CRISC Exam Questions

An organization has decided to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable. As a result of this decision, the risk associat...

When a risk practitioner is determining a system's criticality. it is MOST helpful to review the associated:

When evaluating a number of potential controls for treating risk, it is MOST important to consider:

Which of the following is the MOST effective way to reduce potential losses due to ongoing expense fraud?

An organization is participating in an industry benchmarking study that involves providing customer transaction records for analysis Which of the following is the MOST important co...

Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board?

Which of the following is MOST important to promoting a risk-aware culture?

The BEST metric to demonstrate that servers are configured securely is the total number of servers:

Which of the following resources is MOST helpful to a risk practitioner when updating the likelihood rating in the risk register?

A segregation of duties control was found to be ineffective because it did not account for all applicable functions when evaluating access. Who is responsible for ensuring the cont...

Which of the following would be the BEST way for a risk practitioner to validate the effectiveness of a patching program?

The BEST indicator of the risk appetite of an organization is the

Which of the following is the BEST method to mitigate the risk of an unauthorized employee viewing confidential data in a database''

Which of the following is the BEST approach for an organization in a heavily regulated industry to comprehensively test application functionality?

An organization has agreed to a 99% availability for its online services and will not accept availability that falls below 98.5%. This is an example of:

Which of the following is the PRIMARY purpose of creating and documenting control procedures?

Of the following, who is responsible for approval when a change in an application system is ready for release to production?

A risk practitioner recently discovered that personal information from the production environment is required for testing purposes in non-production environments. Which of the foll...

Which of the following is the GREATEST concern when establishing key risk indicators (KRIs)?

Which of the following provides the MOST useful information to assess the magnitude of identified deficiencies in the IT control environment?

Which of the following provides the BEST assurance of the effectiveness of vendor security controls?

The MAIN purpose of selecting a risk response is to.

Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?

Which of the following is the BEST way to ensure data is properly sanitized while in cloud storage?

Which risk response strategy could management apply to both positive and negative risk that has been identified?

An organization's recovery team is attempting to recover critical data backups following a major flood in its data center. However, key team members do not know exactly what steps...

A control process has been implemented in response to a new regulatory requirement, but has significantly reduced productivity. Which of the following is the BEST way to resolve th...

A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which ot the...

A risk practitioner has identified that the agreed recovery time objective (RTO) with a Software as a Service (SaaS) provider is longer than the business expectation. Which of the...

Which of the following is the MOST useful information for a risk practitioner when planning response activities after risk identification?

Which of the following situations presents the GREATEST challenge to creating a comprehensive IT risk profile of an organization?

Which of the following BEST enables a risk practitioner to understand management's approach to organizational risk?

Which of the following is the MOST important reason to validate that risk responses have been executed as outlined in the risk response plan''

Which of the following BEST helps to identify significant events that could impact an organization?

Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?

Which of the following BEST enables effective IT control implementation?

Which of the following should be the FIRST consideration when establishing a new risk governance program?

When establishing an enterprise IT risk management program, it is MOST important to:

An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?

Which of the following is the MAIN benefit to an organization using key risk indicators (KRIs)?

What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical le...

Which of the following would provide the MOST helpful input to develop risk scenarios associated with hosting an organization's key IT applications in a cloud environment?

A newly incorporated enterprise needs to secure its information assets From a governance perspective which of the following should be done FIRST?

A highly regulated enterprise is developing a new risk management plan to specifically address legal and regulatory risk scenarios What should be done FIRST by IT governance to sup...

Business management is seeking assurance from the CIO that IT has a plan in place for early identification of potential issues that could impact the delivery of a new application W...

A root because analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators. Who should be accountable for resolving the situat...

Which of the following is the BEST way to determine whether system settings are in alignment with control baselines?

A recent big data project has resulted in the creation of an application used to support important investment decisions. Which of the following should be of GREATEST concern to the...

Which of the following presents the GREATEST challenge to managing an organization's end- user devices?