Question 1

Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?

Options :

A : Cost of the information control system.

B : Cost versus benefit of additional mitigating controls.

C : Annualized loss expectancy (ALE) for the system.

D : Frequency of business impact.

Answer: C

Question 2

Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?

Options :

A : User management coordination does not exist

B : Audit recommendations may not be implemented

C : Users may have unauthorized access to originate, modify or delete data

D : Specific user accountability cannot be established

Answer: C

Question 3

Which of the following are sub-categories of threat?Each correct answer represents a complete solution. (Choose three.)

Options :

A : Natural and supernatural

B : Computer and user

C : Natural and man-made

D : Intentional and accidental

E : External and internal

Answer: A,C,D

Question 4

Static code analysis has been consistently finding a significant number of critical security issues throughout an organization's internally developed applications. The risk practitioner’s BEST recommendation would be to:

Options :

A : provide training on secure programming practices.

B : conduct penetration tests before code implementation.

C : outsource software development.

D : conduct security design reviews.

Answer: A

Question 5

You work as a project manager for SoftTech Inc. You are working with the project stakeholders to begin the qualitative risk analysis process. Which of the following inputs will be needed for the qualitative risk analysis process in your project?Each correct answer represents a complete solution. (Choose three.)

Options :

A : Project scope statement

B : Cost management plan

C : Risk register

D : Organizational process assets

Answer: A,C,D

Confidently Practice Online with Free CRISC Exam Cram

Buying Options: