CRISC Exam Questions

Which organization is implementing a project to automate the purchasing process, including the modification of approval controls. Which of the following tasks is lie responsibility...

Which of the following is MOST important to determine when assessing the potential risk exposure of a loss event involving personal data?

Which of the following s MOST likely to deter an employee from engaging in inappropriate use of company owned IT systems?

Reviewing which of the following BEST helps an organization gam insight into its overall risk profile''

Which of the following is the GREATEST benefit of a three lines of defense structure?

Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?

Which of the following is the PRIMARY objective of establishing an organization's risk tolerance and appetite?

The MAJOR reason to classify information assets is

Which of the following key performance indicators (KPis) would BEST measure me risk of a service outage when using a Software as a Service (SaaS) vendors

An organization recently configured a new business division Which of the following is MOST likely to be affected?

Which of the following BEST balances the costs and benefits of managing IT risk*?

A MAJOR advantage of using key risk indicators (KRis) is that (hey

Who is MOST appropriate to be assigned ownership of a control

Which stakeholder is MOST important to include when defining a risk profile during me selection process for a new third party application'?

An internal audit report reveals that a legacy system is no longer supported Which of the following is the risk practitioner's MOST important action before recommending a risk resp...

Which of the following is MOST helpful in providing a high-level overview of current IT risk severity*?

Which of the following would be of GREATEST concern regarding an organization's asset management?

To define the risk management strategy which of the following MUST be set by the board of directors?

An information security audit identified a risk resulting from the failure of an automated control Who is responsible for ensuring the risk register is updated accordingly?

Which of the following is the PRIMARY reason to engage business unit managers in risk management processes'?

An organization retains footage from its data center security camera for 30 days when the policy requires 90-day retention The business owner challenges whether the situation is wo...

An organization has been experiencing an increasing number of spear phishing attacks Which of the following would be the MOST effective way to mitigate the risk associated with the...

During a risk assessment, a risk practitioner learns that an IT risk factor is adequately mitigated by compensating controls in an associated business process. Which of the followi...

Who should be responsible for determining which stakeholders need to be involved in the development of a risk scenario?

Which of the following is a risk practitioner's BEST course of action after identifying risk scenarios related to noncompliance with new industry regulations?

Which of the following is the GREATEST benefit of having a mature enterprise architecture (EA) in place?

Which of the following would provide the MOST useful input when evaluating the appropriateness of risk responses?

Which of the following will BEST ensure that controls adequately support business goals and objectives?

The cost of maintaining a control has grown to exceed the potential loss. Which of the following BEST describes this situation?

Which of the following is the BEST key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO)?

A global organization has implemented an application that does not address all privacy requirements across multiple jurisdictions. Which of the following risk responses has the org...

Which of the following is MOST likely to introduce risk for financial institutions that use blockchain?

A failed IT system upgrade project has resulted in the corruption of an organization's asset inventory database. Which of the following controls BEST mitigates the impact of this i...

Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?

A risk practitioner is reviewing accountability assignments for data risk in the risk register. Which of the following would pose the GREATEST concern?

Which of the following roles should be assigned accountability for monitoring risk levels?

A penetration test reveals several vulnerabilities in a web-facing application. Which of the following should be the FIRST step in selecting a risk response?

After an annual risk assessment is completed, which of the following would be MOST important to communicate to stakeholders?

Which of the following would MOST likely cause management to unknowingly accept excessive risk?

An organization recently implemented a machine learning-based solution to monitor IT usage and analyze user behavior in an effort to detect internal fraud. Which of the following i...

The MOST important measure of the effectiveness of risk management in project implementation is the percentage of projects:

Which of the following is MOST helpful in identifying loss magnitude during risk analysis of a new system?

Which of the following is the BEST way to protect sensitive data from administrators within a public cloud?

When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?

Which of the following should be the PRIMARY input to determine risk tolerance?

Which of the following is the ULTIMATE goal of conducting a privacy impact analysis (PIA)?

Which of the following is MOST important to determine as a result of a risk assessment?

Which of the following is the GREATEST benefit of using IT risk scenarios?

When implementing an IT risk management program, which of the following is the BEST time to evaluate current control effectiveness?

After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to