Isaca CRISC Online Practice Questions and Exam Preparation

Isaca CRISC Online Questions & Answers

• Question 1:

  Which of the following is a KEY outcome of risk ownership?

  A. Risk responsibilities are addressed.
  B. Risk-related information is communicated.
  C. Risk-oriented tasks are defined.
  D. Business process risk is analyzed.
  A. Risk responsibilities are addressed.

• Question 2:

  Which of the following is PRIMARILY responsible for providing assurance to the board of directors and senior management during the evaluation of a risk management program implementation?

  A. Risk management
  B. Business units
  C. External audit
  D. Internal audit
  D. Internal audit

• Question 3:

  Which of the following is MOST important for managing ethical risk?

  A. Involving senior management in resolving ethical disputes
  B. Developing metrics to trend reported ethics violations
  C. Identifying the ethical concerns of each stakeholder
  D. Establishing a code of conduct for employee behavior
  D. Establishing a code of conduct for employee behavior

• Question 4:

  Who should be responsible for approving the cost of controls to be implemented for mitigating risk?

  A. Risk practitioner
  B. Risk owner
  C. Control owner
  D. Control implementer
  B. Risk owner

• Question 5:

  Automated code reviews to reduce the risk associated with web applications are MOST effective when performed:

  A. throughout development
  B. during pre-production testing
  C. in the design phase
  D. once in the production environment
  A. throughout development

• Question 6:

  The risk associated with inadvertent disclosure of database records from a public cloud service provider (CSP) would MOST effectively be reduced by: A. encrypting the data

  B. including a nondisclosure clause in the CSP contract

  C. assessing the data classification scheme

  D. reviewing CSP access privileges

  Correct Answer. A
  A

• Question 7:

  A risk owner has identified a risk with high impact and very low likelihood. The potential loss is covered by insurance. Which of the following should the risk practitioner do NEXT?

  A. Recommend avoiding the risk.
  B. Validate the risk response with internal audit.
  C. Update the risk register.
  D. Evaluate outsourcing the process.
  C. Update the risk register.

• Question 8:

  Which of The following should be of GREATEST concern for an organization considering the adoption of a bring your own device (BYOD) initiative?

  A. Device corruption
  B. Data loss
  C. Malicious users
  D. User support
  B. Data loss

• Question 9:

  Which of the following would provide executive management with the BEST information to make risk decisions as a result of a risk assessment?

  A. A companion of risk assessment results to the desired state
  B. A quantitative presentation of risk assessment results
  C. An assessment of organizational maturity levels and readiness
  D. A qualitative presentation of risk assessment results
  A. A companion of risk assessment results to the desired state

• Question 10:

  Which of the following approaches MOST effectively enables accountability for data protection?

  A. Establishing ownership for data within applications and systems
  B. Establishing discipline for policy violations by data owners
  C. Implementing data protection policies across the organization
  D. Conducting data protection awareness and training campaigns
  A. Establishing ownership for data within applications and systems