CRISC Free Exam Questions & Answers PDF Updated on Apr-2023 [Q68-Q90]

13Apr 2023 by admin No Comments

4.7/5 - (3 votes)

CRISC Free Exam Questions and Answers PDF Updated on Apr-2023

Latest CRISC Exam Dumps Recently Updated 1014 Questions

NEW QUESTION 68
You are the project manager of GRT project. You discovered that by bringing on more qualified resources or by providing even better quality than originally planned, could result in reducing the amount of time required to complete the project. If your organization seizes this opportunity it would be an example of what risk response?

Enhance

Exploit

Explanation:
Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities forpositive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.

NEW QUESTION 69
A new international data privacy regulation requires personal data to be disposed after the specified retention period, which is different from the local regulatory requirement. Which of the following is the risk practitioner’s BEST recommendation to resolve the disparity?

Adopt the international standard.

Adopt the standard determined by legal counsel.

Adopt the local standard.

Adopt the least stringent standard determined by the risk committee.

NEW QUESTION 70
Wendy is about to perform qualitative risk analysis on the identified risks within her project. Which one of the following will NOT help Wendy to perform this project management activity?

Risk management plan

Project scope statement

Risk register

Stakeholder register

Explanation:
The stakeholder register is not an input to the qualitative risk analysis process. The four inputs are
the risk register, risk management plan, project scope statement, and organizational process
assets.

is incorrect. The risk register can help Wendy to perform qualitative risk analysis.

is incorrect. The project scope statement is needed to help with qualitative risk analysis.

NEW QUESTION 71
An organization has been notified that a dis grunted, terminated IT administrator has tried to break into the corporate network. Which of the following discoveries should be of GREATEST concern to the organization?

A brute force attack has been detected

An external vulnerability scan has been detected

An increase in support request has been observed

Authentication logs have been disabled

NEW QUESTION 72
Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes’ impact on the features and functions of the project’s product?

Cost change control system

Configuration management system

Scope change control system

Integrated change control

NEW QUESTION 73
You work as a project manager for BlueWell Inc. You have declined a proposed change request because of the risk associated with the proposed change request. Where should the declined change request be documented and stored?

Change request log

Project archives

Lessons learned

Project document updates

NEW QUESTION 74
When of the following provides the MOST tenable evidence that a business process control is effective?

Demonstration that the control is operating as designed

A successful walk-through of the associated risk assessment

Management attestation that the control is operating effectively

Automated data indicating that risk has been reduced

NEW QUESTION 75
Which of the following is NOT true for risk governance?

Risk governance is based on the principles of cooperation, participation, mitigation and sustainability, and is adopted to achieve more effective risk management.

Risk governance requires reporting once a year.

Risk governance seeks to reduce risk exposure and vulnerability by filling gaps in risk policy.

Risk governance is a systemic approach to decision making processes associated to natural and technological risks.

NEW QUESTION 76
Which of the following is an acceptable method for handling positive project risk?

Exploit

Avoid

Mitigate

Transfer

NEW QUESTION 77
Which of the following controls will BEST detect unauthorized modification of data by a database administrator?

Reviewing database access rights

Reviewing changes to edit checks

Comparing data to input records

Reviewing database activity logs

NEW QUESTION 78
A global organization is planning to collect customer behavior data through social media advertising. Which of the following is the MOST important business risk to be considered?

Regulatory requirements may differ in each country.

Data sampling may be impacted by various industry restrictions.

Business advertising will need to be tailored by country.

The data analysis may be ineffective in achieving objectives.

NEW QUESTION 79
Which of the following should be done FIRST when information is no longer required to support business objectives?

Archive the information to a backup database.

Protect the information according to the classification policy.

Assess the information against the retention policy.

Securely and permanently erase the information

NEW QUESTION 80
You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?

Project network diagrams

Cause-and-effect analysis

Decision tree analysis

Delphi Technique

NEW QUESTION 81
You are the project manager of HJT project. Important confidential files of your project are stored on a computer. Keeping the unauthorized access of this computer in mind, you have placed a hidden CCTV in the room, even on having protection password. Which kind of control CCTV is?

Technical control

Physical control

Administrative control

Management control

Explanation:
CCTV is a physical control. Physical controls protect the physical environment. They include basics such as locks to protect access to secure areas. They also include environmental controls. This section presents the following examples of physical controls: Locked doors, guards, access logs, and closed-circuit television Fire detection and suppression Temperature and humidity detection Electrical grounding and circuit breakers Water detection

NEW QUESTION 82
Which of the following issues should be of GREATEST concern when evaluating existing controls during a risk assessment?

Redundant compensating controls are in place.

Asset custodians are responsible for defining controls instead of asset owners.

A high number of approved exceptions exist with compensating controls.

Successive assessments have the same recurring vulnerabilities.

NEW QUESTION 83
Which of the following is MOST important to have in place to ensure the effectiveness of risk and security metrics reporting?

Organizational reporting process

Incident reporting procedures

Regularly scheduled audits

Incident management policy

NEW QUESTION 84
As part of an overall IT risk management plan, an IT risk register BEST helps management:

stay current with existing control status

align IT processes with business objectives

understand the organizational risk profile

communicate the enterprise risk management policy

NEW QUESTION 85
Which of the following is MOST important to sustainable development of secure IT services?

Security training for systems development staff

Well-documented business cases

Security architecture principles

Secure coding practices

NEW QUESTION 86
During a risk assessment, the risk practitioner finds a new risk scenario without controls has been entered into the risk register. Which of the following is the MOST appropriate action?

Include the new risk scenario in the current risk assessment.

Postpone the risk assessment until controls are identified.

Request the risk scenario be removed from the register.

Exclude the new risk scenario from the current risk assessment

NEW QUESTION 87
A teaming agreement is an example of what type of risk response?

Acceptance

Mitigation

Transfer

NEW QUESTION 88
Risk management strategies are PRIMARILY adopted to:

achieve compliance with legal requirements

take necessary precautions for claims and losses

avoid risk for business and IT assets

achieve acceptable residual risk levels

NEW QUESTION 89
Which of the following activities would BEST contribute to promoting an organization-wide risk-aware culture?

Communicating components of risk and their acceptable levels

Performing a benchmark analysis and evaluating gaps

Participating in peer reviews and implementing best practices

Conducting risk assessments and implementing controls

NEW QUESTION 90
Who should be accountable for ensuring effective cybersecurity controls are established?

Security management function

Enterprise risk function

Risk owner

IT management

ISACA CRISC Exam Certification Details:

Duration	240 mins
Number of Questions	150
Exam Price ISACA Member	$575 (USD)
Books / Training	Virtual Instructor-Led Training In-Person Training & Conferences Customized, On-Site Corporate Training CRISC Planning Guide
Passing Score	450/800
Exam Name	ISACA Certified in Risk and Information Systems Control (CRISC)
Exam Code	CRISC
Sample Questions	ISACA CRISC Sample Questions

ISACA CRISC Real 2023 Braindumps Mock Exam Dumps: https://www.practicematerial.com/CRISC-exam-materials.html

ISACA CRISC Exam Certification Details:

Leave a Reply Cancel reply