.png)
CRISC Practice Questions
Certified in Risk and Information Systems Control
Last Update 3 days ago
Total Questions : 1938
Dive into our fully updated and stable CRISC practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.
Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CRISC. Use this test to pinpoint which areas you need to focus your study on.
An internal audit report reveals that a legacy system is no longer supported Which of the following is the risk practitioner's MOST important action before recommending a risk response'
An organization is considering allowing users to access company data from their personal devices. Which of the following is the MOST important factor when assessing the risk?
Which of the following risk scenarios would be the GREATEST concern as a result of a single sign-on implementation?
Which of the following will MOST likely change as a result of the decrease in risk appetite due to a new privacy regulation?
The MOST important reason to monitor key risk indicators (KRIs) is to help management:
Which of the following is the PRIMARY reason to ensure policies and standards are properly documented within the risk management process?
An organization has decided to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable. As a result of this decision, the risk associated with these new entries has been;
Which of The following BEST represents the desired risk posture for an organization?
During a routine check, a system administrator identifies unusual activity indicating an intruder within a firewall. Which of the following controls has MOST likely been compromised?
Which of the following should a risk practitioner do FIRST when an organization decides to use a cloud service?
Which of the following is a drawback in the use of quantitative risk analysis?
A risk assessment indicates the residual risk associated with a new bring your own device (BYOD) program is within organizational risk tolerance. Which of the following should the risk practitioner
recommend be done NEXT?
Which of the following is MOST important to consider when assessing the likelihood that a recently discovered software vulnerability will be exploited?
An organization has updated its acceptable use policy to mitigate the risk of employees disclosing confidential information. Which of the following is the BEST way to reinforce the effectiveness of this policy?
Which of the following is the MOST important consideration when developing an organization's risk taxonomy?
The PRIMARY reason for communicating risk assessment results to data owners is to enable the:
Which of the following is the BEST way to ensure data is properly sanitized while in cloud storage?
Which of the following should be the PRIMARY basis for establishing a priority sequence when restoring business processes after a disruption?
Which of the following is the MOST reliable validation of a new control?
An identified high probability risk scenario involving a critical, proprietary business function has an annualized cost of control higher than the annual loss expectancy. Which of the following is the BEST risk response?
While reviewing a contract of a cloud services vendor, it was discovered that the vendor refuses to accept liability for a sensitive data breach. Which of the following controls will BES reduce the risk associated with such a data breach?
Which of the following would provide the MOST objective assessment of the effectiveness of an organization's security controls?
Which of the following is the BEST way to reduce the likelihood of an individual performing a potentially harmful action as the result of unnecessary entitlement?
Which of the following should be the PRIMARY driver for the prioritization of risk responses?
Which of the following is MOST important when identifying an organization's risk exposure associated with Internet of Things (loT) devices?
Which of the following risk management practices BEST facilitates the incorporation of IT risk scenarios into the enterprise-wide risk register?
Which of the following is the PRIMARY benefit of implementing key control indicators (KCIs)?
Which of the following should be the FIRST consideration when a business unit wants to use personal information for a purpose other than for which it was originally collected?
During an internal IT audit, an active network account belonging to a former employee was identified. Which of the following is the BEST way to prevent future occurrences?
Which of the following roles is BEST suited to help a risk practitioner understand the impact of IT-related events on business objectives?
Which of the following BEST informs decision-makers about the value of a notice and consent control for the collection of personal information?
A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite. Which of the following is the risk practitioner's BEST course of action?
An organization is unable to implement a multi-factor authentication requirement until the next fiscal year due to budget constraints. Consequently, a policy exception must be submitted. Which of the following is MOST important to include in the analysis of the exception?
An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?
Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?
Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?
Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?
A risk assessment has been completed on an application and reported to the application owner. The report includes validated vulnerability findings that require mitigation. Which of the following should be the NEXT step?
When developing a business continuity plan (BCP), it is MOST important to:
Who is MOST important lo include in the assessment of existing IT risk scenarios?
A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the following should be done FIRST?
Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented. Which risk treatment has been selected?
The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of:
Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?
Which of the following would qualify as a key performance indicator (KPI)?
Which of the following is the PRIMARY role of the first line within the three lines model?
The FIRST step for a startup company when developing a disaster recovery plan (DRP) should be to identify:
