[2021] Free CRISC Exam Dumps to Pass Exam Easily
CRISC Exam Dumps, CRISC Practice Test Questions
Exam Overview
The CRISC certification exam is made up of 150 multiple-choice questions and the time allotted for its completion is 240 minutes. The candidates can take it in Chinese (Simplified and Traditional), English, German, French, Italian, Korean, Japanese, Spanish, and Turkish. The passing score is 450 points (out of 800).
To register for the test, the students must pay the required fee. For the ISACA members, it is $575, while for the non-members – $760. This exam is administered through the PSI testing centers across the world. You can take it at any time because registration is always on-going. After making payment, you can schedule your test as early as 48 hours. However, make sure that you understand its content before you attempt the exam to avoid retaking it. If you do not pass the test, you will have to pay another fee.
How to study the CRISC Exam
VCETorrent expert team recommends you to prepare some notes on these topics along with it don’t forget to practice ISACA CRISC Exam dumps which been written by our expert team, Both these will help you a lot to clear this exam with good marks.
NEW QUESTION 114
Which of the following should be done FIRST when a new risk scenario has been identified?
- A. Assess the risk training program
- B. Assess the risk awareness program
- C. Identify the risk owner
- D. Estimate the residual risk
Answer: B
Explanation:
Section: Volume D
NEW QUESTION 115
Which of the following role carriers has to account for collecting data on risk and articulating risk?
- A. Chief information officer (CIO)
- B. Chief risk officer (CRO)
- C. Enterprise risk committee
- D. Business process owner
Answer: B
Explanation:
Section: Volume D
Explanation:
CRO is the individual who oversees all aspects of risk management across the enterprise. Chief risk officer has the main accountability for collecting data and articulating risk. If there is any fault in these processes, then CRO should be answerable.
Incorrect Answers:
A: Enterprise risk committee are the executives who are accountable for the enterprise level collaboration and consensus required to support enterprise risk management (ERM). They are to some extent responsible for articulating risk but are not accounted for it. They are neither responsible nor accounted for collecting data on risk.
B: Business process owner is an individual responsible for identifying process requirements, approving process design and managing process performance. He/she is responsible for collecting data and articulating risk but is not accounted for them.
C: CIO is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources. CIO has some responsibility towards collecting data and articulating risk but is not accounted for them.
NEW QUESTION 116
Which of the following come under the phases of risk identification and evaluation?
Each correct answer represents a complete solution. Choose three.
- A. Analyzing risk
- B. Applying controls
- C. Maintain a risk profile
- D. Collecting data
Answer: A,C,D
Explanation:
Section: Volume D
Explanation:
Risk identification is the process of determining which risks may affect the project. It also documents risks' characteristics.
Following are high-level phases that are involved in risk identification and evaluation:
* Collecting data- Involves collecting data on the business environment, types of events, risk categories, risk scenarios, etc., to identify relevant data to enable effective risk identification, analysis and reporting.
* Analyzing risk- Involves analyzing risk to develop useful information which is used while taking risk- decisions. Risk-decisions take into account the business relevance of risk factors.
* Maintain a risk profile- Requires maintaining an up-to-date and complete inventory of known threats and their attributes (e.g., expected likelihood, potential impact, and disposition), IT resources, capabilities, and controls as understood in the context of business products, services and processes to effectively monitor risk over time.
Incorrect Answers:
D: It comes under risk management process, and not in risk identification and evaluation process.
NEW QUESTION 117
After undertaking a risk assessment of a production system, the MOST appropriate action is for the risk manager to:
- A. recommend a program that minimizes the concerns of that production system.
- B. inform the development team of the concerns, and together formulate risk reduction measures.
- C. inform the IT manager of the concerns and propose measures to reduce them.
- D. inform the process owner of the concerns and propose measures to reduce them
Answer: D
NEW QUESTION 118
Which of the following role carriers is accounted for analyzing risks, maintaining risk profile, and risk-aware decisions?
- A. Chief risk officer (CRO)
- B. Chief information officer (CIO)
- C. Business management
- D. Business process owner
- E. Explanation:
Business management is the business individuals with roles relating to managing a program. They are typically accountable for analyzing risks, maintaining risk profile, and risk-aware decisions. Other than this, they are also responsible for managing risks, react to events, etc.
Answer: C
Explanation:
is incorrect. CIO is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources. CIO has some responsibility analyzing risks, maintaining risk profile, and risk-aware decisions but is not accounted for them. Answer: B is incorrect. Business process owner is an individual responsible for identifying process requirements, approving process design and managing process performance. He/she is responsible for analyzing risks, maintaining risk profile, and risk-aware decisions but is not accounted for them. Answer: D is incorrect. CRO is the individual who oversees all aspects of risk management across the enterprise. He/she is responsible for analyzing risks, maintaining risk profile, and risk-aware decisions but is not accounted for them.
NEW QUESTION 119
Which of the following are the security plans adopted by the organization?
