CRISC Practice Test

An organization operates in an environment where reduced time-to-market for new software products is a top business priority. Which of the following should be the risk practitioner's GREATEST concern?

A.

Sufficient resources are not assigned to IT development projects.

B.

Customer support help desk staff does not have adequate training.

C.

Email infrastructure does not have proper rollback plans.

D.

The corporate email system does not identify and store phishing emails

The PRIMARY reason for periodic penetration testing of Internet-facing applications is to:

A.

ensure policy and regulatory compliance.

B.

assess the proliferation of new threats.

C.

verify Internet firewall control settings.

D.

identify vulnerabilities in the system.

What is the PRIMARY reason to periodically review key performance indicators (KPIs)?

A.

Ensure compliance.

B.

Identify trends.

C.

Promote a risk-aware culture.

D.

Optimize resources needed for controls

Which of the following would MOST likely drive the need to review and update key performance indicators (KPIs) for critical IT assets?

A.

The outsourcing of related IT processes

B.

Outcomes of periodic risk assessments

C.

Changes in service level objectives

D.

Findings from continuous monitoring

An organization wants to assess the maturity of its internal control environment. The FIRST step should be to:

A.

validate control process execution.

B.

determine if controls are effective.

C.

identify key process owners.

D.

conduct a baseline assessment.