CRISC 6th Ed Self-Assessment -Solved 100% Correct
Which of the following business requirements BEST relates to the need for resilient
business and information systems processes?
A. Effectiveness
B. Confidentiality
C. Integrity
D. Availability - ANSWER-D. Availability relates to information being available when
required by the business process now and in the future.
Resilience is the ability to provide and maintain an acceptable level of service
during disasters or when facing operational challenges.
Which of the following statements BEST describes the value of a risk register?
A. It captures the risk inventory.
B. It drives the risk response plan.
C. It is a risk reporting tool.
D. It lists internal risk and external risk. - ANSWER-B. Risk registers serve as the
main reference for all risk-related information, supporting risk-related decisions
such as risk response activities and their prioritization.
Shortly after performing the annual review and revision of corporate policies, a risk
practitioner becomes aware that a new law may affect security requirements for the
human resources system. The risk practitioner should:
A. analyze in detail how the law may affect the enterprise.
B. ensure that necessary adjustments are implemented during the next review
cycle.
C. initiate an ad hoc revision of the corporate policy.
D. notify the system custodian to implement changes. - ANSWER-A. Assessing how
the law may affect the enterprise is the best course of action. The analysis must
also determine whether existing controls already address the new requirements.
An information system that processes weather forecasts for public consumption is
MOST likely to place its highest priority on:
A. nonrepudiation.
B. confidentiality.
C. integrity.
D. availability. - ANSWER-C. A system that delivers weather forecasts is likely to
place its highest priority on the integrity of the data. The risk practitioner should
keep in mind that whether a forecast turns out to be accurate in its prediction is
distinct from whether the data was accurately represented.
Which of the following choices provides the BEST view of risk management?
A. An interdisciplinary team
B. A third-party risk assessment service provider
, C. The enterprise's IT department
D. The enterprise's internal compliance department - ANSWER-A. Having an
interdisciplinary team contribute to risk management ensures that all areas are
adequately considered and included in the risk assessment processes to support an
enterprise view of risk.
Which of the following choices is a PRIMARY consideration when developing an IT
risk awareness program?
A. Why technology risk is owned by IT
B. How technology risk can impact each attendee's area of business
C. How business process owners can transfer technology risk
D. Why technology risk is more difficult to manage compared to other risk -
ANSWER-B. Stakeholders must understand how the IT-related risk impacts the
overall business.
It is MOST important that risk appetite is aligned with business objectives to ensure
that:
A. resources are directed toward areas of low risk tolerance.
B. major risk is identified and eliminated.
C. IT and business goals are aligned.
D. the risk strategy is adequately communicated. - ANSWER-A. Risk appetite is the
amount of risk that an enterprise is willing to take on in pursuit of value. Aligning it
with business objectives allows an enterprise to evaluate and deploy valuable
resources toward those objectives where the risk tolerance (for loss) is low.
Weak passwords and transmission over unprotected communication lines are
examples of:
A. vulnerabilities.
B. threats.
C. probabilities.
D. impacts. - ANSWER-A. Vulnerabilities represent characteristics of information
resources that may be exploited by a threat.
The MOST significant drawback of using quantitative risk analysis instead of
qualitative risk analysis is the:
A. lower objectivity.
B. greater reliance on expertise.
C. less management buy-in.
D. higher cost. - ANSWER-D. Quantitative risk analysis is generally more complex
and, therefore, more costly than qualitative risk analysis.
Risk scenarios are analyzed to determine:
A. strength of controls.
B. likelihood and impact.
C. current risk profile.
D. scenario root cause. - ANSWER-B. Risk scenarios are descriptions of events that
can lead to a business impact and are evaluated to determine the likelihood and
impact should the event occur.
Which of the following business requirements BEST relates to the need for resilient
business and information systems processes?
A. Effectiveness
B. Confidentiality
C. Integrity
D. Availability - ANSWER-D. Availability relates to information being available when
required by the business process now and in the future.
Resilience is the ability to provide and maintain an acceptable level of service
during disasters or when facing operational challenges.
Which of the following statements BEST describes the value of a risk register?
A. It captures the risk inventory.
B. It drives the risk response plan.
C. It is a risk reporting tool.
D. It lists internal risk and external risk. - ANSWER-B. Risk registers serve as the
main reference for all risk-related information, supporting risk-related decisions
such as risk response activities and their prioritization.
Shortly after performing the annual review and revision of corporate policies, a risk
practitioner becomes aware that a new law may affect security requirements for the
human resources system. The risk practitioner should:
A. analyze in detail how the law may affect the enterprise.
B. ensure that necessary adjustments are implemented during the next review
cycle.
C. initiate an ad hoc revision of the corporate policy.
D. notify the system custodian to implement changes. - ANSWER-A. Assessing how
the law may affect the enterprise is the best course of action. The analysis must
also determine whether existing controls already address the new requirements.
An information system that processes weather forecasts for public consumption is
MOST likely to place its highest priority on:
A. nonrepudiation.
B. confidentiality.
C. integrity.
D. availability. - ANSWER-C. A system that delivers weather forecasts is likely to
place its highest priority on the integrity of the data. The risk practitioner should
keep in mind that whether a forecast turns out to be accurate in its prediction is
distinct from whether the data was accurately represented.
Which of the following choices provides the BEST view of risk management?
A. An interdisciplinary team
B. A third-party risk assessment service provider
, C. The enterprise's IT department
D. The enterprise's internal compliance department - ANSWER-A. Having an
interdisciplinary team contribute to risk management ensures that all areas are
adequately considered and included in the risk assessment processes to support an
enterprise view of risk.
Which of the following choices is a PRIMARY consideration when developing an IT
risk awareness program?
A. Why technology risk is owned by IT
B. How technology risk can impact each attendee's area of business
C. How business process owners can transfer technology risk
D. Why technology risk is more difficult to manage compared to other risk -
ANSWER-B. Stakeholders must understand how the IT-related risk impacts the
overall business.
It is MOST important that risk appetite is aligned with business objectives to ensure
that:
A. resources are directed toward areas of low risk tolerance.
B. major risk is identified and eliminated.
C. IT and business goals are aligned.
D. the risk strategy is adequately communicated. - ANSWER-A. Risk appetite is the
amount of risk that an enterprise is willing to take on in pursuit of value. Aligning it
with business objectives allows an enterprise to evaluate and deploy valuable
resources toward those objectives where the risk tolerance (for loss) is low.
Weak passwords and transmission over unprotected communication lines are
examples of:
A. vulnerabilities.
B. threats.
C. probabilities.
D. impacts. - ANSWER-A. Vulnerabilities represent characteristics of information
resources that may be exploited by a threat.
The MOST significant drawback of using quantitative risk analysis instead of
qualitative risk analysis is the:
A. lower objectivity.
B. greater reliance on expertise.
C. less management buy-in.
D. higher cost. - ANSWER-D. Quantitative risk analysis is generally more complex
and, therefore, more costly than qualitative risk analysis.
Risk scenarios are analyzed to determine:
A. strength of controls.
B. likelihood and impact.
C. current risk profile.
D. scenario root cause. - ANSWER-B. Risk scenarios are descriptions of events that
can lead to a business impact and are evaluated to determine the likelihood and
impact should the event occur.
