Question 1

Which of the following is a risk practitioner's BEST recommendation to address an organization's need to secure multiple systems with limited IT resources?

Options :

A : Perform a vulnerability analysis.

B : Schedule a penetration test.

C : Apply available security patches.

D : Conduct a business impact analysis (BIA).

Answer: D

Question 2

An organization is in the process of reviewing its risk appetite statement and re-defining the risk tolerance threshold. Which of the following elements of the risk register is MOST likely to change as a result of this review?

Options :

A : Risk impact

B : Risk response

C : Risk likelihood

D : Risk ownership

Answer: B

Question 3

After a high-profile systems breach at an organization's key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:

Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor's control environment?

Options :

A : External audit

B : Internal audit

C : Vendor performance scorecard

D : Regulatory examination

Answer: B

Question 4

Which of the following is the BEST approach for selecting controls to minimize risk?

Options :

A : Industry best practice review

B : Cost-benefit analysis

C : Risk assessment

D : Control-effectiveness evaluation

Answer: B

Question 5

Which of the following is MOST important to review when evaluating the ongoing effectiveness of the IT risk register?

Options :

A : The timeframes for risk response actions

B : The costs associated with mitigation options

C : The cost-benefit analysis of each risk response

D : The status of identified risk scenarios

Answer: D

Free CRISC Mock Exam – Practice Online Confidently

Buying Options: