CRISC Exam Questions

A migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing. Which part of the...

Which of the following is the BEST key performance indicator (KPI) to measure the ability to deliver uninterrupted IT services?

Which of the following is MOST important for a multinational organization to consider when developing its security policies and standards?

Which of the following should be the starting point when performing a risk analysis for an asset?

Which of the following emerging technologies is frequently used for botnet distributed denial of service (DDoS) attacks?

When determining the accuracy of a key risk indicator (KRI), it is MOST important that the indicator:

Which of the following should be of MOST concern to a risk practitioner reviewing the system development life cycle (SDLC)?

Which of the following is the BEST response when a potential IT control deficiency has been identified?

An organization's stakeholders are unable to agree on appropriate risk responses. Which of the following would be the BEST course of action?

Which of the following is the MOST important success factor when introducing risk management in an organization?

A risk practitioner learns that a risk owner has been accepting gifts from a supplier of IT products. Some of these IT products are used to implement controls and to mitigate risk...

Which of the following should a risk practitioner do NEXT after learning that Internet of Things (loT) devices installed in the production environment lack appropriate security con...

Which of the following process controls BEST mitigates the risk of an employee issuing fraudulent payments to a vendor?

A hospital recently implemented a new technology to allow virtual patient appointments. Which of the following should be the risk practitioner's FIRST course of action?

Which of the following is the MOST important reason to restrict access to the risk register on a need- to-know basis?

The BEST way for management to validate whether risk response activities have been completed is to review:

Which of the following is the PRIMARY benefit of integrating risk and security requirements in an organization's enterprise architecture (EA)?

A key risk indicator (KRI) that incorporates data from external open-source threat intelligence sources has shown changes in risk trend dat

A risk practitioner discovers that an IT operations team manager bypassed web filtering controls by using a mobile device, in violation of the network security policy. Which of the...

Which of the following risk impacts should be the PRIMARY consideration for determining recovery priorities in a disaster recovery situation?

Which of the following provides the MOST useful input to the development of realistic risk scenarios?

Which of the following is the BEST control for a large organization to implement to effectively mitigate risk related to fraudulent transactions?

Which of the following is the GREATEST concern if user acceptance testing (UAT) is not conducted when implementing a new application?

Which of the following is the PRIMARY reason to ensure policies and standards are properly documented within the risk management process?

A risk practitioner is involved in a comprehensive overhaul of the organizational risk management program. Which of the following should be reviewed FIRST to help identify relevant...

A risk assessment has revealed that the probability of a successful cybersecurity attack is increasing. The potential loss could exceed the organization's risk appetite. Which of t...

An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers. Which of the following should be the M...

Which of the following is the BEST indicator of the effectiveness of a control?

Key control indicators (KCls) help to assess the effectiveness of the internal control environment PRIMARILY by:

A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two yea...

When outsourcing a business process to a cloud service provider, it is MOST important to understand that:

Which of the following would MOST effectively reduce the potential for inappropriate exposure of vulnerabilities documented in an organization's risk register?

Which of the following BEST enables an organization to determine whether risk management is aligned with its goals and objectives?

If concurrent update transactions to an account are not processed properly, which of the following will MOST likely be affected?

Which of the following is the BEST method for determining an enterprise's current appetite for risk?

Which of the following is the MOST important course of action to foster an ethical, risk-aware culture?

An online payment processor would be severely impacted if the fraud detection system has an outage. Which of the following is the BEST way to address this risk?

A risk practitioner is developing a set of bottom-up IT risk scenarios. The MOST important time to involve business stakeholders is when:

When reporting to senior management on changes in trends related to IT risk, which of the following is MOST important?

Which of the following is MOST important to identify when developing top-down risk scenarios?

Which of the following is the BEST course of action for a system administrator who suspects a colleague may be intentionally weakening a system's validation controls in order to pa...

An organization has updated its acceptable use policy to mitigate the risk of employees disclosing confidential information. Which of the following is the BEST way to reinforce the...

Which of the following situations would BEST justify escalation to senior management?

Which of the following is MOST important for management to consider when deciding whether to invest in an IT initiative that exceeds management's risk appetite?

Which of the following is MOST important to review when evaluating the ongoing effectiveness of the IT risk register?

An organization has built up its cash reserves and has now become financially able to support additional risk while meeting its objectives. What is this change MOST likely to impac...

An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?

A risk practitioner is performing a risk assessment of recent external advancements in quantum computing. Which of the following would pose the GREATEST concern for the risk practi...

Which of the following will MOST likely change as a result of the decrease in risk appetite due to a new privacy regulation?

Who should be accountable for authorizing information system access to internal users?