ISACA Certified in Risk and Information Systems Control (CRISC)

The ISACA Certified in Risk and Information Systems Control (CRISC) validates expertise in identifying and managing enterprise IT risk. It focuses on implementing and maintaining information systems controls to mitigate risks and ensure organizational stability. Achieving the symbol ISACA_CRISC marks a professional as an expert in bridging the gap between technical risk and business impact.

---------- Question 1

An organization plans to outsource its entire IT infrastructure management to a third-party service provider. From a CRISC perspective, what is the most critical aspect to manage during this third-party engagement?

1. Ensuring the service providers logo is prominently displayed on all marketing materials.
2. Verifying the service providers compliance with the organizations information security policies and standards.
3. Negotiating the lowest possible monthly service fee for the contract.
4. Delegating all responsibility for IT security to the third-party provider.

---------- Question 2

A financial institution discovers that unpatched servers containing customer data are accessible from the internet. Which term best describes the unpatched servers in this scenario?

1. Threat.
2. Vulnerability.
3. Risk event.
4. Loss result.

---------- Question 3

An organization is considering a major acquisition that will integrate diverse IT systems and data architectures. A CRISC professional is reviewing the organizational structure for potential IT risk impacts. What is the primary concern regarding organizational structure in this scenario?

1. The physical location of the acquired company's data centers.
2. Duplication of existing software licenses post-acquisition.
3. Potential for unclear roles and responsibilities leading to control gaps and accountability issues.
4. The brand recognition of the acquired company's products in the market.

---------- Question 4

An organization deploys new AI tools for its employees, which process confidential company data. To prevent misuse or accidental data exposure, the CRISC professional initiates a training program focused on secure handling of AI inputs and outputs, identifying AI-specific phishing attempts, and understanding AI ethical guidelines. This initiative directly contributes to what?

1. Business continuity management
2. Enterprise architecture
3. Information security awareness training
4. Disaster recovery management

---------- Question 5

An organization is developing a new cloud-based AI solution to enhance customer service. Which of the following is the most critical initial step for the CRISC professional to ensure alignment with organizational strategy and effective IT risk management?

1. Conduct a detailed technical vulnerability assessment of the cloud platform.
2. Develop a comprehensive incident response plan specifically for AI outages.
3. Understand the organization business objectives, risk appetite, and strategic goals for the AI initiative.
4. Implement a new security awareness training program for all employees on cloud security.

---------- Question 6

A CRISC professional is developing key risk indicators KRIs for the organizations data privacy program. Which characteristic is most crucial for an effective KRI?

1. It should be difficult to measure and highly subjective.
2. It must align with a specific operational procedure and be easy to audit.
3. It should be predictive, providing an early warning of potential risk events.
4. It should reflect the direct financial cost of a past security incident.

---------- Question 7

An organization is monitoring its cybersecurity posture. Which metric would be considered a Key Risk Indicator KRI for potential data breaches?

1. Number of successful phishing emails blocked by the email gateway.
2. Average time to resolve critical security incidents.
3. Percentage of employees completing security awareness training.
4. Total number of network vulnerabilities identified in the last quarter.

---------- Question 8

A major datacenter outage occurs, impacting critical business operations. Which IT principle focuses on restoring business functions and IT systems to a pre-defined operational level after such a disruptive event?

1. Change Management.
2. Project Management.
3. Disaster Recovery Management.
4. System Development Life Cycle.

---------- Question 9

When selecting controls for a new system processing highly sensitive customer data, a CRISC professional applies a recognized framework (e.g., NIST SP 800-53) to ensure comprehensive security coverage. Which phase of control management does this activity primarily fall under?

1. Control implementation
2. Control testing and effectiveness evaluation
3. Control design, selection and analysis
4. Risk monitoring and reporting

---------- Question 10

After implementing new security controls, a CRISC professional compares the remaining risk to the organizations risk tolerance. The risk that remains after the application of controls is best described as what?

1. Inherent risk
2. Enterprise risk
3. Residual risk
4. Acceptable risk

---

Are they useful?

Click here to get 900 more questions to pass this certification at the first try! Explanation for each answer is included!

Follow the below LINKEDIN channel to stay updated about 89+ exams!

Security Engineering Network