[Jan-2022] Latest ISACA CRISC exam dumps and online Test Engine
ISACA CRISC: Selling Isaca Certificaton Products and Solutions
For more info visit:
An A-list certification exam like the ISACA CRISC has a lot in store for its brave challengers. If you identify yourself as part of this daring crowd, you should pursue this certification by preparing diligently. It’s the first rule to keep in mind when beginning your venture as an ISACA candidate. So, in this post, you’ll learn the process of elimination when dealing with CRISC exam prep resources.
How to study the CRISC Exam
ExamsReviews expert team recommends you to prepare some notes on these topics along with it don’t forget to practice ISACA CRISC Exam dumps which been written by our expert team, Both these will help you a lot to clear this exam with good marks.
NEW QUESTION 334
You are the project manager of the PFO project. You are working with your project team members and two subject matter experts to assess the identified risk events in the project. Which of the following approaches is the best to assess the risk events in the project?
- A. Probability and Impact Matrix
- B. Root cause analysis
- C. Interviews or meetings
- D. Determination of the true cost of the risk event
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Risk probability and assessment is completed through interviews and meetings with the participants that are most familiar with the risk events, the project work, or have other information that can help determine the affect of the risk.
Incorrect Answers:
B: The true cost of the risk event is not a qualitative risk assessment approach. It is often done during the quantitative risk analysis process.
C: The probability and impact matrix is a tool and technique to prioritize the risk events, but it's not the best answer for assessing risk events within the project.
D: Root cause analysis is a risk identification technique, not a qualitative assessment tool.
NEW QUESTION 335
Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?
- A. Increase the frequency of incident reporting.
- B. Purchase cyber insurance from a third party.
- C. Conduct a control assessment.
- D. Enhance the security awareness program.
Answer: C
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 336
Which of the following BEST enables the identification of trends in risk levels?
- A. Qualitative definitions for key risk indicators (KRIs) are used.
- B. Measurements for key risk indicators (KRIs) are repeatable
- C. Quantitative measurements are used for key risk indicators (KRIs).
- D. Correlation between risk levels and key risk indicators (KRIs) is positive.
Answer: C
NEW QUESTION 337
Which of the following is the BEST method for discovering high-impact risk types?
- A. Explanation:
Failure modes and effects analysis is used in discovering high-impact risk types. FMEA: Is one of the tools used within the Six Sigma methodology to design and implement a robust process to: Identify failure modes Establish a risk priority so that corrective actions can be put in place to address and reduce the risk Helps in identifying and documenting where in the process the source of the failure impacts the (internal or external) customer Is used to determine failure modes and assess risk posed by the process and thus, to theenterprise as a whole' - B. Failure modes and effects analysis
- C. Delphi technique
- D. Qualitative risk analysis
- E. Quantitative risk analysis
Answer: B
Explanation:
and A are incorrect. These two are the methods of analyzing risk, but not specifically for high-impact risk types. Hence is not the best answer. Answer: B is incorrect. Delphi is a technique to identify potential risk. In this technique, the responses are gathered via aquestion:and their inputs are organized according to their contents. The collected responses are sent back to these experts for further input, addition, and comments. The final list of risks in the project is prepared after that. The participants in this technique are anonymous and therefore it helps prevent a person from unduly influencing the others in the group. The Delphi technique helps in reaching the consensus quickly.
NEW QUESTION 338
For the first time, the procurement department has requested that IT grant remote access to third-party suppliers. Which of the following is the BEST course of action for IT in responding to the request?
- A. Propose a solution after analyzing IT risk
- B. Adequate internal standards to fit the new business case
- C. Design and implement key authentication controls
- D. Design and implement a secure remote access process
Answer: A
Explanation:
Section: Volume D
NEW QUESTION 339
You are working in an enterprise. Your enterprise owned various risks. Which among the following is MOST likely to own the risk to an information system that supports a critical business process?
- A. System users
- B. Risk management department
- C. Senior management
- D. IT director
Answer: C
Explanation:
Section: Volume C
Explanation:
Senior management is responsible for the acceptance and mitigation of all risk. Hence they will also own the risk to an information system that supports a critical business process.
Incorrect Answers:
A: The system users are responsible for utilizing the system properly and following procedures, but they do not own the risk.
C: The IT director manages the IT systems on behalf of the business owners.
D: The risk management department determines and reports on level of risk, but does not own the risk. Risk is owned by senior management.
NEW QUESTION 340
Which of the following statements is NOT true regarding the risk management plan?
- A. The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.
- B. The risk management plan is an output of the Plan Risk Management process.
- C. The risk management plan includes a description of the risk responses and triggers.
- D. The risk management plan is an input to all the remaining risk-planning processes.
Answer: C
Explanation:
Section: Volume C
Explanation:
The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. The risk management plan does not include responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.
