CRISC Exam Questions & Answers

Document Content and Description Below

CRISC Exam Questions & Answers What is the primary force for driving privacy? - ANS - Regulation What is Confidentiality? - ANS - Maintains the secrecy and privacy of data "need to know / least pri... vilege" What is Integrity? - ANS - Guarding against improper information modification, exclusion, or destruction "authenticity" What is Availability? - ANS - Providing timely and reliable access to information What is the order of Information Security Risk Management Process steps? - ANS - 1) Context Establishment 2) Risk Identification 3) Risk Analysis 4) Risk Evaluation 5) Risk Treatment What does the Risk Identification Process involve? - ANS - 1) Identify Assets 2) Identify Threats 3) Identify Existing Controls 4) Identify Vulnerabilities 5) Identify Consequences 6) Risk Estimation What are examples of Threats? - ANS - personnel, natural events, theft, terrorism, criminal acts, software errors, mechanical failure, accidents The IT risk action plan is an output communication from? - ANS - Chief Risk Officer and the Enterprise Risk Management Committee What is risk Magnitude? - ANS - The impact to the enterprise when the event occurs What are synonyms for Frequency and Magnitude? - ANS - Likelihood and Impact What is Risk Appetite? - ANS - The amount of risk, on a broad level, that an entity is willing tot accept in pursuit of its mission What is Risk Tolerance? - ANS - The acceptable level of variation that management is willing to allow for any particular risk as it pursues its objectives What does Risk Governance address? - ANS - Oversight of the business risk strategy for the enterprise What are the 3 objectives of Risk Governance? - ANS - 1) Establish a common risk view 2) Integrate risk management into the enterprise 3) Make risk-aware business decisions What are the 5 components of Governance? - ANS - 1) Alignment 2) Value Delivery 3) Risk Management 4) Performance Measurement 5) Resource Management What is the difference between Responsibility and Accountability? - ANS - Responsibility belong to those who must ensure that activities are completed successfully VS Accountability which applies to those who either own the required resource or those who have the authority to approve the execution and/or accept the outcome of an activity What is another term for IT Risk Scenario Analysis? - ANS - Stress Test What is the rough allocation of risk relevant to almost all organizations? - ANS - Financial Risk (35%) Strategic Risk (25%) Operational Risk (25%) Legal and Compliance Risk (15%) What are the Four CRISC domains? (which also represent the cyclic process of IT Risk Management) - ANS - 1) IT Risk Identification 2) IT Risk Assessment 3) Risk Response and Mitigation 4) Risk and Control Monitoring and Reporting What is a Risk? - ANS - When a threat exploits a vulnerability which damages an asset which breaks a business process How do you classify assets? - ANS - Using an Information/Data Classification Policy Which line of defense is a CRISC? - ANS - 2nd line Which line of defense is a CIO? - ANS - 1st line Which level of Management accepts a risk? - ANS - Executive management (i.e. CEO) What is Control Risk? - ANS - When the controls chosen to mitigate risk are incorrect What is the #1 Project Risk? - ANS - Failure to meet expectations What are the 4 ways to deal with a risk? - ANS - 1) avoid 2) mitigate 3) accept 4) transfer Is IT Risk part of Op Risk? - ANS - Yes What is the framework that SOX controls are based on? - ANS - COSO 2013 What are the 6 types of controls? - ANS - 1) Policy 2) Standard 3) Procedure 4) Process 5) Org structure 6) Physical entity (e.g. security guard) (80% of controls are Procedures / Processes) Anyone who manages risk should not report to..... - ANS - Someone who delivers value [Show More]

Last updated: 2 years ago

Preview 1 out of 17 pages