sanctions for policy violations to all staff.

Obtain signed acceptance of the new policy from employees.

Train all staff on relevant information security best practices.

Implement data loss prevention (DLP) within the corporate network.

388. Which of the following is the BEST key performance indicator (KPI) to measure the ability to deliver

uninterrupted IT services?

Mean time between failures (MTBF)

Mean time to recover (MTTR)

Planned downtime

Unplanned downtime

389. Which of the following is the MOST important input when developing risk scenarios?

Key performance indicators

Business objectives

The organization's risk framework

Risk appetite

390. A control owner has completed a year-long project.

To strengthen existing controls. It is MOST important for the risk practitioner to:

update the risk register to reflect the correct level of residual risk.

ensure risk monitoring for the project is initiated.

conduct and document a business impact analysis (BIA).

verify cost-benefit of the new controls being implemented.

Page 40 of 48

391. Which of the following methods is an example of risk mitigation?

Not providing capability for employees to work remotely

Outsourcing the IT activities and infrastructure

Enforcing change and configuration management processes

Taking out insurance coverage for IT-related incidents

392. Which of the following actions should a risk practitioner do NEXT when an increased industry trend of external cyber attacks is identified?

Conduct a threat and vulnerability analysis.

Notify senior management of the new risk scenario.

Update the risk impact rating in the risk register.

Update the key risk indicator (KRI) in the risk register.

393. Which of the following should be an element of the risk appetite of an organization?

The effectiveness of compensating controls

The enterprise's capacity to absorb loss

The residual risk affected by preventive controls

The amount of inherent risk considered appropriate

394. Which of the following is MOST important to consider when determining the value of an asset during the risk identification process?

The criticality of the asset

The vulnerability profile of the asset

The monetary value of the asset

The size of the asset's user base

395. Which of the following should be the PRIMARY focus of a disaster recovery management (DRM) framework and related processes?

Restoring IT and cybersecurity operations

Assessing the impact and probability of disaster scenarios

Ensuring timely recovery of critical business operations

Determining capacity for alternate sites

396. Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?

To enhance compliance with standards

To minimize subjectivity of assessments

To increase consensus among peers

To provide assessments for benchmarking

397. Which of the following is MOST important to review when determining whether a potential IT service provider’s control environment is effective?

Independent audit report

Control self-assessment

MOST important to update when an

Service level agreements (SLAs)

398. A control for mitigating risk in a key business area cannot be implemented immediately.

Which of the following is the risk practitioner's BEST course of action when a compensating control needs to be applied?

Obtain the risk owner's approval.

Record the risk as accepted in the risk register.

Inform senior management.

update the risk response plan.

399. The MAIN purpose of a risk register is to:

document the risk universe of the organization.

promote an understanding of risk across the organization.

enable well-informed risk management decisions.

identify stakeholders associated with risk scenarios.

400. Which of the following is the PRIMARY objective of establishing an organization's risk tolerance and appetite?

To align with board reporting requirements

To assist management in decision making

To create organization-wide risk awareness

To minimize risk mitigation efforts

Page 41 of 48

401. Which of the following should be the PRIMARY goal of developing information security metrics?

Raising security awareness

Enabling continuous improvement

Identifying security threats

Ensuring regulatory compliance

402. Which of the following is MOST helpful in identifying new risk exposures due to changes in the business environment?

Standard operating procedures

SWOT analysis

Industry benchmarking

Control gap analysis

403. Which of the following is the MOST important consideration when sharing risk management updates with executive management?

Including trend analysis of risk metrics

Using an aggregated view of organizational risk

Relying on key risk indicator (KRI) data

Ensuring relevance to organizational goals

404. Which of the following is the GREATEST benefit of incorporating IT risk scenarios into the corporate risk register?

Corporate incident escalation protocols are established.

Exposure is integrated into the organization's risk profile.

Risk appetite cascades to business unit management

The organization-wide control budget is expanded.

405. Which of the following is the BEST course of action for a system administrator who suspects a colleague may be intentionally weakening a system's validation controls in order to pass through fraudulent transactions?

