CRISCPreview

Which of the following would BEST facilitate the implementation of data classification requirements?

An organization has used generic risk scenarios to populate its risk register. Which of the following presents the GREATEST challenge to assigning ownership of the associated risk entries?

An organization's business process requires the verbal verification of personal information in an environment where other customers may overhear this information. Which of the following is the MOST significant risk?

An organization has initiated a project to launch an IT-based service to customers and take advantage of being the first to market. Which of the following should be of GREATEST concern to senior management?

Which of the following is the MOST important objective of embedding risk management practices into the initiation phase of the project management life cycle?

Which of the following is the MOST significant indicator of the need to perform a penetration test?

Which of the following provides the MOST reliable information to ensure a newly acquired company has appropriate IT controls in place?

Print jobs containing confidential information are sent to a shared network printer located in a secure room. Which of the following is the BEST control to prevent the inappropriate disclosure of confidential information?

Which of the following would be MOST helpful when communicating roles associated with the IT risk management process?

Fred is the project manager of a large project in his organization. Fred needs to begin planning the risk management plan with the project team and key stakeholders. Which plan risk management process tool and technique should Fred use to plan risk management?

The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

A bank recently incorporated blockchain technology with the potential to impact known risk within the organization. Which of the following is the risk practitioner's
BEST course of action?

Of the following, who is BEST suited to assist a risk practitioner in developing a relevant set of risk scenarios?

The risk associated with an asset after controls are applied can be expressed as:

A risk practitioner notices a trend of noncompliance with an IT-related control. Which of the following would BEST assist in making a recommendation to management?

Which key performance indicator (KPI) BEST measures the effectiveness of an organization's disaster recovery program?

The PRIMARY advantage of involving end users in continuity planning is that they:

Which of the following is the PRIMARY risk management responsibility of the second line of defense?

Which of the following is the BEST way to ensure ongoing control effectiveness?

Who should have the authority to approve an exception to a control?

Which of the following is a responsibility of the second line of defense in the three lines of defense model?

To mitigate the risk of using a spreadsheet to analyze financial data, IT has engaged a third-party vendor to deploy a standard application to automate the process. Which of the following parties should own the risk associated with calculation errors?