CRISC Domain 2 MCQ

Which of the following is MOST likely be addressed by risk response?

• Destruction of obsolete computer equipment

• Theft of a smartphone from an office

• Sanitization and reuse of a flash drive

• Employee deletion of a file

Which of the following is the MOST important reason for conducting periodic risk assessments?

• Risk assessments are not always precise.

• Reviewers can optimize and reduce the cost of controls

• Risk assessments demonstrate the value of risk management to senior management

• Business risk is subject to frequent change

When a start-up company becomes popular, it suddenly is the target of hackers. This is considered:

• an emerging vulnerability

• a vulnerability event

• an emerging threat

• an environmental risk factor

Which of the following choices BEST helps identify information systems control deficiencies?

• Gap analysis

• The current IT risk profile

• The IT controls framework

• Countermeasure analysis

Risk scenarios should be created PRIMARILY based on which of the following?

• Input from senior management

• Previous security incidents

• Threats that the enterprise faces

• Results of the risk analysis

An enterprise learns of a security breach at another entity using similar network technology. The MOST important action for a risk practitioner is to:

• assess the likelihood of the incident occurring at the risk practitioner's enterprise

• discontinue the use of the vulnerable technology

• report to senior management that the enterprise is not affected

• remind staff that no similar security breaches have taken place

Risk scenarios are analysed to determine the:

• strength of controls

• likelihood and impact

• current risk profiles

• scenario root cause

Which of the following statements BEST describes the value of a risk register?

• It captures the risk inventory

• it drives the risk response plan

• It is a risk reporting tool

• It lists internal risk and external risk

If risk has been identified, but not yet mitigated, the enterprise would:

• record and mitigate serious risk and disregard low-level risk

• obtain management commitment to mitigate all identified risk within a reasonable time frame

• document identified risk in the risk register and maintain the remediation status

• conduct an annual risk assessment, but disregard previous assessments to prevent risk bias

The board of directors wants to know the financial impact of specific, individual risk scenarios. What type of approach is BEST suited to fulfill this requirement?

• Delphi method

• Quantitative analysis

• Qualitative analysis

• Financial risk modeling