Verified CRISC dumps Q&As - Pass Guarantee or Full Refund [Nov-2023]
CRISC PDF Dumps | Nov 19, 2023 Recently Updated Questions
NEW QUESTION # 589
You are the project manager of a SGT project. You have been actively communicating and working with the project stakeholders. One of the outputs of the "manage stakeholder expectations" process can actually create new risk events for your project. Which output of the manage stakeholder expectations process can create risks?
- A. Change requests
- B. Project management plan updates
- C. An organizational process asset updates
- D. Project document updates
Answer: A
Explanation:
Section: Volume B
Explanation:
The manage stakeholder expectations process can create change requests for the project, which can cause new risk events to enter into the project.
Change requests are requests to expand or reduce the project scope, modify policies, processes, plans, or procedures, modify costs or budgets or revise schedules. These requests for a change can be direct or indirect, externally or internally initiated, and legally or contractually imposed or optional. A Project Manager needs to ensure that only formally documented requested changes are processed and only approved change requests are implemented.
Incorrect Answers:
A: The project management plan updates do not create new risks.
B: The organizational process assets updates do not create new risks.
D: The project document updates do not create new risks.
NEW QUESTION # 590
A risk practitioner shares the results of a vulnerability assessment for a critical business application with the business manager. Which of the following is the NEXT step?
- A. Conduct a penetration test to validate the vulnerabilities from the findings.
- B. Evaluate the impact of the vulnerabilities to the business application.
- C. Escalate the findings to senior management and internal audit.
- D. Develop a risk action plan to address the findings.
Answer: A
NEW QUESTION # 591
Which of the following steps ensure effective communication of the risk analysis results to relevant stakeholders? Each correct answer represents a complete solution. Choose three.
- A. Communicate the negative impacts of the events only, it needs more consideration
- B. Communicate the risk-return context clearly
- C. The results should be reported in terms and formats that are useful to support business decisions
- D. Provide decision makers with an understanding of worst-case and most probable scenarios,due diligence exposures and significant reputation, legal or regulatory considerations
Answer: B,C,D
Explanation:
Section: Volume B
Explanation:
The result of risk analysis process is being communicated to relevant stakeholders. The steps that are involved in communication are:
* The results should be reported in terms and formats that are useful to support business decisions.
* Coordinate additional risk analysis activity as required by decision makers, like report rejection and scope adjustment
* Communicate the risk-return context clearly, which include probabilities of loss and/or gain, ranges, and confidence levels (if possible) that enable management to balance risk-return.
* Identify the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process.
* Provide decision makers with an understanding of worst-case and most probable scenarios, due diligence exposures and significant reputation, legal or regulatory considerations.
Incorrect Answers:
C: Communicate the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process, for effective communication. Only negative impacts are not considered alone.
NEW QUESTION # 592
You are the project manager of your enterprise. You have identified new threats, and then evaluated the ability of existing controls to mitigate risk associated with new threats. You noticed that the existing control is not efficient in mitigating these new risks. What are the various steps you could take in this case?
Each correct answer represents a complete solution. Choose all that apply.
- A. Deployment of a threat-specific countermeasure
- B. Apply more controls
- C. Modify of the technical architecture
- D. Education of staff or business partners
Answer: A,C,D
Explanation:
Explanation/Reference:
Explanation:
As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the:
Modification of the technical architecture
Deployment of a threat-specific countermeasure
Implementation of a compensating mechanism or process until mitigating controls are developed
Education of staff or business partners
Incorrect Answers:
D: Applying more controls is not the good solution. They usually complicate the condition.
NEW QUESTION # 593
An organization has four different projects competing for funding to reduce overall IT risk. Which project should management defer?
- A. Project Alpha
- B. Project Charlie
- C. Project Delta
- D. Project Bravo
Answer: B
NEW QUESTION # 594
Which of the following should be of GREATEST concern when reviewing the results of an independent control assessment to determine the effectiveness of a vendor's control environment?
- A. The controls had recurring noncompliance.
- B. The risk associated with multiple control gaps was accepted.
- C. The control owners disagreed with the auditor's recommendations.
- D. The report was provided directly from the vendor.
Answer: D
NEW QUESTION # 595
A department allows multiple users to perform maintenance on a system using a single set of credentials. A risk practitioner determined this practice to be high-risk. Which of the following is the MOST effective way to mitigate this risk?
- A. Multi-factor authentication
- B. Audit trail review
- C. Single sign-on
- D. Data encryption at rest
Answer: B
NEW QUESTION # 596
The MOST important reason for implementing change control procedures is to ensure:
- A. an audit trail exists.
- B. only approved changes are implemented
- C. timely evaluation of change events
- D. that emergency changes are logged.
Answer: B
NEW QUESTION # 597
You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of identified risks by including internally generated risks. What risk identification approach are you using in this example?