Incorrect Answers:
A, B, D: These all statements are true for risk management plan. The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. It includes thresholds, scoring and interpretation methods, responsible parties, and budgets. It also acts as input to all the remaining risk-planning processes.
NEW QUESTION 341
Which of the following is the MOST important component in a risk treatment plan?
- A. Treatment plan justification
- B. Target completion date
- C. Technical details
- D. Treatment plan ownership
Answer: A
NEW QUESTION 342
A teaming agreement is an example of what type of risk response?
- A. Mitigation
- B. Acceptance
- C. Transfer
- D. Share
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Teaming agreements are often comes under sharing risk response, as they involves joint ventures to realize an opportunity that an organization would not be able to seize otherwise.
Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.
Incorrect Answers:
A: Acceptance is a risk response that is appropriate for positive or negative risk events. It does not pursue the risk, but documents the event and allows the risk to happen. Often acceptance is used for low probability and low impact risk events.
B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together.
C: Transference is a negative risk response where the project manager hires a third party to own the risk event.
NEW QUESTION 343
Which of the following are true for threats?
Each correct answer represents a complete solution. Choose three.
- A. They can result in risks from external sources
- B. They are real
- C. They are possibility
- D. They can become more imminent as time goes by, or it can diminish
- E. They will arise and stay in place until they are properly dealt.
Answer: A,B,D
Explanation:
Explanation/Reference:
Explanation:
Threat is an act of coercion wherein an act is proposed to elicit a negative response. Threats are real, while the vulnerabilities are a possibility. They can result in risks from external sources, and can become imminent by time or can diminish.
Incorrect Answers:
C, E: These two are true for vulnerability, but not threat. Unlike the threat, vulnerabilities are possibility and can result in risks from internal sources. They will arise and stay in place until they are properly dealt.
NEW QUESTION 344
Which of the following is the MOST important consideration when performing a risk assessment of a fire suppression system within a data center?
- A. Maintenance procedures
- B. Installation manuals
- C. Insurance coverage
- D. Onsite replacement availability
Answer: A
NEW QUESTION 345
Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?
- A. Cost of testing the business continuity plan
- B. Cost of downtime due to a disaster
- C. Response time of the emergency action plan
- D. Cost of offsite backup premises
Answer: B
NEW QUESTION 346
Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?
- A. Explanation:
Sammy She certainly can create an assessment for a risk event for time cost, and scope. It is probable that a risk event may have an effect on just one or more objectives so an assessment of the objective is acceptable. - B. Harry is correct, because the risk probability and impact considers all objectives of the project.
- C. Sammy is correct, because she is the project manager.
- D. Sammy is correct, because organizations can create risk scores for each objective of the project.
- E. Harry is correct, the risk probability and impact matrix is the only approach to risk assessment.
Answer: D
Explanation:
is incorrect. Just because Sammy is the project manager, it is not necessary that she is right. Answer:D is incorrect. Harry's reasoning is flawed as each objective can be reviewed for the risk's impact rather than the total project. Answer:C is incorrect. Harry is incorrect as there are multiple approaches to risk assessment for a project
NEW QUESTION 347
Which of the following BEST indicates the efficiency of a process for granting access privileges?
- A. Number and type of locked obsolete accounts
- B. Number of changes in access granted to users
- C. Average number of access privilege exceptions
- D. Average time to grant access privileges
Answer: C
NEW QUESTION 348
Which of the following steps ensure effective communication of the risk analysis results to relevant stakeholders? Each correct answer represents a complete solution. Choose three.
- A. The results should be reported in terms and formats that are useful to support business decisions
- B. Communicate the negative impacts of the events only, it needs more consideration
- C. Provide decision makers with an understanding of worst-case and most probable scenarios,due diligence exposures and significant reputation, legal or regulatory considerations
- D. Communicate the risk-return context clearly
Answer: A,C,D
Explanation:
Explanation/Reference:
Explanation:
The result of risk analysis process is being communicated to relevant stakeholders. The steps that are involved in communication are:
The results should be reported in terms and formats that are useful to support business decisions.
Coordinate additional risk analysis activity as required by decision makers, like report rejection and
scope adjustment
Communicate the risk-return context clearly, which include probabilities of loss and/or gain, ranges, and
confidence levels (if possible) that enable management to balance risk-return.
Identify the negative impacts of events that drive response decisions as well as positive impacts of
events that represent opportunities which should channel back into the strategy and objective setting process.
Provide decision makers with an understanding of worst-case and most probable scenarios, due
diligence exposures and significant reputation, legal or regulatory considerations.
Incorrect Answers:
C: Communicate the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process, for effective communication. Only negative impacts are not considered alone.
