.png)
CRISC Practice Questions
Certified in Risk and Information Systems Control
Last Update 3 days ago
Total Questions : 1938
Dive into our fully updated and stable CRISC practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.
Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CRISC. Use this test to pinpoint which areas you need to focus your study on.
Which of the following is MOST important to the effectiveness of a senior oversight committee for risk monitoring?
Which of the following is a risk practitioner's BEST recommendation upon learning that an employee inadvertently disclosed sensitive data to a vendor?
Which of the following activities BEST facilitates effective risk management throughout the organization?
Which of the following is MOST helpful to understand the consequences of an IT risk event?
Which of the following is the PRIMARY reason for an organization to include an acceptable use banner when users log in?
While reviewing the risk register, a risk practitioner notices that different business units have significant variances in inherent risk for the same risk scenario. Which of the following is the BEST course of action?
The PRIMARY objective of testing the effectiveness of a new control before implementation is to:
An organization's risk practitioner learns a new third-party system on the corporate network has introduced vulnerabilities that could compromise corporate IT systems. What should the risk practitioner do
FIRST?
Which of the following s MOST likely to deter an employee from engaging in inappropriate use of company owned IT systems?
Which of the following is the MOST important reason to communicate control effectiveness to senior management?
Which of the following is the PRIMARY benefit of integrating risk and security requirements in an organization's enterprise architecture (EA)?
The head of a business operations department asks to review the entire IT risk register. Which of the following would be the risk manager s BEST approach to this request before sharing the register?
Which of the following is the BEST indication that an organization's risk management program has not reached the desired maturity level?
The effectiveness of a control has decreased. What is the MOST likely effect on the associated risk?
To enable effective risk governance, it is MOST important for senior management to:
Which of the following should be the PRIMARY consideration when prioritizing limited resources needed to implement overdue corrective actions arising from a recent internal audit?
The PRIMARY benefit of classifying information assets is that it helps to:
A risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet. What should be the risk practitioner's FIRST course of action?
Who is MOST likely to be responsible for the coordination between the IT risk strategy and the business risk strategy?
After several security incidents resulting in significant financial losses, IT management has decided to outsource the security function to a third party that provides 24/7 security operation services. Which risk response option has management implemented?
The use of multi-factor authentication (MFA) when applied to an FTP connection is an example of which type of control category?
A robotic process automation (RPA) project has implemented new robots to enhance the efficiency of a sales business process. Which of the following provides the BEST evidence that the new controls have been implemented successfully?
Which of the following BEST enables an organization to address new risk associated with an Internet of Things (IoT) solution?
A risk action plan has been changed during the risk mitigation effort. Which of the following is MOST important for the risk practitioner to verify?
A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption. Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?
Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable information (Pll)?
An organization has decided to commit to a business activity with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner's MOST important action related to this decision?
An organization wants to transfer risk by purchasing cyber insurance. Which of the following would be MOST important for the risk practitioner to communicate to senior management for contract negotiation purposes?
Which of the following has the GREATEST impact on ensuring the alignment of the risk profile with business objectives?
Which of the following is a specific concern related to machine learning algorithms?
An organization mandates the escalation of a service ticket when a key application is offline for 5 minutes or more due to potential risk exposure. The risk practitioner has been asked by management to prepare a report of application offline times using both 3- and 5-minute thresholds. What does the 3-minute threshold represent?
Which of the following emerging technologies is frequently used for botnet distributed denial of service (DDoS) attacks?
A risk practitioner is reporting on an increasing trend of ransomware attacks in the industry. Which of the following information is MOST important to include to enable an informed response decision by key stakeholders?
Which of the following would BEST enable a risk practitioner to embed risk management within the organization?
An organization is outsourcing a key database to be hosted by an external service provider. Who is BEST suited to assess the impact of potential data loss?
Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?
Which of the following activities is MOST likely to be assigned to the second line in the three lines model?
An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?
A key risk indicator (KRI) threshold has reached the alert level, indicating data leakage incidents are highly probable. What should be the risk practitioner's FIRST course of action?
Which of the following would MOST likely cause management to unknowingly accept excessive risk?
A risk practitioner has been asked to advise management on developing a log collection and correlation strategy. Which of the following should be the MOST important consideration when developing this strategy?
A key performance indicator (KPI) has been established to monitor the number of software changes that fail and must be re-implemented. An increase in the KPI indicates an ineffective:
Which of the following will help ensure the elective decision-making of an IT risk management committee?
Which of the following is the MOST important consideration when establishing a recovery point objective (RPO)?
Which of the following is a risk practitioner's MOST important responsibility in managing risk acceptance that exceeds risk tolerance?
Which of the following provides the MOST useful information to senior management about risk mitigation status?
Which of the following is the PRIMARY benefit of consistently recording risk assessment results in the risk register?