Each correct answer represents a complete solution. Choose all that apply.
- A. Disaster recovery plan
- B. Backup plan
- C. Business continuity plan
- D. Explanation:
Organizations create different security plans to address different scenarios. Many of the security plans are common to most organizations. Most used security plans found in many organizations are: Business continuity plan Disaster recovery plan Backup plan Incident response plan - E. Project management plan
Answer: A,B,C
Explanation:
is incorrect. Project management plan is not a security plan, but a plan which describes the implementation of the project.
NEW QUESTION 120
Which of the following is the MOST important information to be communicated during security awareness training?
- A. Corporate risk profile
- B. The current risk management capability
- C. Recent security incidents
- D. Management's expectations
Answer: D
NEW QUESTION 121
Which of the following individuals is responsible for identifying process requirements, approving process design and managing process performance?
- A. Risk owner
- B. Chief information officer
- C. Chief financial officer
- D. Business process owner
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Business process owners are the individuals responsible for identifying process requirements, approving process design and managing process performance. In general, a business process owner must be at an appropriately high level in the enterprise and have authority to commit resources to process-specific risk management activities.
Incorrect Answers:
B: Risk owner for each risk should be the person who has the most influence over its outcome. Selecting the risk owner thus usually involves considering the source of risk and identifying the person who is best placed to understand and implement what needs to be done.
C: Chief financial officer is the most senior official of the enterprise who is accountable for financial planning, record keeping, investor relations and financial risks.
D: Chief information officer is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources.
NEW QUESTION 122
A teaming agreement is an example of what type of risk response?
- A. Acceptance
- B. Mitigation
- C. Transfer
- D. Share
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Teaming agreements are often comes under sharing risk response, as they involves joint ventures to realize an opportunity that an organization would not be able to seize otherwise.
Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.
Incorrect Answers:
A: Acceptance is a risk response that is appropriate for positive or negative risk events. It does not pursue the risk, but documents the event and allows the risk to happen. Often acceptance is used for low probability and low impact risk events.
B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together.
C: Transference is a negative risk response where the project manager hires a third party to own the risk event.
NEW QUESTION 123
You are working in an enterprise. Your enterprise owned various risks. Which among the following is MOST likely to own the risk to an information system that supports a critical business process?
- A. is incorrect. The risk management department determines and reports on level of risk,
but does not own the risk. Risk is owned by senior management. - B. Senior management
- C. System users
- D. is incorrect. The IT director manages the IT systems on behalf of the business owners.
- E. Explanation:
Senior management is responsible for the acceptance and mitigation of all risk. Hence they will
also own the risk to an information system that supports a critical business process. - F. Risk management department
- G. IT director
Answer: B
Explanation:
is incorrect. The system users are responsible for utilizing the system properly and
following procedures, but they do not own the risk.
NEW QUESTION 124
You are the project manager for Bluewell Inc. You are studying the documentation of project plan. The documentation states that there are twenty-five stakeholders with the project. What will be the number of communication channel s for the project?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Section: Volume C
Explanation:
Communication channels are paths of communication with stakeholders in a project. The number of communication channels shows the complexity of a project's communication and can be derived through the formula shown below:
Total Number of Communication Channels = n (n-1)/2
where n is the number of stakeholders.
Hence, a project having five stakeholders will have ten communication channels. Putting the value of the number of stakeholders in the formula will provide the number of communication channels.
Hence,
Number of communication channel = (n (n-1)) / 2
= (25 (25-1)) / 2
= (25 x 24) / 2
= 600 / 2
= 300
Incorrect Answers:
A, B, C: These are not valid number of communication channels for the given scenario.
NEW QUESTION 125
You are the risk professional in Bluewell Inc. You have identified a risk and want to implement a specific risk mitigation activity. What you should PRIMARILY utilize?
- A. Technical evaluation report
- B. Vulnerability assessment report
- C. Business case
- D. Budgetary requirements
Answer: C
Explanation:
Section: Volume C
Explanation:
As business case includes business need (like new product, change in process, compliance need, etc.) and the requirements of the enterprise (new technology, cost, etc.), risk professional should utilize this for implementing specific risk mitigation activity. Risk professional must look at the costs of the various controls and compare them against the benefits that the organization will receive from the risk response. Hence he/she needs to have knowledge of business case development to illustrate the costs and benefits of the risk response.
Incorrect Answers:
A, C, D: These all options are supplemental.
NEW QUESTION 126
The MOST effective approach to prioritize risk scenarios is by:
- A. assessing impact to the strategic plan
- B. soliciting input from risk management experts
- C. evaluating the cost of risk response
- D. aligning with industry best practices
Answer: A
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION 127
A multinational organization is considering implementing standard background checks to' all new employees A KEY concern regarding this approach
- A. fail to identity all relevant issues.
- B. be too line consuming
- C. violate laws in other countries
- D. be too costly
Answer: C
NEW QUESTION 128
Which of the following would BEST help to ensure that suspicious network activity is identified?
