CRISC Review Questions
R1-1 Which of the following is MOST important to determine when defining risk management
strategies?
A. Risk assessment criteria
B. IT architecture complexity
C. An enterprise disaster recover
...
CRISC Review Questions
R1-1 Which of the following is MOST important to determine when defining risk management
strategies?
A. Risk assessment criteria
B. IT architecture complexity
C. An enterprise disaster recovery plan
D. Business objectives and operations - ANS - D is the correct answer.
Justification:
A. Information on the internal and external environment must be collected to define a strategy
and identify its
impact. Risk assessment criteria alone are not sufficient.
B. IT architecture complexity is more directly related to assessing risk than defining strategies.
C. An enterprise disaster recovery plan is more directly related to mitigating the risk.
D. While defining risk management strategies, the risk practitioner needs to analyze the
organization's
objectives and risk tolerance and define a risk management framework based on this analysis.
Some
organizations may accept known risk, while others may invest in and apply mitigating controls to
reduce risk.
R1-2 Which of the following is the MOST important information to include in a risk
management strategic plan?
A. Risk management staffing requirements
B. The risk management mission statement
C. Risk mitigation investment plans
D. The current state and desired future state - ANS - D is the correct answer.
Justification:
A. Risk management staffing requirements are generally driven by a robust understanding of the
current and
desired future state.
B. The risk management mission statement is important but is not an actionable part of a risk
management
strategic plan.
C. Risk mitigation investment plans are generally driven by a robust understanding of the current
and desired
future state.
D. It is most important to paint a vision for the future and then draw a road map from the starting
point;
therefore, this requires that the current state and desired future state be fully understood.
R1-3 Information that is no longer required to support the main purpose of the business from an
information security
perspective should be:
A. analyzed under the retention policy.
B. protected under the information classification policy.
C. analyzed under the backup policy.
D. protected under the business impact analysis. - ANS - A is the correct answer.
Justification:
A. Information that is no longer required should be analyzed under the retention policy to
determine
whether the organization is required to maintain the data for business, legal or regulatory
reasons.
Keeping data that are no longer required unnecessarily consumes resources; may be in breach of
legal and regulatory obligations regarding retention of data; and, in the case of sensitive personal
information, can increase the risk of data compromise.
B. The information classification policy should specify retention and destruction of information
that is no longer
of value to the core business, as applicable.
C. The backup policy is generally based on recovery point objectives. The information
classification policy
should specify retention and destruction of backup media.
D. A business impact analysis can help determine that this information does not support the main
objective of the
business, but does not indicate the action to take.
R1-4 An enterprise has outsourced the majority of its IT department to a third party whose
servers are in a foreign
country. Which of the following is the MOST critical security consideration?
A. A security breach notification may get delayed due to the time difference.
B. Additional network intrusion detection sensors should be installed, resulting in additional
cost.
C. The enterprise could be unable to monitor compliance with its internal security and privacy
guidelines.
D. Laws and regulations of the country of origin may not be enforceable in the foreign country. -
ANS - D is the correct answer.
Justification:
A. Security breach notification is not a problem. Time difference does not play a role in a 24/7
environment.
Mobile devices (smartphones, tablets, etc.) are usually available to communicate a notification.
B. The need for additional network intrusion sensors is a manageable problem that requires
additional funding,
but can be addressed.
C. Outsourcing does not remove the enterprise's responsibility regarding internal requirements.
D. Laws and regulations of the country of origin may not be enforceable in the foreign country.
Conversely, the laws and regulations of the foreign vendor may also affect the enterprise.
Potential
violation of local laws applicable to the enterprise or the vendor may not be recognized or
remedied due
to the lack of knowledge of local laws and/or inability to enforce them.
R1-5 An enterprise recently developed a breakthrough technology that could provide a
significant competitive edge.
Which of the following FIRST governs how this information is to be protected from within the
enterprise?
A. The data classification policy
B. The acceptable use policy
C. Encryption standards
D. The access control policy - ANS - A is the correct answer.
Justification:
A. A data classification policy describes the data classification categories, level of protection to
be provided
for each category of data and roles and responsibilities of potential users, including data owners.
B. An acceptable use policy is oriented more toward the end user and, therefore, does not
specifically address
which controls should be in place to adeq
[Show More]
.png)
