CRISC Practice Test

Which of the following is the MOST important foundational element of an effective three lines of defense
model for an organization?

A.

A robust risk aggregation tool set

B.

Clearly defined roles and responsibilities

C.

A well-established risk management committee

D.

Well-documented and communicated escalation procedures

Which of the following should be included in a risk assessment report to BEST facilitate senior management's
understanding of the results?

A.

Benchmarking parameters likely to affect the results

B.

Tools and techniques used by risk owners to perform the assessments

C.

A risk heat map with a summary of risk identified and assessed

D.

The possible impact of internal and external risk factors on the assessment results

Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an
organization?

A.

Better understanding of the risk appetite

B.

Improving audit results

C.

Enabling risk-based decision making

D.

Increasing process control efficiencies

Which of the following is the MOST effective key performance indicator (KPI) for change management?

A.

Percentage of changes with a fallback plan

B.

Number of changes implemented

C.

Percentage of successful changes

D.

Average time required to implement a change

Which of the following is the BEST way to validate the results of a vulnerability assessment?

A.

Perform a penetration test.

B.

Review security logs.

C.

Conduct a threat analysis.

D.

Perform a root cause analysis