.png)
CRISC Practice Questions
Certified in Risk and Information Systems Control
Last Update 3 days ago
Total Questions : 1938
Dive into our fully updated and stable CRISC practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.
Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CRISC. Use this test to pinpoint which areas you need to focus your study on.
Which of the following BEST enables risk-based decision making in support of a business continuity plan (BCP)?
Which of the following BEST mitigates the risk of violating privacy laws when transferring personal information lo a supplier?
Whether the results of risk analyses should be presented in quantitative or qualitative terms should be based PRIMARILY on the:
A business is conducting a proof of concept on a vendor's Al technology. Which of the following is the MOST important consideration for managing risk?
A business unit has implemented robotic process automation (RPA) for its
repetitive back-office tasks. Which of the following should be the risk
practitioner's GREATEST concern?
Which of the following BEST provides an early warning that network access of terminated employees is not being revoked in accordance with the service level agreement (SLA)?
An insurance company handling sensitive and personal information from its customers receives a large volume of telephone requests and electronic communications daily. Which of the following
is MOST important to include in a risk awareness training session for the customer service department?
After migrating a key financial system to a new provider, it was discovered that a developer could gain access to the production environment. Which of the following is the BEST way to mitigate the risk in this situation?
A risk practitioner has recently become aware of unauthorized use of confidential personal information within the organization. Which of the following should the risk practitioner do FIRST?
Where should a risk practitioner document the current state and desired future state of organizational risk?
A company has recently acquired a customer relationship management (CRM) application from a certified software vendor. Which of the following will BE ST help lo prevent technical vulnerabilities from being exploded?
Which of the following deficiencies identified during a review of an organization's cybersecurity policy should be of MOST concern?
The PRIMARY benefit of using a maturity model is that it helps to evaluate the:
The GREATEST benefit of including low-probability, high-impact events in a risk assessment is the ability to:
Analyzing trends in key control indicators (KCIs) BEST enables a risk practitioner to proactively identify impacts on an organization's:
A new software package that could help mitigate risk in an organization has become available. Which of the following is the risk practitioner's BEST course of action?
Which organizational role should be accountable for ensuring information assets are appropriately classified?
An IT control gap has been identified in a key process. Who would be the MOST appropriate owner of the risk associated with this gap?
Which of the following will BEST help to ensure implementation of corrective action plans?
Of the following, who is responsible for approval when a change in an application system is ready for release to production?
Which of the following risk impacts should be the PRIMARY consideration for determining recovery priorities in a disaster recovery situation?
A risk owner has identified a risk with high impact and very low likelihood. The potential loss is covered by insurance. Which of the following should the risk practitioner do NEXT?
An organization operates in an environment where reduced time-to-market for new software products is a top business priority. Which of the following should be the risk practitioner's GREATEST concern?
When assessing the maturity level of an organization’s risk management framework, which of the following should be of GREATEST concern to a risk practitioner?
Which of the following BEST indicates that risk management is embedded into the responsibilities of all employees?
What is the PRIMARY role of the application owner when changes are being introduced into an existing environment?
Which of the following changes would be reflected in an organization's risk profile after the failure of a critical patch implementation?
Which of the following is MOST important for the organization to consider before implementing a new in-house developed artificial intelligence (Al) solution?
What is the MOST important consideration when aligning IT risk management with the enterprise risk management (ERM) framework?
A new regulator/ requirement imposes severe fines for data leakage involving customers' personally identifiable information (Pll). The risk practitioner has recommended avoiding the risk. Which of the following actions would BEST align with this recommendation?
An organization's IT infrastructure is running end-of-life software that is not allowed without exception approval. Which of the following would provide the MOST helpful information to justify investing in updated software?
Which of the following is MOST important to determine as a result of a risk assessment?
Which of the following criteria associated with key risk indicators (KRIs) BEST enables effective risk monitoring?
Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?
Which of the following is the MOST important key risk indicator (KRI) to protect personal information on corporate mobile endpoints?
After a risk has been identified, who is in the BEST position to select the appropriate risk treatment option?
Which of the following provides the MOST useful information when determining if a specific control should be implemented?
Which of the following is the BEST key control indicator (KCI) for a vulnerability management program?
An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk practitioner do FIRST?
The BEST indication that risk management is effective is when risk has been reduced to meet:
Which of the following is necessary to enable an IT risk register to be consolidated with the rest of the organization’s risk register?
A key performance indicator (KPI) has been established to monitor the number of software changes that fail and must be re-implemented. An increase in the KPI indicates an ineffective:
The risk associated with an asset after controls are applied can be expressed as:
An organization is reviewing a contract for a Software as a Service (SaaS) sales application with a 99.9% uptime service level agreement (SLA). Which of the following BEST describes ownership of availability risk?
In order to efficiently execute a risk response action plan, it is MOST important for the emergency response team members to understand:
Which of the following helps ensure compliance with a nonrepudiation policy requirement for electronic transactions?
