CRISC Exam Questions

When is the BEST to identify risk associated with major project to determine a mitigation plan?

The PRIMARY objective of collecting information and reviewing documentation when performing periodic risk analysis should be to:

An organization is analyzing the risk of shadow IT usage. Which of the following is the MOST important input into the assessment?

Which of the following would be a risk practitioner's BEST recommendation upon learning of an updated cybersecurity regulation that could impact the organization?

It is MOST important that security controls for a new system be documented in:

An organization is planning to move its application infrastructure from on-premises to the cloud. Which of the following is the BEST course of the actin to address the risk associa...

Which of the following would be the result of a significant increase in the motivation of a malicious threat actor?

Which of the following would BEST facilitate the implementation of data classification requirements?

Which of the following sources is MOST relevant to reference when updating security awareness training materials?

Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?

When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?

Which of the following would MOST effectively reduce risk associated with an increase of online transactions on a retailer website?

Which of the following is the BEST method of creating risk awareness in an organization?

A bank recently incorporated Blockchain technology with the potential to impact known risk within the organization. Which of the following is the risk practitioner's BEST course of...

Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?

Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?

Which of the following is the MOST important objective from a cost perspective for considering aggregated risk responses in an organization?

Which of the following is MOST helpful in providing an overview of an organization's risk management program?

Which of the following is the BEST control to minimize the risk associated with scope creep in software development?

An organization has recently hired a large number of part-time employees. During the annual audit, it was discovered that many user IDs and passwords were documented in procedure m...

Which of the following is MOST important to update when an organization's risk appetite changes?

The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:

In order to efficiently execute a risk response action plan, it is MOST important for the emergency response team members to understand:

Which of the following is the BEST indicator of executive management's support for IT risk mitigation efforts?

Which of the following BEST enables risk-based decision making in support of a business continuity plan (BCP)?

Which of the following is MOST important for senior management to review during an acquisition?

Senior management wants to increase investment in the organization's cybersecurity program in response to changes in the external threat landscape. Which of the following would BES...

A recent vulnerability assessment of a web-facing application revealed several weaknesses. Which of the following should be done NEXT to determine the risk exposure?

Which of the following should be of GREATEST concern when reviewing the results of an independent control assessment to determine the effectiveness of a vendor's control environmen...

Which of the following is the MOST critical factor to consider when determining an organization's risk appetite?

Which of the following is the MOST important key performance indicator (KPI) to monitor the effectiveness of disaster recovery processes?

An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should...

During a risk assessment, a key external technology supplier refuses to provide control design and effectiveness information, citing confidentiality concerns. What should the risk...

Which of the following findings of a security awareness program assessment would cause the GREATEST concern to a risk practitioner?

Which of the following is the MOST important concern when assigning multiple risk owners for an identified risk?

Following an acquisition, the acquiring company's risk practitioner has been asked to update the organization's IT risk profile What is the MOST important information to review fro...

An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to a...

Which of the following is the MAIN purpose of monitoring risk?

During an acquisition, which of the following would provide the MOST useful input to the parent company's risk practitioner when developing risk scenarios for the post-acquisition...

Which of the following is the MOST important consideration when communicating the risk associated with technology end-of-life to business owners?

Which of the following is MOST important when conducting a post-implementation review as part of the system development life cycle (SDLC)?

Using key risk indicators (KRIs) to illustrate changes in the risk profile PRIMARILY helps to:

Which of the following will BEST help to ensure key risk indicators (KRIs) provide value to risk owners?

When defining thresholds for control key performance indicators (KPIs). it is MOST helpful to align:

Which of the following is the MOST important step to ensure regulatory requirements are adequately addressed within an organization?

Which of the following is the GREATEST benefit of identifying appropriate risk owners?

An organization's chief information officer (CIO) has proposed investing in a new. untested technology to take advantage of being first to market Senior management has concerns abo...

A risk practitioner is utilizing a risk heat map during a risk assessment. Risk events that are coded with the same color will have a similar:

A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner's NEXT step?

The objective of aligning mitigating controls to risk appetite is to ensure that: