CRISC Exam Questions

Which of the following factors will have the GREATEST impact on the implementation of a risk mitigation strategy for an organization?

In the three lines of defense model, a PRIMARY objective of the second line is to:

Which of the following is the MOST useful input when developing risk scenarios?

An organization needs to send files to a business partner to perform a quality control audit on the organization's record-keeping processes. The files include personal information...

A risk action plan has been changed during the risk mitigation effort. Which of the following is MOST important for the risk practitioner to verify?

An organization uses a biometric access control system for authentication and access to its server room. Which control type has been implemented?

Which of the following is the GREATEST concern associated with the use of artificial intelligence (AI) language models?

Which of the following is BEST measured by key control indicators (KCIs)?

Which of the following would be a risk practitioner's GREATEST concern related to the monitoring of key risk indicators (KRIs)?

An organization requires a third party for processing customer personal data. Which of the following is the BEST approach when sharing data over a public network?

Which of the following is the GREATEST concern when using artificial intelligence (AI) language models?

Which of the following is the MOST effective way to help ensure future risk levels do not exceed the organization's risk appetite?

An organization's decision to remain noncompliant with certain laws or regulations is MOST likely influenced by:

When assessing the maturity level of an organization's risk management framework, which of the following should be of GREATEST concern to a risk practitioner?

Which of the following is MOST useful input when developing risk scenarios?

Which of the following is the GREATEST impact of implementing a risk mitigation strategy?

In the three lines of defense model, a PRIMARY objective of the second line is to:

Which of the following is the MOST important consideration when prioritizing risk response?

Which of the following is the GREATEST concern related to the monitoring of key risk indicators (KRIs)?

Who is accountable for authorizing application access in a cloud Software as a Service (SaaS) solution?

The BEST use of key risk indicators (KRIs) is to provide:

During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course...

A MAJOR advantage of using key risk indicators (KRIs) is that they:

Which of the following is the PRIMARY benefit of using a risk profile?

A failure in an organization's IT system build process has resulted in several computers on the network missing the corporate endpoint detection and response (EDR) software. Which...

Which of the following is the PRIMARY reason for logging in a production database environment?

Who is ULTIMATELY accountable for risk treatment?

An organization has implemented a policy requiring staff members to take a minimum of five consecutive days' leave per year to mitigate the risk of malicious insider activities. Wh...

Which of the following BEST enables an organization to address new risk associated with an Internet of Things (IoT) solution?

An organization is subject to a new regulation that requires nearly real-time recovery of its services following a disruption. Which of the following is the BEST way to manage the...

A user has contacted the risk practitioner regarding malware spreading laterally across the organization's corporate network. Which of the following is the risk practitioner's BEST...

Because of a potential data breach, an organization has decided to temporarily shut down its online sales order system until sufficient controls can be implemented. Which risk trea...

A global organization is considering the transfer of its customer information systems to an overseas cloud service provider in the event of a disaster. Which of the following shoul...

Recent penetration testing of an organization's software has identified many different types of security risks. Which of the following is the MOST likely root cause for the identif...

Which of the following would BEST facilitate the implementation of data classification requirements?

An organization has adopted an emerging technology without following proper processes. Which of the following is the risk practitioner's BEST course of action to address this risk?

Which of the following BEST reduces the likelihood of fraudulent activity that occurs through use of a digital wallet?

A risk practitioner has been notified of a social engineering attack using artificial intelligence (AI) technology to impersonate senior management personnel. Which of the followin...

Which of the following outcomes of disaster recovery planning is MOST important to enable the initiation of necessary actions during a disaster?

When assigning control ownership, it is MOST important to verify that the owner has accountability for:

A risk practitioner's BEST guidance to help an organization develop relevant risk scenarios is to ensure the scenarios are:

Which of the following presents the GREATEST security risk associated with Internet of Things (IoT) technology?

An organization has established a single enterprise-wide risk register that records high-level risk scenarios. The IT risk department has created its own register to record more gr...

Where is the FIRST place a risk practitioner should look to identify accountability for a specific risk?

A service organization is preparing to adopt an IT control framework to comply with the contractual requirements of a new client. Which of the following would be MOST helpful to th...

Which of the following is the BEST way to mitigate the risk associated with fraudulent use of an enterprise's brand on Internet sites?

Which of the following is PRIMARILY responsible for providing assurance to the board of directors and senior management during the evaluation of a risk management program implement...

During the creation of an organization's IT risk management program, the BEST time to identify key risk indicators (KRIs) is while:

A bank recently incorporated blockchain technology with the potential to impact known risk within the organization. Which of the following is the risk practitioner's BEST course of...

During a risk assessment of a financial institution, a risk practitioner discovers that tellers can initiate and approve transactions of significant value. This team is also respon...