CRISC Domain 1 MCQ

IT Risk is measured by it's:

• Level of damage to IT systems

• Impact on business operations

• Cost of countermeasures

• Annual Loss Expectancy

Which of the following is MOST important to determine when defining risk management strategies?

• Risk assessment criteria

• IT architecture complexity

• Enterprise disaster recovery plan

• Business objectives and operations

Who is responsible for explaining the ramifications of a new zero-day exploit to the enterprise to senior management?

• Chief Operating Officer

• Chief Risk Officer

• Chief Information Security Officer

• Chief Information Officer

The risk to an information system that supports a critical business process is owned by:

• the IT Director

• Senior Management

• the Risk Management department

• the system users

Which of the following is MOST important when selecting an appropriate risk management methodology?

• Risk culture

• Countermeasure analysis

• Cost benefit analysis

• Risk transfer strategy

Which of the following is MOST useful when computing annual loss exposure?

• The cost of existing controls

• The number of vulnerabilities

• The net present value of the asset

• The business value of the asset

Which of the following provides the GREATEST support to a risk practitioner recommending encryption of corporate laptops and removable media as a risk mitigation measure?

• Benchmarking with peers

• Evaluating public reports on encryption algorithms in the public domain

• Developing a business case

• Scanning unencrypted systems for vulnerabilities

Which of the following should be of MOST concern to a risk practitioner?

• Failure to notify the public of an intrusion

• Failure to notify the police of an attempted intrusion

• Failure to internally report a successful attack

• Failure to examine access rights periodically

Which of the following choices provide the BEST view of risk management?

• An interdisciplinary team within the enterprise

• A third party risk assessment service provider

• The enterprise's IT department

• The enterprise's internal compliance department

Which of the following is one of the MAIN purposes of the 1st line of defense in the 3 lines of defense model?

• Ensure that financial controls are in place

• Ensure control deficiencies are addressed

• Ensure risk management practices are effective

• Ensure compliance with rules and regulations