Real Exam Questions CRISC Dumps Exam Questions in here [Sep-2021]
Get Latest Sep-2021 Conduct effective penetration tests using CRISC
NEW QUESTION 275
After mapping generic risk scenarios to organizational security policies, the NEXT course of action should be to:
- A. perform a risk analysis on the risk scenarios.
- B. validate the risk scenarios for business applicability.
- C. record risk scenarios in the risk register for analysis.
- D. reduce the number of risk scenarios to a manageable set.
Answer: B
NEW QUESTION 276
During a routine check, a system administrator identifies unusual activity indicating an intruder within a firewall. Which of the following controls has MOST likely been compromised?
- A. Data validation
- B. Authentication
- C. Data integrity
- D. Identification
Answer: B
NEW QUESTION 277
The design of procedures to prevent fraudulent transactions within an enterprise resource planning (ERP) system should be based on:
- A. stakeholder risk tolerance.
- B. the control environment.
- C. suppliers used by the organization.
- D. benchmarking criteria.
Answer: A
NEW QUESTION 278
What can be determined from the risk scenario chart?
- A. Relative positions on the risk map
- B. Capability of enterprise to implement
- C. Risk treatment options
- D. The multiple risk factors addressed by a chosen response
Answer: D
NEW QUESTION 279
You are the project manager of your enterprise. You have introduced an intrusion detection system for the control. You have identified a warning of violation of security policies of your enterprise. What type of control is an intrusion detection system (IDS)?
- A. Detective
- B. Corrective
- C. Recovery
- D. Preventative
Answer: A
Explanation:
Section: Volume C
Explanation:
An intrusion detection system (IDS) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPS for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies.
As IDS detects and gives warning when the violation of security policies of the enterprise occurs, it is a detective control.
Incorrect Answers:
B: These controls make effort to reduce the impact of a threat from problems discovered by detective controls.
As IDS only detects but not reduce the impact, hence it is not a corrective control.
C: As IDS only detects the problem when it occurs and not prior of its occurrence, it is not preventive control.
D: These controls make efforts to overcome the impact of the incident on the business, hence IDS is not a recovery control.
NEW QUESTION 280
Jeff works as a Project Manager for www.company.com Inc. He and his team members are involved in the identify risk process. Which of the following tools & techniques will Jeff use in the identify risk process?
Each correct answer represents a complete solution. (Choose three.)
- A. Documentation reviews
- B. Checklist analysis
- C. Information gathering technique
- D. Risk categorization
Answer: A,B,C
Explanation:
Explanation/Reference:
Explanation:
The various tools & techniques used in the identify risk process are as follows:
Documentation reviews
Information gathering technique
Checklist analysis
Assumption analysis
Diagramming techniques
SWOT analysis
Expert judgment
NEW QUESTION 281
You work as a project manager for BlueWell Inc. You have declined a proposed change request because of the risk associated with the proposed change request. Where should the declined change request be documented and stored?
- A. Lessons learned
- B. Project document updates
- C. Project archives
- D. Change request log
Answer: D
Explanation:
Section: Volume B
Explanation:
The change request log records the status of all change requests, approved or declined.
The change request log is used as an account for change requests and as a means of tracking their disposition on a current basis. The change request log develops a measure of consistency into the change management process. It encourages common inputs into the process and is a common estimation approach for all change requests. As the log is an important component of project requirements, it should be readily available to the project team members responsible for project delivery. It should be maintained in a file with read-only access to those who are not responsible for approving or disapproving project change requests.
Incorrect Answers:
B: The project archive includes all project documentation and is created through the close project or phase process. It is not the best choice for this option.
C: Lessons learned are not the correct place to document the status of a declined, or approved, change request.
D: The project document updates is not the best choice for this question. It can be placed into the project documents, but the declined changes are part of the change request log.
NEW QUESTION 282
Which of the following issues should be of GREATEST concern when evaluating existing controls during a risk assessment?
- A. Successive assessments have the same recurring vulnerabilities.
- B. Asset custodians are responsible for defining controls instead of asset owners.
- C. Redundant compensating controls are in place.
- D. A high number of approved exceptions exist with compensating controls.
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 283
Which of the following should be a risk practitioner's NEXT step upon learning the organization is not in compliance with a specific legal regulation?
- A. Notify senior compliance executives of the associated risk.
- B. Assess the likelihood and magnitude of the associated risk.
- C. Determine the penalties for lack of compliance.
- D. Identify mitigation activities and compensating controls.
Answer: B
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 284
You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk the response adopted is re-architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?
- A. Business case to be made
- B. Contagious risk
- C. Explanation:
This is categorized as a Business case to be made because the project cost is very large. The response to be implemented requires quite large investment. Therefore it comes under business case to be made. - D. Quick win
- E. Deferrals
Answer: A
Explanation:
is incorrect. Quick win is very effective and efficient response that addresses medium to high risk. But in this the response does not require large investments. Answer: A is incorrect. It addresses costly risk response to a low risk. But here the response is less costly than that of business case to be made. Answer: D is incorrect. This is not risk response prioritization option, instead it is a type of risk that happen with the several of the enterprise's business partners within a very short time frame.