NEW QUESTION 349
You work as a project manager for BlueWell Inc. You have declined a proposed change request because of the risk associated with the proposed change request. Where should the declined change request be documented and stored?
- A. Project archives
- B. Project document updates
- C. Change request log
- D. Lessons learned
- E. Explanation:
The change request log records the status of all change requests, approved or declined. The change request log is used as an account for change requests and as a means of tracking their disposition on a current basis. The change request log develops a measure of consistency into the change management process. It encourages common inputs into the process and is a common estimation approach for all change requests. As the log is an important component of project requirements, it should be readily available to the project team members responsible for project delivery. It should be maintained in a file with read-only access to those who are not responsible for approving or disapproving project change requests.
Answer: C
Explanation:
is incorrect. Lessons learned are not the correct place to document the status of a declined, or approved, change request. Answer:B is incorrect. The project archive includes all project documentation and is created through the close project or phase process. It is not the best choice for this option D is incorrect. The project document updates is not the best choice for thisbe fleshed into the project documents, but the declined changes are part of the change request log.
NEW QUESTION 350
Establishing an organizational code of conduct is an example of which type of control?
- A. Preventive
- B. Directive
- C. Compensating
- D. Detective
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 351
While developing obscure risk scenarios, what are the requirements of the enterprise?
Each correct answer represents a part of the solution. Choose two.
- A. Have capability to cure the risk events
- B. Be in a position that it can observe anything going wrong
- C. Have sufficient number of analyst
- D. Have capability to recognize an observed event as something wrong
Answer: B,D
Explanation:
Section: Volume B
Explanation:
The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things:
* Visibility
* Recognition
* For the fulfillment of this task enterprise must:
* Be in a position that it can observe anything going wrong
* Have the capability to recognize an observed event as something wrong Incorrect Answers:
A, C: These are not the direct requirements for developing obscure risk scenarios, like curing risk events comes under process of risk management. Hence capability of curing risk event does not lay any impact on the process of development of risk scenarios.
NEW QUESTION 352
Which of the following is MOST important to the effectiveness of key performance indicators (KPIs)?
- A. Relevance
- B. Annual review
- C. Automation
- D. Management approval
Answer: D
NEW QUESTION 353
Which of the following is the PRIMARY reason to use key control indicators (KCIs) to evaluate control operating effectiveness?
- A. To identify control vulnerabilities
- B. To measure business exposure to risk
- C. To raise awareness of operational issues
- D. To monitor the achievement of set objectives
Answer: D
NEW QUESTION 354
Which of the following activities would BEST facilitate effective risk management throughout the organization?
- A. Conducting periodic risk assessments
- B. Performing a business impact analysis
- C. Reviewing risk-related process documentation
- D. Performing frequent audits
Answer: B
NEW QUESTION 355
You are the project manager of the QPS project. You and your project team have identified a pure risk. You along with the key stakeholders, decided to remove the pure risk from the project by changing the project plan altogether. What is a pure risk?
- A. It is a risk event that cannot be avoided because of the order of the work.
- B. is incorrect. The risk event created by the application of risk response is called
secondary risk. - C. It is a risk event that is generated due to errors or omission in the project work.
- D. It is a risk event that is created by the application of risk response.
- E. Explanation:
A pure risk has only a negative effect on the project. Pure risks are activities that are dangerous to complete and manage such as construction, electrical work, or manufacturing. It is a class of risk
in which loss is the only probable result and there is no positive result.
Pure risk is associated to the events that are outside the risk-taker's control. - F. It is a risk event that only has a negative side and not any positive result.
- G. is incorrect. This in not valid definition of pure risk.
Answer: F
Explanation:
is incorrect. A risk event that is generated due to errors or omission in the project work
is not necessarily pure risk.
NEW QUESTION 356
Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure?
- A. Cost-benefit analysis
- B. Relevance to the business process
- C. Comparison against best practice
- D. Regulatory compliance requirements
Answer: B
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 357
Which of the following observations would be GREATEST concern to a risk practitioner reviewing the implementation status of management action plans?
- A. Management has not completed an early mitigation milestone.
- B. Management has not begun the implementation.
- C. Management has not determined a final implementation date.
- D. Management has not secured resources for mitigation activities.
Answer: D
NEW QUESTION 358
What is MOST important for the risk practitioner to understand when creating an initial IT risk register?
- A. Organizational objectives
- B. IT objectives
- C. Control environment
- D. Enterprise architecture (EA)
Answer: A
NEW QUESTION 359
......
New 2022 CRISC Test Tutorial (Updated 930 Questions): https://www.examsreviews.com/CRISC-pass4sure-exam-review.html
Reliable CRISC Exam Tips Test Pdf Exam Material: https://drive.google.com/open?id=1jGfzhB5LWqXWsBpLWlE4yAgX7v_q-ufJ