IsacaIsaca
CRISC · Question #328
CRISC Question #328: Real Exam Question with Answer & Explanation
Sign in or unlock CRISC to reveal the answer and full explanation for question #328. The question stem and answer options stay visible for context.
Submitted by mike_84· Apr 18, 2026IT Risk Assessment
Question
What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner's business impact analysis (BIA)?
Options
- AInclude the application in the business continuity plan (BCP).
- BDetermine the business purpose of the application.
- CSegregate the application from the network.
- DReport the finding to management.
Unlock CRISC to see the answer
You've previewed enough free CRISC questions. Unlock CRISC for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Shadow IT#Risk identification#Business Impact Analysis (BIA)#Risk assessment process