CRISC Practice Test

Which of the following would BEST help to ensure that suspicious network activity is identified?

A.

Analyzing intrusion detection system (IDS) logs

B.

Analyzing server logs

C.

Using a third-party monitoring provider

D.

Coordinating events with appropriate agencies

The MAIN goal of the risk analysis process is to determine the:

A.

potential severity of impact

B.

frequency and magnitude of loss

C.

control deficiencies

D.

threats and vulnerabilities

The MAIN purpose of conducting a control self-assessment (CSA) is to:

A.

gain a better understanding of the control effectiveness in the organization

B.

gain a better understanding of the risk in the organization

C.

adjust the controls prior to an external audit

D.

reduce the dependency on external audits

Which of the following provides the BEST measurement of an organization's risk management maturity level?

A.

Level of residual risk

B.

The results of a gap analysis

C.

IT alignment to business objectives

D.

Key risk indicators (KRIs)

Who should be accountable for ensuring effective cybersecurity controls are established?

A.

Risk owner

B.

Security management function

C.

IT management

D.

Enterprise risk function