CRISC Exam Questions

Which of the following is the BEST key performance indicator (KPI) for a server patch management process?

What is a risk practitioner's BEST approach to monitor and measure how quickly an exposure to a specific risk can affect the organization?

Which of the following is MOST important to update following a change in organizational risk appetite and tolerance?

Which of the following provides the BEST evidence that risk responses are effective?

An organization has an internal control that requires all access for employees be removed within 15 days of their termination date. Which of the following should the risk practitio...

Which of the following is the BEST indication that key risk indicators (KRIs) should be revised?

Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?

After conducting a risk assessment for regulatory compliance, an organization has identified only one possible mitigating control. The cost of the control has been determined to be...

Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?

Which of the following should be done FIRST when a new risk scenario has been identified

Which of the following activities is a responsibility of the second line of defense?

Which of the following is MOST important requirement to include in a Software as a Service (SaaS) vendor contract to ensure data is protected?

Which of the following is MOST important when identifying an organization's risk exposure associated with Internet of Things (loT) devices?

An organization has contracted with a cloud service provider to support the deployment of a new product. Of the following, who should own the associated risk?

A business impact analysis (BIA) has documented the duration of maximum allowable outage for each of an organization's applications. Which of the following MUST be aligned with the...

Which of the following offers the SIMPLEST overview of changes in an organization's risk profile?

A risk practitioner is defining metrics for security threats that were not identified by antivirus software. Which type of metric is being developed?

Which of the following BEST mitigates ethical risk?

Which process is MOST effective to determine relevance of threats for risk scenarios?

Which of the following is the BEST approach for obtaining management buy-in to implement additional IT controls?

Which of the following is the MOST important consideration for the board and senior leadership regarding the organization's approach to risk management for emerging technologies?

An organization recently implemented an automated interface for uploading payment files to its banking system to replace manual processing. Which of the following elements of the r...

A data center has recently been migrated to a jurisdiction where heavy fines will be imposed should leakage of customer personal data occur. Assuming no other changes to the operat...

Which of the following is MOST important to review when an organization needs to transition the majority of its employees to remote work during a crisis?

Which of the following BEST mitigates the risk associated with inadvertent data leakage by users who work remotely?

A failure in an organization s IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which...

In a public company, which group is PRIMARILY accountable for ensuring sufficient attention and resources are applied to the risk management process?

The PRIMARY reason for communicating risk assessment results to data owners is to enable the:

Which of the following BEST enables the timely detection of changes in the security control environment?

Reviewing which of the following would provide the MOST useful information when preparing to evaluate the effectiveness of existing controls?

Which of the following BEST enables the integration of IT risk management across an organization?

The percentage of unpatched systems is a:

Which of the following is MOST important to the effectiveness of a senior oversight committee for risk monitoring?

Which of the following is BEST used to aggregate data from multiple systems to identify abnormal behavior?

A risk practitioner's BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:

Which of the following is the MOST important update for keeping the risk register current?

Which of the following BEST enables detection of ethical violations committed by employees?

During a recent security framework review, it was discovered that the marketing department implemented a non-fungible token asset program. This was done without following establish...

An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level. Which of the following should the risk pract...

A robotic process automation (RPA) project has implemented new robots to enhance the efficiency of a sales business process. Which of the following provides the BEST evidence that...

Which of the following should be the PRIMARY focus of a disaster recovery management (DRM) framework and related processes?

A risk practitioner has been notified of a social engineering attack using artificial intelligence (Al) technology to impersonate senior management personnel. Which of the followin...

Which of the following presents the GREATEST privacy risk related to personal data processing for a global organization?

Which of the following describes the relationship between risk appetite and risk tolerance?

Which of the following should be the MOST important consideration when determining controls necessary for a highly critical information system?

Which of the following is MOST important to ensure risk management practices are effective at all levels within the organization?

Which of the following scenarios presents the GREATEST risk of noncompliance with data privacy best practices?

A business impact analysis (BIA) enables an organization to determine appropriate IT risk mitigation actions by:

Which of the following should be reported periodically to the risk committee?

A risk practitioner is advising management on how to update the IT policy framework to account for the organization s cloud usage. Which of the following should be the FIRST step i...