NEW QUESTION 285
Which of the following BEST contributes to the implementation of an effective risk response action plan?
- A. An IT tactical plan
- B. A business impact analysis
- C. Disaster recovery and continuity testing
- D. Assigned roles and responsibilities
Answer: D
NEW QUESTION 286
You are the risk official of your enterprise. Your enterprise takes important decisions without considering risk credential information and is also unaware of external requirements for risk management and integration with enterprise risk management. In which of the following risk management capability maturity levels does your enterprise exists?
- A. Level 4
- B. Level 1
- C. Level 5
- D. Level 0
Answer: D
Explanation:
Explanation/Reference:
Explanation:
0 nonexistent: An enterprise's risk management capability maturity level is 0 when:
The enterprise does not recognize the need to consider the risk management or the business impact
from IT risk.
Decisions involving risk lack credible information.
Awareness of external requirements for risk management and integration with enterprise risk
management (ERM) do not exists.
Incorrect Answers:
A, C, D: These all are much higher levels of the risk management capability maturity model and in all these enterprises do take decisions considering the risk credential information. Moreover, in these levels enterprise is aware of external requirements for risk management and integrate with ERM.
NEW QUESTION 287
Numerous media reports indicate a recently discovered technical vulnerability is being actively exploited. Which of the following would be the BEST response to this scenario?
- A. Assess the vulnerability management process.
- B. Conduct a vulnerability assessment.
- C. Reassess the inherent risk of the target.
- D. Conduct a control serf-assessment.
Answer: B
NEW QUESTION 288
A trusted third party service provider has determined that the risk of a client's systems being hacked is low.
Which of the following would be the client's BEST course of action?
- A. Perform their own risk assessment
- B. Implement additional controls to address the risk.
- C. Perform an independent audit of the third party.
- D. Accept the risk based on the third party's risk assessment
Answer: D
NEW QUESTION 289
The MOST effective way to increase the likelihood that risk responses will be implemented is to:
- A. create an action plan
- B. perform regular audits.
- C. review progress reports
- D. assign ownership
Answer: D
NEW QUESTION 290
Whether the results of risk analyses should be presented in quantitative or qualitative terms should be based PRIMARILY on the:
- A. specific risk analysis framework being used.
- B. requirements of management.
- C. results of the risk assessment.
- D. organizational risk tolerance
Answer: B
NEW QUESTION 291
What are the two MAJOR factors to be considered while deciding risk appetite level? Each correct answer represents a part of the solution. Choose two.
- A. Alignment with risk-culture
- B. Risk-aware decisions
- C. The capacity of the enterprise's objective to absorb loss.
- D. The amount of loss the enterprise wants to accept
Answer: C,D
Explanation:
Explanation/Reference:
Explanation:
Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission.
This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the following two major factors should be taken into account:
The enterprise's objective capacity to absorb loss, e.g., financial loss, reputation damage, etc.
The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the enterprise wants to accept in pursue of its objective fulfillment.
Incorrect Answers:
B: Alignment with risk-culture is also one of the factors but is not as important as these two.
C: Risk aware decision is not the factor, but is the result which uses risk appetite information as its input.
NEW QUESTION 292
Which of the following actions assures management that the organization's objectives are protected from the occurrence of risk events?
- A. Hedging
- B. Risk management
- C. Internal control
- D. Risk assessment
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Internal controls are the actions taken by the organization to help to assure management that the organization's objectives are protected from the occurrence of risk events. Internal control objectives are applicable to all manual or automated areas. Internal control objectives include:
Internal accounting controls- They control accounting operations, including safeguarding assets and
financial records.
Operational controls- They focus on day-to-day operations, functions, and activities. They ensure that
all the organization's objectives are being accomplished.
Administrative controls- They focus on operational efficiency in a functional area and stick to
management policies.
Incorrect Answers:
B: Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources. It is done to minimize, monitor, and control the probability and impact of unfortunate events or to maximize the realization of opportunities.
C: Hedging is the process of managing the risk of price changes in physical material by offsetting that risk in the futures market. In other words, it is the avoidance of risk. So, it only avoids risk but can not assure protection against risk.
D: Risk assessment is a process of analyzing the identified risk, both quantitatively and qualitatively.
Quantitative risk assessment requires calculations of two components of risk, the magnitude of the potential loss, and the probability that the loss will occur. While qualitatively risk assessment checks the severity of risk. The assessment attempts to determine the likelihood of the risk being realized and the impact of the risk on the operation. This provides several conclusions:
Probability-establishing the likelihood of occurrence and reoccurrence of specific risks, independently
and combined.
Interdependencies-the relationship between different types of risk. For instance, one risk may have
greater potential of occurring if another risk has occurred. Or probability or impact of a situation may increase with combined risk.
NEW QUESTION 293
......
Authentic Best resources for CRISC Online Practice Exam: https://www.dumpstests.com/CRISC-latest-test-dumps.html
Get the superior quality CRISC Dumps with explanations waiting just for you, get it now: https://drive.google.com/open?id=1MoKCOSvbFFdMFne13bg9EhhqShgo24XB