- A. is incorrect. Root cause analysis examines causal factors for events within the project.
- B. Root cause analysis
- C. Explanation:
This is an example of SWOT analysis. SWOT analysis examines the strengths, weaknesses,
opportunities, and threats within the project and generated from within the organization.
SWOT stands for Strengths, Weaknesses, Opportunities, and Threats. It is a part of business
policy that helps an individual or a company to make decisions. It includes the strategies to build
the strength of a company and use the opportunities to make the company successful. It also
includes the strategies to overcome the weaknesses of and threats to the company. - D. SWOT analysis
- E. Influence diagramming techniques
- F. Assumptions analysis
- G. is incorrect. Assumptions analysis does not use four pre-defined perspectives for
review.
Answer: D
Explanation:
is incorrect. Influence diagramming techniques examines the relationships between
things and events within the project.
NEW QUESTION # 598
What are the functions of audit and accountability control?
Each correct answer represents a complete solution. Choose all that apply.
- A. Explanation:
Audit and accountability family of controls helps an organization implement an effective audit program. It provides details on how to determine what to audit. It provides details on how to protect the audit logs. It also includes information on using audit logs for non-repudiation. - B. Implement effective access control
- C. Implement an effective audit program
- D. Provides details on how to determine what to audit
- E. Provides details on how to protect the audit logs
Answer: A,C,D,E
Explanation:
is incorrect. Access Control is the family of controls that helps an organizationimplement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties. Audit and accountability family of controls do not help in implementing effective access control.
NEW QUESTION # 599
IT stakeholders have asked a risk practitioner for IT risk profile reports associated with specific departments to allocate resources for risk mitigation. The BEST way to address this request would be to use:
- A. the cost associated with each control.
- B. key risk indicators (KRls).
- C. information from the risk register.
- D. historical risk assessments.
Answer: B
NEW QUESTION # 600
Which of the following are the common mistakes while implementing KRIs?
Each correct answer represents a complete solution. Choose three.
- A. Choosing KRIs that are not linked to specific risk
- B. Choosing KRIs that are incomplete or inaccurate due to unclear specifications
- C. Choosing KRIs that has high correlation with the risk
- D. Choosing KRIs that are difficult to measure
Answer: A,B,D
Explanation:
Section: Volume C
Explanation:
A common mistake when implementing KRIs other than selecting too many KRIs includes choosing KRIs that are:
* Not linked to specific risk
* Incomplete or inaccurate due to unclear specifications
* Too generic
* Difficult to aggregate, compare and interpret
* Difficult to measure
Incorrect Answers:
B: For ensuring high reliability of the KRI, The indicator must possess a high correlation with the risk and be a good predictor or outcome measure. Hence KRIs are chosen that has high correlation with the risk.
NEW QUESTION # 601
Which of the following should be PRIMARILY considered while designing information systems controls?
- A. Explanation:
Review of the enterprise's strategic plan is the first step in designing effective IS controls that
would fit the enterprise's long-term plans. - B. The present IT budget
- C. The IT strategic plan
- D. is incorrect. The present IT budget is just one of the components of the strategic plan.
- E. The existing IT environment
- F. The organizational strategic plan
- G. is incorrect. Review of the existing IT environment is also useful and necessary but is
not the first step that needs to be undertaken.
Answer: F
Explanation:
is incorrect. The IT strategic plan exists to support the enterprise's strategic plan but is
not solely considered while designing information system control.
NEW QUESTION # 602
The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:
- A. without causing an unplanned system outage.
- B. successfully within the expected time frame.
- C. by the security administration team.
- D. successfully during the first attempt.
Answer: B
NEW QUESTION # 603
An organization with a large number of applications wants to establish a security risk assessment program. Which of the following would provide the MOST useful information when determining the frequency of risk assessments?
- A. Prioritization from business owners
- B. Feedback from end users
- C. Results of a benchmark analysis
- D. Recommendations from internal audit
Answer: A
NEW QUESTION # 604
The risk associated with data loss from a website which contains sensitive customer information is BEST owned by:
- A. IT security
- B. the third-party website manager
- C. the compliance manager
- D. the business process owner
Answer: D
NEW QUESTION # 605
Which of the following is the STRONGEST indication an organization has ethics management issues?
- A. Internal IT auditors report to the chief information security officer (CISO).
- B. The organization has only two lines of defense.
- C. Employees face sanctions for not signing the organization's acceptable use policy.
- D. Employees do not report IT risk issues for fear of consequences.
Answer: D
Explanation:
Section: Volume D
NEW QUESTION # 606
......
CRISC Exam Questions – Valid CRISC Dumps Pdf: https://www.braindumpquiz.com/CRISC-exam-material.html
CRISC Practice Test Questions Answers Updated 1196 Questions: https://drive.google.com/open?id=1eT6C14k4eke0awzvz4AcNEINAKyLRIDn