Implement compensating controls to deter fraud attempts.

Share the concern through a whistleblower communication channel.

Monitor the activity to collect evidence.

Determine whether the system environment has flaws that may motivate fraud attempts.

406. Which of the following is MOST useful when communicating risk to management?

Risk policy

Audit report

Risk map

Maturity model

407. A large organization is replacing its enterprise resource planning (ERP) system and has decided not to deploy the payroll module of the new system. Instead, the current payroll system will continue to be used.

Of the following, who should own the risk if the ERP and payroll system fail to operate as expected?

The business owner

The ERP administrator

The project steering committee

The IT project manager

408. Which of the following would be MOST helpful in assessing the risk associated with data loss due to human vulnerabilities?

Reviewing password change history

Performing periodic access recertification

Conducting social engineering exercises

Reviewing the results of security awareness surveys

409. An organization practices the principle of least privilege.

To ensure access remains appropriate, application owners should be required to review user access rights on a regular basis by obtaining:

business purpose documentation and software license counts

an access control matrix and approval from the user's manager

documentation indicating the intended users of the application

security logs to determine the cause of invalid login attempts

410. An organization's decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:

The region in which the organization operates.

Established business culture.

Risk appetite set by senior management.

Identified business process controls.

Page 42 of 48

411. An organization's risk management team wants to develop IT risk scenarios to show the impact of collecting and storing credit card information.

Which of the following is the MOST comprehensive approach to capture this scenario?

Top-down analysis

Event tree analysis

Control gap analysis

Bottom-up analysis

412. Which of the following should management consider when selecting a risk mitigation option?

Maturity of the enterprise architecture

Cost of control implementation

Reliability of key performance indicators (KPIs)

Reliability of key risk indicators (KPIs)

413. Which group has PRIMARY ownership of reputational risk stemming from unethical behavior within the organization?

Board of directors

Human resources (HR)

Risk management committee

Audit committee

414. An organization has decided to outsource a web application, and customer data will be stored in the vendor's public cloud.

To protect customer data, it is MOST important to ensure which of the following?

The organization's incident response procedures have been updated.

The vendor stores the data in the same jurisdiction.

Administrative access is only held by the vendor.

The vendor's responsibilities are defined in the contract.

415. Mapping open risk issues to an enterprise risk heat map BEST facilitates:

risk response.

control monitoring.

risk identification.

risk ownership.

416. Which of the following would BEST enable a risk practitioner to embed risk management within the organization?

Provide risk management feedback to key stakeholders.

Collect and analyze risk data for report generation.

Monitor and prioritize risk data according to the heat map.

Engage key stakeholders in risk management practices.

417. When developing a response plan to address security incidents regarding sensitive data loss, it is MOST important

revalidate current key risk indicators (KRIs).

revise risk management procedures.

review the data classification policy.

revalidate existing risk scenarios.

418. When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?

Results of benchmarking studies

Results of risk assessments

Number of emergency change requests

Maturity model

419. An IT control gap has been identified in a key process. Who would be the MOST appropriate owner of the risk associated with this gap?

Key control owner

Operational risk manager

Business process owner

Chief information security officer (CISO)

420. A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software.

Which of the following should be the risk practitioner’s IMMEDIATE concern?

Multiple corporate build images exist.

The process documentation was not updated.

The IT build process was not followed.

Threats are not being detected.

Page 43 of 48

421. Which of the following is MOST important when determining risk appetite?

Assessing regulatory requirements

Benchmarking against industry standards

Gaining management consensus

Identifying risk tolerance

422. Which of the following is the BEST way for a risk practitioner to help management prioritize risk response?

Align business objectives to the risk profile.

Assess risk against business objectives

Implement an organization-specific risk taxonomy.

Explain risk details to management.

423. Which of the following is the MOST important reason to communicate control effectiveness to senior management?

To demonstrate alignment with industry best practices

To assure management that control ownership is assigned

To ensure management understands the current risk status

To align risk management with strategic objectives

424. Which of the following should a risk practitioner do FIRST to support the implementation of governance around organizational assets within an enterprise risk management (ERM) program?

