.png)
CRISC Practice Questions
Certified in Risk and Information Systems Control
Last Update 3 days ago
Total Questions : 1938
Dive into our fully updated and stable CRISC practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.
Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CRISC. Use this test to pinpoint which areas you need to focus your study on.
What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical legacy system?
Which of the following should be the PRIMARY focus of an independent review of a risk management process?
An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?
Which of the following is the GREATEST risk associated with an environment that lacks documentation of the architecture?
An organization's recovery team is attempting to recover critical data backups following a major flood in its data center. However, key team members do not know exactly what steps should be taken to address this crisis. Which of the following is the MOST likely cause of this situation?
An organization has outsourced its backup and recovery procedures to a cloud service provider. The provider's controls are inadequate for the organization's level of risk tolerance. As a result, the organization has internally implemented additional backup and recovery controls. Which risk response has been adopted?
Which of the following is MOST important for a risk practitioner to understand about an organization in order to create an effective risk
awareness program?
Which of the following should be the PRIMARY basis for prioritizing risk responses?
A control owner identifies that the organization's shared drive contains personally identifiable information (Pll) that can be accessed by all personnel. Which of the following is the MOST effective risk response?
Which of the following is the MOST important requirement for monitoring key risk indicators (KRls) using log analysis?
Which of the following approaches BEST identifies information systems control deficiencies?
An organization is making significant changes to an application. At what point should the application risk profile be updated?
Which of the following provides the BEST evidence that risk responses have been executed according to their risk action plans?
Which of the following provides the BEST level of assurance to an organization that its vendors' controls are effective?
The MOST essential content to include in an IT risk awareness program is how to:
An organization with a large number of applications wants to establish a security risk assessment program. Which of the following would provide the MOST useful information when determining the frequency of risk assessments?
Within the three lines of defense model, the PRIMARY responsibility for ensuring risk mitigation controls are properly configured belongs with:
A risk practitioner wants to identify potential risk events that affect the continuity of a critical business process. Which of the following should the risk practitioner do FIRST?
An organization has procured a managed hosting service and just discovered the location is likely to be flooded every 20 years. Of the following, who should be notified of this new information FIRST.
Which of the following controls would BEST mitigate the risk of user passwords being compromised by a man in the middle technique?
An organization is subject to a new regulation that requires nearly real-time recovery of its services following a disruption. Which of the following is the BEST way to manage the risk in this situation?
Which of the following is the PRIMARY reason to compare the business impact analysis (BIA) against the organization's business continuity plan (BCP)?
Which of The following should be of GREATEST concern for an organization considering the adoption of a bring your own device (BYOD) initiative?
When reviewing management's IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?
Which of the following should a risk practitioner recommend be done prior to disposal of server hardware containing confidential data?
Winch of the following is the BEST evidence of an effective risk treatment plan?
Following the implementation of an Internet of Things (loT) solution, a risk practitioner identifies new risk factors with impact to existing controls. Which of the following is MOST important to include in a report to stakeholders?
Which of the following BEST indicates effective information security incident management?
An organization is preparing to transfer a large number of customer service representatives to the sales department. Of the following, who is responsible for mitigating the risk associated with residual system access?
When reviewing a business continuity plan (BCP). which of the following would be the MOST significant deficiency?
A risk practitioner shares the results of a vulnerability assessment for a critical business application with the business manager. Which of the following is the NEXT step?
Which of the following IT key risk indicators (KRIs) provides management with the BEST feedback on IT capacity?
An organization has established a contract with a vendor that includes penalties for loss of availability. Which risk treatment has been adopted by the organization?
The MOST important consideration when selecting a control to mitigate an identified risk is whether:
Which of the following is the PRIMARY reason to use administrative controls in conjunction with technical controls?
Who should be responsible for implementing and maintaining security controls?
To ensure key risk indicators (KRIs) are effective and meaningful, the KRIs should be aligned to:
Which of the following is MOST important to ensure when continuously monitoring the performance of a client-facing application?
A recent vulnerability assessment of a web-facing application revealed several weaknesses. Which of the following should be done NEXT to determine the risk exposure?
The MOST effective way to increase the likelihood that risk responses will be implemented is to:
When of the following provides the MOST tenable evidence that a business process control is effective?
An organization has implemented a policy requiring staff members to take a minimum of five consecutive days' leave per year to mitigate the risk of malicious insider activities. Which of the following is the BEST key performance indicator (KPI) of the effectiveness of this policy?
Which of the following would BEST help identify the owner for each risk scenario in a risk register?
An organization is analyzing the risk of shadow IT usage. Which of the following is the MOST important input into the assessment?
Which of the following would MOST likely require a risk practitioner to update the risk register?
A risk practitioner is assisting with the preparation of a report on the organization s disaster recovery (DR) capabilities. Which information would have the MOST impact on the overall recovery profile?
A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which of the following is the risk practitioner's BEST course of action?
