CRISC Practice Test

An organization is planning to acquire a new financial system. Which of the following stakeholders would
provide the MOST relevant information for analyzing the risk associated with the new IT solution?

A.

Project sponsor

B.

Process owner

C.

Risk manager

D.

Internal auditor

Which of the following is a PRIMARY benefit of engaging the risk owner during the risk assessment process?

A.

Identification of controls gaps that may lead to noncompliance

B.

Prioritization of risk action plans across departments

C.

Early detection of emerging threats

D.

Accurate measurement of loss impact

Before implementing instant messaging within an organization using a public solution, which of the following should be in place to mitigate data leakage risk?

A.

A data extraction tool

B.

An access control list

C.

An intrusion detection system (IDS)

D.

An acceptable usage policy

Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?

A.

To enhance compliance with standards

B.

To minimize subjectivity of assessments

C.

To increase consensus among peers

D.

To provide assessments for benchmarking

A risk practitioner is organizing risk awareness training for senior management. Which of the following is the MOST important topic to cover in the training session?

A.

The organization's strategic risk management projects

B.

Senior management roles and responsibilities

C.

The organizations risk appetite and tolerance

D.

Senior management allocation of risk management resources