CRISC Exam Questions

It was discovered that a service provider's administrator was accessing sensitive information without the approval of the customer in an Infrastructure as a Service (laaS) model. W...

Which group has PRIMARY ownership of reputational risk stemming from unethical behavior within the organization?

Which of the following is the MOST important reason to communicate control effectiveness to senior management?

Which of the following actions should a risk practitioner do NEXT when an increased industry trend of external cyber attacks is identified?

The PRIMARY benefit of selecting an appropriate set of key risk indicators (KRIs) is that they:

A large organization recently restructured the IT department and has decided to outsource certain functions. What action should the control owners in the IT department take?

Which of the following risk activities is BEST facilitated by enterprise architecture (EA)?

A multinational company needs to implement a new centralized security system. The risk practitioner has identified a conflict between the organization's data-handling policy and lo...

An organization's risk management team wants to develop IT risk scenarios to show the impact of collecting and storing credit card information. Which of the following is the MOST c...

Which of the following is the MOST essential factor for managing risk in a highly dynamic environment?

Who should be responsible for approving the cost of controls to be implemented for mitigating risk?

An organization recently experienced a cyber attack that resulted in the loss of confidential customer data. Which of the following is the risk practitioner's BEST recommendation a...

The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:

An organization has restructured its business processes, and the business continuity plan (BCP) needs to be revised accordingly. Which of the following should be identified FIRST?

An organization is moving its critical assets to the cloud. Which of the following is the MOST important key performance indicator (KPI) to include in the service level agreement (...

Which of the following is the MOST important criteria for selecting key risk indicators (KRIs)?

Which of the following is the BEST metric to demonstrate the effectiveness of an organization's patch management process?

What is the MOST important consideration when selecting key performance indicators (KPIs) for control monitoring?

Within the three lines of defense model, the responsibility for managing risk and controls resides with:

Which of the following has the GREATEST positive impact on ethical compliance within the risk management process?

An organization has established a contract with a vendor that includes penalties for loss of availability. Which risk treatment has been adopted by the organization?

Which of the following deficiencies identified during a review of an organization's cybersecurity policy should be of MOST concern?

Which of the following is MOST helpful when prioritizing action plans for identified risk?

Which of the following is the MOST likely reason an organization would engage an independent reviewer to assess its IT risk management program?

Which of the following is the BEST criterion to determine whether higher residual risk ratings in the risk register should be accepted?

Which of the following changes would be reflected in an organization's risk profile after the failure of a critical patch implementation?

Which of the following BEST protects organizational data within a production cloud environment?

Which of the following management actions will MOST likely change the likelihood rating of a risk scenario related to remote network access?

An organization has outsourced its backup and recovery procedures to a third-party cloud provider. Which of the following should be the risk practitioner's NEXT course of action?

An organization uses a web application hosted by a cloud service that is populated by data sent to the vendor via email on a monthly basis. Which of the following should be the FIR...

Which of the following is the BEST way to determine the value of information assets for risk management purposes?

Which of the following BEST facilitates the development of relevant risk scenarios?

Which of the following is the PRIMARY purpose of a risk register?

A risk practitioner notes control design changes when comparing risk response to a previously approved action plan. Which of the following is MOST important for the practitioner to...

The software version of an enterprise's critical business application has reached end-of-life and is no longer supported by the vendor. IT has decided to develop an in-house replac...

An organization recently implemented new technologies that enable the use of robotic process automation. Which of the following is MOST important to reassess?

The PRIMARY focus of an ongoing risk awareness program should be to:

An organization operates in an environment where the impact of ransomware attacks is high, with a low likelihood. After quantifying the impact of the risk associated with ransomwar...

Of the following, whose input is ESSENTIAL when developing risk scenarios for the implementation of a third-party mobile application that stores customer data?

Which of the following is the PRIMARY objective of a risk awareness program?

During a review of the asset life cycle process, a risk practitioner identified several unreturned and unencrypted laptops belonging to former employees. Which of the following is...

Which of the following is a risk practitioner's BEST recommendation regarding disaster recovery management (DRM) for Software as a Service (SaaS) providers?

Which of the following criteria for assigning owners to IT risk scenarios provides the GREATEST benefit to an organization?

Which of the following is the ULTIMATE objective of utilizing key control indicators (KCIs) in the risk management process?

Which of the following is the BEST method to track asset inventory?

A risk practitioner has reviewed new international regulations and realizes the new regulations will affect the organization. Which of the following should be the risk practitioner...

Which of the following should be the PRIMARY consideration when assessing the risk of using Internet of Things (loT) devices to collect and process personally identifiable informat...

Which types of controls are BEST used to minimize the risk associated with a vulnerability?

Which of the following should be done FIRST upon learning that the organization will be affected by a new regulation in its industry?

An insurance company handling sensitive and personal information from its customers receives a large volume of telephone requests and electronic communications daily. Which of the...