CRISC Exam Questions

Of the following, who is BEST suited to assist a risk practitioner in developing a relevant set of risk scenarios?

An organization has made a decision to purchase a new IT system. During when phase of the system development life cycle (SDLC) will identified risk MOST likely lead to architecture...

Recovery the objectives (RTOs) should be based on

Which of the following issues found during the review of a newly created disaster recovery plan (DRP) should be of MOST concern?

Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth''

An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?

it was determined that replication of a critical database used by two business units failed. Which of the following should be of GREATEST concern1?

Which of the following contributes MOST to the effective implementation of risk responses?

As pan of business continuity planning, which of the following is MOST important to include m a business impact analysis (BlA)?

Which of the following would BEST mitigate an identified risk scenario?

An organization has decided to commit to a business activity with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practiti...

Which of the following would BEST mitigate the ongoing risk associated with operating system (OS) vulnerabilities?

Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?

An organization has an approved bring your own device (BYOD) policy. Which of the following would BEST mitigate the security risk associated with the inappropriate use of enterpris...

Which key performance efficiency IKPI) BEST measures the effectiveness of an organization's disaster recovery program?

Which of the following will BEST help to ensure the continued effectiveness of the IT risk management function within an organization experiencing high employee turnover?

An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would...

A company has recently acquired a customer relationship management (CRM) application from a certified software vendor. Which of the following will BE ST help lo prevent technical v...

Which of the following is MOST important information to review when developing plans for using emerging technologies?

What is the PRIMARY reason an organization should include background checks on roles with elevated access to production as part of its hiring process?

Before assigning sensitivity levels to information it is MOST important to:

An organization has used generic risk scenarios to populate its risk register. Which of the following presents the GREATEST challenge to assigning of the associated risk entries?

When of the following standard operating procedure (SOP) statements BEST illustrates appropriate risk register maintenance?

Which of the blowing is MOST important when implementing an organization s security policy?

A cote data center went offline abruptly for several hours affecting many transactions across multiple locations. Which of the to" owing would provide the MOST useful information t...

A risk practitioner observed Vial a high number of pokey exceptions were approved by senior management. Which of the following is the risk practitioner's BEST course of action to d...

The BEST way to mitigate the high cost of retrieving electronic evidence associated with potential litigation is to implement policies and procedures for.

An organization has completed a risk assessment of one of its service providers. Who should be accountable for ensuring that risk responses are implemented?

Which of the following would MOST likely require a risk practitioner to update the risk register?

An IT risk threat analysis is BEST used to establish

Which of the following is a risk practitioner's MOST important responsibility in managing risk acceptance that exceeds risk tolerance?

Which of the following would provide the BEST evidence of an effective internal control environment/?

An organization is concerned that its employees may be unintentionally disclosing data through the use of social media sites. Which of the following will MOST effectively mitigate...

Who should be responsible (of evaluating the residual risk after a compensating control has been

A global company s business continuity plan (BCP) requires the transfer of its customer information....event of a disaster. Which of the following should be the MOST important risk...

Which of the following is the BEST approach to mitigate the risk associated with a control deficiency?

Which of the following is PRIMARILY a risk management responsibly of the first line of defense?

Which of the following would be the GREATEST concern for an IT risk practitioner when an employees.....

Which of the following is the BEST indication that key risk indicators (KRls) should be revised?

In order to determining a risk is under-controlled the risk practitioner will need to

An organization is considering the adoption of an aggressive business strategy to achieve desired growth From a risk management perspective what should the risk practitioner do NEX...

Which of the following practices would be MOST effective in protecting personality identifiable information (Ptl) from unauthorized access m a cloud environment?

Which of the following is MOST important to the effectiveness of key performance indicators (KPIs)?

Which of the following is the MOST comprehensive resource for prioritizing the implementation of information systems controls?

Which of the following will BEST help to ensure implementation of corrective action plans?

Which of the following would BEST facilitate the implementation of data classification requirements?

Which of the following is MOST important for mitigating ethical risk when establishing accountability for control ownership?

Which of the following management action will MOST likely change the likelihood rating of a risk scenario related to remote network access?

After the implementation of internal of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?

An organization control environment is MOST effective when: