Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home ISACA CRISC

ISACA CRISC Exam Practice Questions (P. 5)

  • Full Access (1896 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #41
Which of the following controls do NOT come under technical class of control?
  1. A
    Program management control
  2. B
    System and Communications Protection control
  3. C
    Identification and Authentication control
  4. D
    Access Control

Correct Answer:
A
Program Management control comes under management class of controls, not technical.
Program Management control is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance with FISMA.
These controls complement other controls. They don't replace them.
Incorrect Answers:
B, C, D: These controls comes under technical class of control.
The Technical class of controls includes four families. These families include over 75 individual controls. Following is a list of each of the families in the Technical class:
✑ Access Control (AC): This family of controls helps an organization implement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties.
✑ Audit and Accountability (AU): This family of controls helps an organization implement an effective audit program. It provides details on how to determine what to audit. It provides details on how to protect the audit logs. It also includes information on using audit logs for non-repudiation.
Identification and Authentication (IA): These controls cover different practices to identify and authenticate users. Each user should be uniquely identified. In
other words, each user has one account. This account is only used by one user. Similarly, device identifiers uniquely identify devices on the network.
✑ System and Communications Protection (SC): The SC family is a large group of controls that cover many aspects of protecting systems and communication channels. Denial of service protection and boundary protection controls are included. Transmission integrity and confidentiality controls are also included.

Question #42
Mary is a project manager in her organization. On her current project she is working with her project team and other key stakeholders to identify the risks within the project. She is currently aiming to create a comprehensive list of project risks so she is using a facilitator to help generate ideas about project risks. What risk identification method is Mary likely using?
  1. A
    Delphi Techniques
  2. B
    Expert judgment
  3. C
    Brainstorming
  4. D
    Checklist analysis

Correct Answer:
C
Mary is using brainstorming in this example. Brainstorming attempts to create a comprehensive list of risks and often is led by a moderator or facilitator to move the process along.
Brainstorming is a technique to gather general data. It can be used to identify risks, ideas, or solutions to issues by using a group of team members or subject- matter expert. Brainstorming is a group creativity technique that also provides other benefits, such as boosting morale, enhancing work enjoyment, and improving team work.
Incorrect Answers:
A: The Delphi technique uses rounds of anonymous surveys to generate a consensus on the identified risks.
B: Expert judgment is not the best answer for this; projects experts generally do the risk identification, in addition to the project team.
D: Checklist analysis uses historical information and information from similar projects within the organization's experience.

Question #43
Which of the following is an administrative control?
  1. A
    Water detection
  2. B
    Reasonableness check
  3. C
    Data loss prevention program
  4. D
    Session timeout

Correct Answer:
C
chatbot-img GPT-4o - Answer
The correct answer is C, Data loss prevention program, which is an administrative control. This involves creating and enforcing policies that ensure effective management of data and mitigating potential risks associated with data loss. Administrative controls mostly are about setting up processes and policies that personnel must follow, distinguishing it from physical or technical controls, like implementing specific technologies or hardware to secure the system.

Question #44
You are the project manager of the NHH Project. You are working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team.
What document do you and your team is creating in this scenario?
  1. A
    Project plan
  2. B
    Resource management plan
  3. C
    Project management plan
  4. D
    Risk management plan

Correct Answer:
D
The risk management plan, part of the comprehensive management plan, defines how risks will be identified, analyzed, monitored and controlled, and even responded to.
A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them. It also consists of the risk assessment matrix.
Risks are built in with any project, and project managers evaluate risks repeatedly and build plans to address them. The risk management plan consists of analysis of possible risks with both high and low impacts, and the mitigation strategies to facilitate the project and avoid being derailed through which the common problems arise. Risk management plans should be timely reviewed by the project team in order to avoid having the analysis become stale and not reflective of actual potential project risks. Most critically, risk management plans include a risk strategy for project execution.
Incorrect Answers:
A: The project plan is not an official PMBOK project management plan.
B: The resource management plan defines the management of project resources, such as project team members, facilities, equipment, and contractors.
C: The project management plan is a comprehensive plan that communicates the intent of the project for all project management knowledge areas.