Develop a detailed risk profile.

Hire experienced and knowledgeable resources.

Schedule internal audits across the business.

Conduct risk assessments across the business.

425. Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findings.

What type of measure has been established?

Service level agreement (SLA)

Critical success factor (CSF)

Key risk indicator (KRI)

Key performance indicator (KPI)

426. A MAJOR advantage of using key risk indicators (KRIs) is that they:

Identify scenarios that exceed defined risk appetite.

Help with internal control assessments concerning risk appetite.

Assess risk scenarios that exceed defined thresholds.

Identify when risk exceeds defined thresholds.

427. Which of the following provides the MOST useful information to determine risk exposure following control implementations?

Strategic plan and risk management integration

Risk escalation and process for communication

Risk limits, thresholds, and indicators

Policies, standards, and procedures

428. The PRIMARY reason a risk practitioner would be interested in an internal audit report is to:

plan awareness programs for business managers.

evaluate maturity of the risk management process.

assist in the development of a risk profile.

maintain a risk register based on noncompliance.

429. Which of the following is the MOST important objective of embedding risk management practices into the initiation phase of the project management life cycle?

To deliver projects on time and on budget

To assess inherent risk

To include project risk in the enterprise-wide IT risk profit.

To assess risk throughout the project

430. Which of the following is the BEST key performance indicator (KPI) for determining how well an IT policy is aligned to business requirements?

Total cost to support the policy

Number of exceptions to the policy

Total cost of policy breaches

Number of inquiries regarding the policy

Page 44 of 48

431. Which of the following would require updates to an organization's IT risk register?

Discovery of an ineffectively designed key IT control

Management review of key risk indicators (KRls)

Changes to the team responsible for maintaining the register

Completion of the latest internal audit

432. Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable information (PII)?

Business strategies and needs

Security features and support

Costs and benefits

Local laws and regulations

433. Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability management process?

Percentage of vulnerabilities remediated within the agreed service level

Number of vulnerabilities identified during the period

Number of vulnerabilities re-opened during the period

Percentage of vulnerabilities escalated to senior management

434. Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

To validate the quality of defined deliverables for the program

To detect increases in program costs

To ensure program risk events are mitigated in a timely manner

To provide timely reporting to the governance steering committee

435. Which of the following is the GREATEST concern associated with business end users developing their own applications on end user spreadsheets and database programs?

An IT project manager is not assigned to oversee development.

Controls are not applied to the applications.

There is a lack of technology recovery options.

The applications are not captured in the risk profile.

436. Of the following, who is BEST suited to assist a risk practitioner in developing a relevant set of risk scenarios?

Internal auditor

Asset owner

Finance manager

Control owner

437. The PRIMARY reason for tracking the status of risk mitigation plans is to ensure:

the proposed controls are implemented as scheduled.

security controls are tested prior to implementation.

compliance with corporate policies.

the risk response strategy has been decided.

438. In order to determining a risk is under-controlled the risk practitioner will need to

understand the risk tolerance

monitor and evaluate IT performance

identify risk management best practices

determine the sufficiency of the IT risk budget

439. A control owner responsible for the access management process has developed a machine learning model to automatically identify excessive access privileges.

What is the risk practitioner's BEST course of action?

Review the design of the machine learning model against control objectives.

Adopt the machine learning model as a replacement for current manual access reviews.

Ensure the model assists in meeting regulatory requirements for access controls.

Discourage the use of emerging technologies in key processes.

440. Which of the following is MOST important for a risk practitioner to ensure once a risk action plan has been completed?

The risk owner has validated outcomes.

The risk register has been updated.

The control objectives are mapped to risk objectives.

The requirements have been achieved.

Page 45 of 48

441. Which of the following is the GREATEST benefit of a three lines of defense structure?

An effective risk culture that empowers employees to report risk

Effective segregation of duties to prevent internal fraud

Clear accountability for risk management processes

Improved effectiveness and efficiency of business operations

442. Which of the following should be the MOST important consideration for senior management when developing a risk response strategy?

