Free CRISC Certification Questions and Answers

Question 1

When defining risk management methods, which of the following should be determined as being MOST important?

Accepted Answer

Business objectives and operations

Answer

IT architecture complexity

Answer

Risk assessment criteria

Answer

Enterprise disaster recovery plan

Question 2

The BIGGEST danger associated with not having a strategy is:

Accepted Answer

improper oversight of IT investment

Answer

increase in the number of licensing violation

Answer

unresolved current and past problems

Answer

increase in the number of obsolete systems

Question 3

Where would the data ethics function MOST likely reside in an enterprise, based on the three lines of defense model?

Accepted Answer

The second line of defense

Answer

The third line of defense

Answer

The first line of defense

Answer

The board of directors

Question 4

Which of the following factors should the cost-benefit analysis of a two-factor authentication system contain the MOST?

Accepted Answer

The total cost of ownership

Answer

The frequency of incidents

Answer

The annual loss expectancy of security incidents

Answer

The approved budget of the project

Question 5

Which of the following BEST guarantees that identified information system vulnerabilities are appropriately mitigated?

Accepted Answer

Assigning action plans with deadlines to responsible personnel.

Answer

Incorporating the findings into the annual report to shareholders.

Answer

Presenting root cause analysis to the management of the enterprise

Answer

Implementing software to input the action points.

Question 6

What is the MOST crucial protection that needs to be in place to prevent abuse of the company's social media account?

Accepted Answer

Two-factor authentication

Answer

Awareness training

Answer

Strong passwords

Answer

Social media account monitoring

Question 7

After the likelihood of a loss event has been estimated, which of the following criteria should be evaluated?

Accepted Answer

Magnitude of impact

Answer

Compensating controls

Answer

Residual risk

Answer

Risk tolerance