Isaca CRISC Certification CRISC Questions & Answers

• Question 1:

  A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite. Which of the following is the risk practitioner's BEST course of action?

  A. Update the risk register with the process changes.

  B. Review risk related to standards and regulations.

  C. Conduct a risk assessment with stakeholders.

  D. Conduct third-party resilience tests.

  Correct Answer: C

• Question 2:

  A risk practitioner is presenting the risk profile to management, indicating an increase in the number of successful network attacks. This information would be MOST helpful to:

  A. determine the availability of network resources.

  B. justify additional controls.

  C. justify investing in a log collection system.

  D. determine the frequency of monitoring.

  Correct Answer: B

• Question 3:

  An organization will be impacted by a new data privacy regulation due to the location of its production facilities. What action should the risk practitioner take when evaluating the new regulation?

  A. Perform an analysis of the new regulation to ensure current risk is identified.

  B. Evaluate if the existing risk responses to the previous regulation are still adequate.

  C. Assess the validity and perform update testing on data privacy controls.

  D. Develop internal control assessments over data privacy for the new regulation.

  Correct Answer: A

• Question 4:

  Which of the following will MOST effectively align IT controls with corporate risk tolerance?

  A. Benchmarks against industry leading practices

  B. Internal policies approved by stakeholders

  C. Key performance indicators (KPIs) approved by stakeholders

  D. Risk management framework

  Correct Answer: C

• Question 5:

  Which of the following should be the FIRST step to investigate an IT monitoring system that has a decreasing alert rate?

  A. Adjust the sensitivity to trigger more alerts.

  B. Determine the root cause for the change in alert rate.

  C. Conduct regression testing to ensure alerts can be triggered.

  D. Review and adjust the timing of the reporting window.

  Correct Answer: B

• Question 6:

  Which of the following is the BEST way to address a board's concern about the organization's cybersecurity posture?

  A. Update security risk scenarios

  B. Create a new security risk officer role

  C. Assess security capabilities against an industry framework

  D. Contract with a third party to perform vulnerability testing

  Correct Answer: D

• Question 7:

  Which of the following is MOST important to consider when determining the value of an asset during the risk identification process?

  A. The vulnerability profile of the asset

  B. The size of the asset's user base

  C. The criticality of the asset

  D. The monetary value of the asset

  Correct Answer: C

• Question 8:

  Which of the following is MOST important to review when determining whether a potential IT service provider's control environment is effective?

  A. Control self-assessment (CSA)

  B. Service level agreements (SLAs)

  C. Key performance indicators (KPIs)

  D. Independent audit report

  Correct Answer: D

• Question 9:

  Which of the following risk-related information is MOST valuable to senior management when formulating an IT strategic plan?

  A. Risk mitigation plans

  B. IT risk appetite statement

  C. Emerging IT risk scenarios

  D. Key risk indicators (KRIs)

  Correct Answer: D

• Question 10:

  What information related to a system vulnerability would be MOST useful to management in making an effective risk-based decision?

  A. Consequences if the vulnerability is exploited

  B. Availability of patches to mitigate the vulnerability

  C. Vulnerability scanning tools currently in place

  D. Risk mitigation plans for the vulnerability

  Correct Answer: A