CRISC Exam Questions

Which of the following is the PRIMARY objective of risk management?

An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of r...

One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk...

An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to...

Which of the following would present the GREATEST challenge for a risk practitioner during a merger of two organizations?

When classifying and prioritizing risk responses, the areas to address FIRST are those with:

A legacy application used for a critical business function relies on software that has reached the end of extended support Which of the following is the MOST effective control to m...

A risk practitioner notices a risk scenario associated with data loss at the organization's cloud provider is assigned to the provider who should the risk scenario be reassigned to...

Who is MOST important lo include in the assessment of existing IT risk scenarios?

An organization plans to implement a new Software as a Service (SaaS) speech-to-text solution Which of the following is MOST important to mitigate risk associated with data privacy...

An incentive program is MOST likely implemented to manage the risk associated with loss of which organizational asset?

When creating a separate IT risk register for a large organization, which of the following is MOST important to consider with regard to the existing corporate risk 'register?

Which of the following is the PRIMARY accountability for a control owner?

A recent risk workshop has identified risk owners and responses for newly identified risk scenarios. Which of the following should be the risk practitioner s NEXT step? r

Which of the following should be a risk practitioner's NEXT step after learning of an incident that has affected a competitor?

WhichT5f the following is the MOST effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage?

Which of the following BEST enables senior management lo compare the ratings of risk scenarios?

Which of the following is the PRIMARY reason for an organization to include an acceptable use banner when users log in?

A recent regulatory requirement has the potential to affect an organization's use of a third party to supply outsourced business services. Which of the following is the BEST course...

Which of the following is MOST important to include when reporting the effectiveness of risk management to senior management?

A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss expos...

What is senior management's role in the RACI model when tasked with reviewing monthly status reports provided by risk owners?

Which of the following proposed benefits is MOST likely to influence senior management approval to reallocate budget for a new security initiative?

Which of the following is the MOST important course of action for a risk practitioner when reviewing the results of control performance monitoring?

Which of the following is MOST important to ensure when reviewing an organization's risk register?

Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?

Which of the following is MOST useful for measuring the existing risk management process against a desired state?

Which of the following is the BEST way to validate whether controls to reduce user device vulnerabilities have been implemented according to management's action plan?

Which of the following should be considered FIRST when creating a comprehensive IT risk register?

Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?

Which of the following is the MOST important characteristic of a key risk indicator (KRI) to enable decision-making?

A poster has been displayed in a data center that reads. "Anyone caught taking photographs in the data center may be subject to disciplinary action." Which of the following control...

Which of the following is MOST important when determining risk appetite?

An organization wants to transfer risk by purchasing cyber insurance. Which of the following would be MOST important for the risk practitioner to communicate to senior management f...

An organizational policy requires critical security patches to be deployed in production within three weeks of patch availability. Which of the following is the BEST metric to veri...

Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?

Risk mitigation is MOST effective when which of the following is optimized?

An organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system. Which of the following is the risk practitioner's BEST course of...

An organization's capability to implement a risk management framework is PRIMARILY influenced by the:

Which of the following BEST supports the management of identified risk scenarios?

Which of the following is MOST important for the organization to consider before implementing a new in-house developed artificial intelligence (Al) solution?

Well-developed, data-driven risk measurements should be:

Which of the following should be the PRIMARY driver for an organization on a multi-year cloud implementation to publish a cloud security policy?

The PRIMARY reason to implement a formalized risk taxonomy is to:

Which of the following scenarios is MOST important to communicate to senior management?

Which organizational role should be accountable for ensuring information assets are appropriately classified?

Which of the following provides the MOST reliable evidence to support conclusions after completing an information systems controls assessment?

A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alt...

Which of the following is the PRIMARY objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register?

Which of the following will BEST help to ensure implementation of corrective action plans?