CRISC Quiz Questions and Answers

Which of the following best describes the risk-related roles and responsibilities of an organizational Business Unit (BU)? The BU management team________.

Answer :
  • owns the risk and is responsible for identifying, assessing and mitigating risk as well as reporting on that risk to the appropriate support functions and the board of directors.

Explanation :

The BU is responsible for owning the risk and its resulting actions. Risk owners have the responsibility of identifying, measuring, monitoring, controlling and reporting on risk to executive management as established by the corporate risk framework.

In the risk management process, a cost-benefit analysis is mainly performed______.

Answer :
  • as part of risk response planning.

Explanation :

In risk response, a range of controls will be identified that can mitigate risk; however, a cost-benefit analysis in this process will help identify the right controls that will address the risk at acceptable levels within the budge

Monitoring has flagged a security exception. What is the most appropriate action?

Answer :
  • Validate the exception

Explanation :

Before any other action is taken, the security manager should ensure that the exception identified by monitoring is not a false positive.

Which of the following is the best approach when conducting an IT risk awareness campaign?

Answer :
  • Provide common messages tailored for different groups.

Explanation :

Groups differ in level of responsibility and expertise; tailor common messages to each group’s role and level of understanding.

Which of the following should the management use to allocate resources for risk response?

Answer :
  • Risk analysis results

Explanation :

Risk analysis results provide a basis for prioritizing risk responses and allocation of resources.

An enterprise learns of a security breach at another entity using similar network technology. The most important action for a risk practitioner is to______.

Answer :
  • assess the likelihood of the incident occurring at the risk practitioner’s enterprise

Risk scenarios are analyzed to determine the______.

Answer :
  • likelihood and impact

Which of the following is the most important reason for conducting periodic risk assessments?

Answer :
  • Business risk is subject to frequent change