- A. Using a third-party monitoring provider
- B. Coordinating events with appropriate agencies
- C. Analyzing server logs
- D. Analyzing intrusion detection system (IDS) logs
Answer: D
NEW QUESTION 129
According to the Section-302 of the Sarbanes-Oxley Act of 2002, what does certification of reports implies?
Each correct answer represents a complete solution. Choose three.
- A. The financial statement does not contain any materially untrue or misleading information.
- B. The signing officer has presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.
- C. The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date at the time to report.
- D. The signing officer has reviewed the report.
Answer: A,B,D
Explanation:
Explanation/Reference:
Explanation:
Section 302 of Sarbanes-Oxley act has the tremendous impact on the risk management solution adopted by corporations. This section specifies that the reports must be certified by the CEO, CFO, or other senior officer performing similar functions.
Certification of reports establishes:
The signing officer has reviewed the report.
The financial statement do not contain, to the knowledge of signing officer, any materially untrue or
misleading information and represent fairly all financial conditions and results of the enterprise's operations.
The signing officers:
- are responsible for establishing and maintaining internal controls
- have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made - known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared
- have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report
- have presented in the report their conclusions about the effectiveness of their internal controls base on their evaluation as of that date The signing officer have disclosed to external auditors, audit committee, and other directors:
- all significant deficiencies in the design or operation of internal controls which could adversely affect the reliability of the reported financial data
- any fraud, whether or not material, that involves management or other employees who have a significant role in the internal controls of the enterprise The signing officer have indicated in the report any internal controls or changes to those internal
controls which have been implemented since they were evaluated.
Incorrect Answers:
A: The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report, not at the time of the report.
NEW QUESTION 130
When reporting risk assessment results to senior management, which of the following is MOST important to include to enable risk-based decision making?
- A. Recent audit and self-assessment results
- B. Risk action plans and associated owners
- C. A list of assets exposed to the highest risk
- D. Potential losses compared to treatment cost
Answer: D
NEW QUESTION 131
Employees are repeatedly seen holding the door open for others, so that trailing employees do not have to stop and swipe their own ID badges. This behavior BEST represents:
- A. a threat
- B. an impact
- C. a vulnerability
- D. a control
Answer: C
Explanation:
Section: Volume D
NEW QUESTION 132
You are the project manager for BlueWell Inc. You have noticed that the risk level in your project increases above the risk tolerance level of your enterprise. You have applied several risk responses. Now you have to update the risk register in accordance to risk response process. All of the following are included in the risk register except for which item?
- A. Agreed-upon response strategies
- B. Risk triggers
- C. Network diagram analysis of critical path activities
- D. Risk owners and their responsibility
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The risk register does not examine the network diagram and the critical path. There may be risks associated with the activities on the network diagram, but it does not address the network diagram directly.
The risk register is updated at the end of the plan risk response process with the information that was discovered during the process. The response plans are recorded in the risk register. In the risk register, risk is stated in order of priority, i.e., those with the highest potential for threat or opportunity first. Some risks might not require response plans at all, but then too they should be put on a watch list and monitored throughout the project. Following elements should appear in the risk register:
List of identified risks, including their descriptions, root causes, and how the risks impact the project
objectives
Risk owners and their responsibility
Outputs from the Perform Qualitative Analysis process
Agreed-upon response strategies
Risk triggers
Cost and schedule activities needed to implement risk responses
Contingency plans
Fallback plans, which are risk response plans that are executed when the initial risk response plan
proves to be ineffective
Contingency reserves
Residual risk, which is a leftover risk that remains after the risk response strategy has been
implemented
Secondary risks, which are risks that come about as a result of implementing a risk response
NEW QUESTION 133
What are the responsibilities of the CRO?
Each correct answer represents a complete solution. Choose three.
- A. Advising Board of Directors
- B. Managing the risk assessment process
- C. Managing the supporting risk management function
- D. Implement corrective actions
Answer: B,C,D
Explanation:
Section: Volume A
Explanation/Reference:
Explanation:
Chief Risk Officer is the executive-level manager in an organization. They provide corporate, guidance, governance, and oversight over the enterprise's risk management activities. The main priority for the CRO is to ensure that the organization is in full compliance with applicable regulations. They may also deal with areas regarding insurance, internal auditing, corporate investigations, fraud, and information security.
CRO's responsibilities include:
* Managing the risk assessment process
* Implementation of corrective actions
* Communicate risk management issues
* Supporting the risk management functions
NEW QUESTION 134
......
Certification Path
The Certified in Risk and Information Systems Control Certification includes only one CRISC exams.
CRISC Exam Dumps, CRISC Practice Test Questions: https://www.vcetorrent.com/CRISC-valid-vce-torrent.html
Free CRISC Study Guides Exam Questions & Answer: https://drive.google.com/open?id=1mwfbeJezIh_t2r7I5Lpr86mFuUxm91ul