Question #45
Where are all risks and risk responses documented as the project progresses?
  1. A
    Risk management plan
  2. B
    Project management plan
  3. C
    Risk response plan
  4. D
    Risk register

Correct Answer:
D
All risks, their responses, and other characteristics are documented in the risk register. As the project progresses and the conditions of the risk events change, the risk register should be updated to reflect the risk conditions.
Incorrect Answers:
A: The risk management plan addresses the project management's approach to risk management, risk identification, analysis, response, and control.
B: The project management plan is the overarching plan for the project, not the specifics of the risk responses and risk identification.
C: The risk response plan only addresses the planned risk responses for the identified risk events in the risk register.

Question #46
A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?
  1. A
    Transference
  2. B
    Mitigation
  3. C
    Avoidance
  4. D
    Exploit

Correct Answer:
A
When you are hiring a third party to own risk, it is known as transference risk response.
Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity.
Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.
Incorrect Answers:
B: The act of spending money to reduce a risk probability and impact is known as mitigation.
C: When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.
D: Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized.

Question #47
John works as a project manager for BlueWell Inc. He is determining which risks can affect the project. Which of the following inputs of the identify risks process is useful in identifying risks associated to the time allowances for the activities or projects as a whole, with a width of the range indicating the degrees of risk?
  1. A
    Activity duration estimates
  2. B
    Activity cost estimates
  3. C
    Risk management plan
  4. D
    Schedule management plan

Correct Answer:
A
The activity duration estimates review is valuable in identifying risks associated to the time allowances for the activities or projects as a whole, with a width of the range indicating the degrees of risk.
Incorrect Answers:
B: The activity cost estimates review is valuable in identifying risks as it provides a quantitative assessment of the expected cost to complete scheduled activities and is expressed as a range, with a width of the range indicating the degrees of risk.
C: A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them.
It also consists of the risk assessment matrix.
D: It describes how the schedule contingencies will be reported and assessed.

Question #48
Which of the following events refer to loss of integrity?
Each correct answer represents a complete solution. (Choose three.)
  1. A
    Someone sees company's secret formula
  2. B
    Someone makes unauthorized changes to a Web site
  3. C
    An e-mail message is modified in transit
  4. D
    A virus infects a file

Correct Answer:
BCD
Loss of integrity refers to the following types of losses:
✑ An e-mail message is modified in transit A virus infects a file
✑ Someone makes unauthorized changes to a Web site
Incorrect Answers:
A: Someone sees company's secret formula or password comes under loss of confidentiality.

Question #49
Which of the following should be PRIMARILY considered while designing information systems controls?
  1. A
    The IT strategic plan
  2. B
    The existing IT environment
  3. C
    The organizational strategic plan
  4. D
    The present IT budget

Correct Answer:
C
Review of the enterprise's strategic plan is the first step in designing effective IS controls that would fit the enterprise's long-term plans.
Incorrect Answers:
A: The IT strategic plan exists to support the enterprise's strategic plan but is not solely considered while designing information system control.
B: Review of the existing IT environment is also useful and necessary but is not the first step that needs to be undertaken.
D: The present IT budget is just one of the components of the strategic plan.

Question #50
Which of the following is the MOST effective inhibitor of relevant and efficient communication?
  1. A
    A false sense of confidence at the top on the degree of actual exposure related to IT and lack of a well-understood direction for risk management from the top down
  2. B
    The perception that the enterprise is trying to cover up known risk from stakeholders
  3. C
    Existence of a blame culture
  4. D
    Misalignment between real risk appetite and translation into policies

Correct Answer:
C
Blame culture should be avoided. It is the most effective inhibitor of relevant and efficient communication. In a blame culture, business units tend to point the finger at IT when projects are not delivered on time or do not meet expectations. In doing so, they fail to realize how the business unit's involvement up front affects project success. In extreme cases, the business unit may assign blame for a failure to meet the expectations that the unit never clearly communicated. Executive leadership must identify and quickly control a blame culture if collaboration is to be fostered throughout the enterprise.
Incorrect Answers:
A: This is the consequence of poor risk communication, not the inhibitor of effective communication.
B: This is the consequence of poor risk communication, not the inhibitor of effective communication.
D: Misalignment between real risk appetite and translation into policies is an inhibitor of effective communication, but is not a prominent as existence of blame culture.

Previous Questions Next Questions

All Pages