CRISC Q&A

The MOST effective method to conduct a risk assessment on an internal system in an organization

is to start by understanding the:

• performance metrics and indicators.

• policies and standards

• recent audit findings and recommendations

• system and its subsystems.

Which of the following approaches is the BEST approach to exception management?

• Escalation processes are defined

• Process deviations are not allowed

• Decisions are based on business impact

• Senior management judgment is required

A substantive test to verify that tape library inventory records are accurate is:

• determining whether bar code readers are installed

• conducting a physical count of the tape inventory

• checking whether receipts and issues of tapes are accurately recorded.

• determining whether the movement of tapes is authorized

Which of the following is used to determine whether unauthorized modifications were made to

production programs?

• An analytical review

• Compliance testing

• A system log analysis

• A forensic analysis

Which of the following is MOST important for effective risk management?

• Assignment of risk owners to identified risk

• Ensuring compliance with regulatory requirements

• Integration of risk management into operational processes

• Implementation of a risk avoidance strategy

Previously accepted risk should be:

• removed from the risk log once it is accepted

• keep it in the risk log

• avoided next time as it provides the best response to the enterprise

• reassessed periodically because the risk can be escalated to an unacceptable level due

  to revised conditions

Which of the following MOST enables risk-aware business decisions?

• Robust information security policies

• An exchange of accurate and timely information

• Skilled risk management personnel

• Effective process controls

The BEST method for detecting and monitoring a hacker’s activities without exposing information

assets to unnecessary risk is to utilize:

• firewalls.

• Using a tool like wireshark

• honeypot

• screened subnet

60. What is the MOST important reason for periodically testing controls?

• To meet regulatory requirements

• To meet due care requirements

• To ensure that control objectives are met

• To achieve compliance with standard policy

An enterprise expanded operations into Europe, Asia and Latin America. The enterprise has a

single-version, multiple-language employee handbook last updated three years ago. Which of the

following is of MOST concern?

• The handbook may not have been correctly translated into all languages

• Newer policies may not be included in the handbook

• Expired policies may be included in the handbook

• The handbook may violate local laws and regulations