Cost of controls

Risk tolerance

Risk appetite

Probability definition

443. A risk practitioner is reporting on an increasing trend of ransomware attacks in the industry.

Which of the following information is MOST important to include to enable an informed response decision by key stakeholders?

Methods of attack progression

Losses incurred by industry peers

Most recent antivirus scan reports

Potential impact of events

444. Which of the following would be a risk practitioner'$ BEST recommendation to help ensure cyber risk is assessed and reflected in the enterprise-level risk profile?

Manage cyber risk according to the organization's risk management framework.

Define cyber roles and responsibilities across the organization

Conduct cyber risk awareness training tailored specifically for senior management

Implement a cyber risk program based on industry best practices

445. A risk practitioner is defining metrics for security threats that were not identified by antivirus software.

Which type of metric is being developed?

Key control indicator (KCI)

Key risk indicator (KRI)

Operational level agreement (OLA)

Service level agreement (SLA)

446. As pan of business continuity planning, which of the following is MOST important to include m a business impact analysis (BlA)?

An assessment of threats to the organization

An assessment of recovery scenarios

industry standard framework

Documentation of testing procedures

447. Which of the following BEST enables an organization to determine whether external emerging risk factors will impact the organization's risk profile?

Control identification and mitigation

Adoption of a compliance-based approach

Prevention and detection techniques

Scenario analysis and stress testing

448. After migrating a key financial system to a new provider, it was discovered that a developer could gain access to the production environment.

Which of the following is the BEST way to mitigate the risk in this situation?

Escalate the issue to the service provider.

Re-certify the application access controls.

Remove the developer's access.

Review the results of pre-migration testing.

449. The BEST way to test the operational effectiveness of a data backup procedure is to:

conduct an audit of files stored offsite.

interview employees to compare actual with expected procedures.

inspect a selection of audit trails and backup logs.

demonstrate a successful recovery from backup files.

450. Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators (KRIs)?

To monitor changes in the risk environment

To provide input to management for the adjustment of risk appetite

To monitor the accuracy of threshold levels in metrics

To obtain business buy-in for investment in risk mitigation measures

Page 46 of 48

451. Which of the following is MOST important for a risk practitioner to consider when determining the control requirements for data privacy arising from emerging technologies?

internal audit recommendations

Laws and regulations

Policies and procedures

Standards and frameworks

452. Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?

Percentage of high-risk vulnerabilities missed

Number of high-risk vulnerabilities outstanding

Defined thresholds for high-risk vulnerabilities

Percentage of high-risk vulnerabilities addressed

453. Which of the following should be the PRIMARY input when designing IT controls?

Benchmark of industry standards

Internal and external risk reports

Recommendations from IT risk experts

Outcome of control self-assessments

454. Which of the following should be included in a risk assessment report to BEST facilitate senior management's understanding of the results?

Benchmarking parameters likely to affect the results

Tools and techniques used by risk owners to perform the assessments

A risk heat map with a summary of risk identified and assessed

The possible impact of internal and external risk factors on the assessment results

455. Which of the following is the BEST way to ensure data is properly sanitized while in cloud storage?

Deleting the data from the file system

Cryptographically scrambling the data

Formatting the cloud storage at the block level

Degaussing the cloud storage media

456. Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth’’?

Average bandwidth usage

Peak bandwidth usage

Total bandwidth usage

Bandwidth used during business hours

457. When an organization's business continuity plan (BCP) states that it cannot afford to lose more than three hours of a critical application's data, the three hours is considered the application’s:

Maximum tolerable outage (MTO).

Recovery point objective (RPO).

Mean time to restore (MTTR).

Recovery time objective (RTO).

458. A risk practitioner is organizing a training session lo communicate risk assessment methodologies to ensure a consistent risk view within the organization.

Which of the following in the MOST important topic to cover in this training?

Applying risk appetite

Applying risk factors

Referencing risk event data

Understanding risk culture

459. Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?

