Question 1

An organization is considering outsourcing user administration controls for a critical system. The potential vendor has offered to perform quarterly self-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to the risk practitioner?

Options :

A : The vendor will not achieve best practices

B : The vendor will not ensure against control failure

C : The controls may not be properly tested

D : Lack of a risk-based approach to access control

Answer: B

Question 2

Which of the following processes is described in the statement below?"It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project."

Options :

A : Perform Quantitative Risk Analysis

B : Monitor and Control Risks

C : Identify Risks

D : Perform Qualitative Risk Analysis

Answer: B

Question 3

Which of the following is the PRIMARY reason to have the risk management process reviewed by a third party?

Options :

A : Obtain an objective view of process gaps and systemic errors.

B : Ensure the risk profile is defined and communicated.

C : Validate the threat management process.

D : Obtain objective assessment of the control environment.

Answer: A

Question 4

Which of the following information MUST be included in a business impact analysis (BIA) to facilitate risk assessments related to business continuity?

Options :

A : Critical business processes with their dependent resources

B : List of threats impacting critical business processes

C : Vulnerabilities identified within critical business processes

D : Business continuity and disaster recovery testing requirements

Answer: A

Question 5

Which of the following criteria is MOST important to include in an agreement with a penetration testing vendor?

Options :

A : Scope of the systems to be assessed

B : Steps to remediate identified vulnerabilities

C : Expectations of code escrow safeguards

D : Details of testing methods to be used

Answer: A

Confidently Practice Online with Free CRISC Exam Cram

Buying Options: