CRISC Exam Questions

In addition to the risk exposure, which of the following is MOST important for senior management to understand prior to approving the use of artificial intelligence (Al) solutions?

Which of the following is MOST useful when performing a quantitative risk assessment?

When determining risk ownership, the MAIN consideration should be:

The BEST way to mitigate the high cost of retrieving electronic evidence associated with potential litigation is to implement policies and procedures for:

To help ensure the success of a major IT project, it is MOST important to:

Which of the following is the PRIMARY reason to conduct risk assessments at periodic intervals?

Which of the following provides the MOST mitigation value for an organization implementing new Internet of Things (loT) devices?

Which of the following is the MOST critical consideration when awarding a project to a third-party service provider whose servers are located offshore?

A new risk practitioner finds that decisions for implementing risk response plans are not being made. Which of the following would MOST likely explain this situation?

A recently purchased IT application does not meet project requirements. Of the following, who is accountable for the potential impact?

A risk practitioner finds that data has been misclassified. Which of the following is the GREATEST concern?

An organization has outsourced its customer management database to an external service provider. Of the following, who should be accountable for ensuring customer data privacy?

Following the implementation of an Internet of Things (loT) solution, a risk practitioner identifies new risk factors with impact to existing controls. Which of the following is MO...

Which of the following should a risk practitioner review FIRST when evaluating risk events associated with the organization's data flow model?

Which of the following controls will BEST mitigate risk associated with excessive access privileges?

A technology company is developing a strategic artificial intelligence (Al)-driven application that has high potential business value. At what point should the enterprise risk prof...

Which of the following is a risk practitioner's BEST course of action if a risk assessment identifies a risk that is extremely unlikely but would have a severe impact should it occ...

Which of the following should be done FIRST when developing an initial set of risk scenarios for an organization?

Which of the following is MOST important for a risk practitioner to understand about an organization in order to create an effective risk awareness program?

Which of the following is the PRIMARY advantage of having a single integrated business continuity plan (BCP) rather than each business unit developing its own BCP?

An organization is implementing Zero Trust architecture to improve its security posture. Which of the following is the MOST important input to develop the architecture?

Who is PRIMARILY accountable for identifying risk on a daily basis and ensuring adherence to the organization's policies?

Which of the following is the PRIMARY risk management responsibility of the third line of defense?

Which of the following is a PRIMARY objective of privacy impact assessments (PIAs)?

Within the risk management space, which of the following activities could be delegated to a cloud service provider?

External penetration tests MUST include:

A business unit has implemented robotic process automation (RPA) for its repetitive back-office tasks. Which of the following should be the risk practitioner's GREATEST concern?

Senior management has requested a risk practitioner's guidance on whether a new technical control requested by a business unit is worth the investment. Which of the following shoul...

A new international data privacy regulation requires personal data to be disposed after the specified retention period, which is different from the local regulatory requirement. Wh...

Which of the following presents the GREATEST concern associated with the use of artificial intelligence (Al) systems?

An organization has determined that risk is not being adequately tracked and managed due to a distributed operating model. Which of the following is the BEST way to address this is...

Upon learning that the number of failed backup attempts continually exceeds the current risk threshold, the risk practitioner should:

Which of the following BEST indicates that an organization's disaster recovery plan (DRP) will mitigate the risk of the organization failing to recover from a major service disrupt...

Which of the following BEST helps to ensure disaster recovery staff members are able to complete their assigned tasks effectively during a disaster?

An organization becomes aware that IT security failed to detect a coordinated cyber attack on its data center. Which of the following is the BEST course of action?

Which of the following is the PRIMARY purpose of a risk register?

Who is accountable for the process when an IT stakeholder operates a key control to address a risk scenario?

Which of the following BEST facilitates the identification of emerging risk?

Which of the following BEST enables effective risk reporting to the board of directors?

The patch management process is MOST effectively monitored through which of the following key control indicators (KCIs)?