Defining expectations in the enterprise risk policy

Increasing organizational resources to mitigate risks

Communicating external audit results

Avoiding risks that could materialize into substantial losses

460. Which of the following is the BEST way to determine the potential organizational impact of emerging privacy regulations?

Evaluate the security architecture maturity.

Map the new requirements to the existing control framework.

Charter a privacy steering committee.

Conduct a privacy impact assessment (PIA).

Page 47 of 48

461. An organization is developing a risk universe to create a holistic view of its overall risk profile.

Which of the following is the GREATEST barrier to achieving the initiative's objectives?

Lack of cross-functional risk assessment workshops within the organization

Lack of common understanding of the organization's risk culture

Lack of quantitative methods to aggregate the total risk exposure

Lack of an integrated risk management system to aggregate risk scenarios

462. Which of the following is MOST helpful when determining whether a system security control is effective?

Control standard operating procedures

Latest security assessment

Current security threat report

Updated risk register

463. Which of the following should be considered when selecting a risk response?

Risk scenarios analysis

Risk response costs

Risk factor awareness

Risk factor identification

464. After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:

record risk scenarios in the risk register for analysis.

validate the risk scenarios for business applicability.

reduce the number of risk scenarios to a manageable set.

perform a risk analysis on the risk scenarios.

465. A risk assessment has identified increased losses associated with an IT risk scenario. It is MOST important for the risk practitioner to:

update the risk rating.

reevaluate inherent risk.

develop new risk scenarios.

implement additional controls.

466. Which of the following is the BEST indicator of the effectiveness of a control?

Scope of the control coverage

The number of exceptions granted

Number of steps necessary to operate process

Number of control deviations detected

467. Which of the following can be interpreted from a single data point on a risk heat map?

Risk tolerance

Risk magnitude

Risk response

Risk appetite

468. To minimize the risk of a potential acquisition being exposed externally, an organization has selected a few key employees to be engaged in the due diligence process. A member of the due diligence team realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired.

What is the BEST course of action for this team member?

Enforce segregation of duties.

Disclose potential conflicts of interest.

Delegate responsibilities involving the acquaintance.

Notify the subsidiary's legal team.

469. Which of the following is the BEST indicator of the effectiveness of a control monitoring program?

Time between control failure and failure detection

Number of key controls as a percentage of total control count

Time spent on internal control assessment reviews

Number of internal control failures within the measurement period

470. Which of the following is MOST important to ensure risk management practices are effective at all levels within the organization?

Communicating risk awareness materials regularly

Establishing key risk indicators (KRIs) to monitor risk management processes

Ensuring that business activities minimize inherent risk

Embedding risk management in business activities

Page 48 of 48

471. An internally developed payroll application leverages Platform as a Service (PaaS) infrastructure from the cloud.

Who owns the related data confidentiality risk?

IT infrastructure head

Human resources head

Supplier management head

Application development head

472. Which of the following is MOST important to determine as a result of a risk assessment?

Risk appetite statement

Risk response options

Risk tolerance levels

Process ownership

473. Which of the following BEST enables senior management lo compare the ratings of risk scenarios?

Key risk indicators (KRIs)

Key performance indicators (KPIs)

Control self-assessment (CSA)

Risk heat map

474. Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Providing assurance of control effectiveness

Implementing internal controls

Monitoring risk responses

Applying risk treatments

475. Which of the following is the BEST indication that an organization's risk management program has not reached the desired maturity level?

Significant increases in risk mitigation budgets

Large fluctuations in risk ratings between assessments

A steady increase in the time to recover from incidents

A large number of control exceptions

TAGS:

CRISC, CRISC exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Get CRISC Dumps Full Version

Q&As: 1590
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

CRISC Exam Dumps – Reliable Way to Pass and Get Certified

Related

Posts

Prepare NIST-COBIT-2019 Exam with Using NIST-COBIT-2019 Dump Questions

Pass CCAK Exam to Get ISACA Certification

CGEIT Exam Dumps – Reliable Way to Pass and Get Certified

Pass Cybersecurity Audit Certificate Exam to Get ISACA Certification

About Us

EMAIL

Services

Opening Hours