ISACA CRISC Practice Test

Answer choices

1. A. Implement immediate system isolation and a full security audit, for the described technical objective and its associated operational control requirements.
2. B. Conduct a detailed technical analysis of the outdated protocols to identify specific vulnerabilities, for the stated governance (26%) requirement.
3. C. Escalate the issue to executive management for immediate system replacement, for the described technical objective and its associated operational control requirements.
4. D. Facilitate a workshop to assess the team’s understanding of risk and promote a culture of proactive risk management.

Wrong-answer review

• A. Implement immediate system isolation and a full security audit, for the described technical objective and its associated operational control requirements.: While system isolation might be necessary eventually, it's a reactive measure that doesn't address the underlying cultural issue. Immediate isolation could also disrupt critical operations without addressing the root cause of the vulnerability's continued use. The governing body’s mandate emphasizes cultural review, not immediate isolation.
• B. Conduct a detailed technical analysis of the outdated protocols to identify specific vulnerabilities, for the stated governance (26%) requirement.: A technical analysis is important, but it's a secondary step. Addressing the team's understanding of risk is paramount to prevent future occurrences and aligns with the governing body's directive to review operational culture. Technical analysis alone won't change behavior.
• C. Escalate the issue to executive management for immediate system replacement, for the described technical objective and its associated operational control requirements.: Immediate system replacement is a costly and disruptive solution. It doesn't address the underlying cultural issues that led to the vulnerability's continued use and bypasses the governing body's mandate for a cultural review. Replacement should be considered after understanding the root cause.

Answer choices

1. A. Require the vendor to replace its identity platform before defining accountability, for the described technical objective and its associated operational control requirements, in context.
2. B. Define and validate the organization’s and vendor’s risk/control ownership, decision rights, and escalation responsibilities for privileged access, then address the control gaps, within this design.
3. C. Transfer all access-control accountability to the vendor because it operates the application, for the described technical objective and its associated operational control requirements, under this approach.
4. D. Terminate the vendor contract because access responsibilities were not documented, for the described technical objective and its associated operational control requirements, under the described governance (26%) criteria.

Answer choices

1. A. Implement immediate encryption of all data at rest and in transit, without first reconciling existing security controls, as the proposed technology and security (20%) approach.
2. B. Establish a formal data governance framework defining roles, responsibilities, and policies for data management, including data classification and access controls, within the technology and security (20%) context.
3. C. Conduct a thorough impact assessment of the migration on existing data security controls, identifying potential gaps and required adjustments, for the required outcome.
4. D. Develop a comprehensive data retention policy based on legal and regulatory requirements, focusing primarily on storage duration, for the described technical objective and its associated operational control requirements.

Answer choices

1. A. Immediately implement a comprehensive risk mitigation strategy, as the organization’s selected response.
2. B. Accept the scenarios and rely on existing regulatory compliance, as presented.
3. C. Conduct a detailed business impact analysis to identify critical processes, for the required business outcome.
4. D. Ignore the scenarios and focus solely on current operational risks, for the stated risk assessment (22%) requirement.

Answer choices

1. A. Develop a detailed risk response plan, including control improvements and communication to stakeholders, as the selected response to the described condition.
2. B. Immediately implement a new, stricter risk limit without further discussion, within the documented scope, ownership, and validation boundaries.
3. C. Escalate the issue to senior management for immediate action, under end-to-end security-and-governance requirements.
4. D. Document the risk acceptance decision and cease further investigation, under the documented operational and governance requirements.

Answer choices

1. A. Escalate the vulnerability to the appropriate regulatory body immediately, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, in the described situation.
2. B. Initiate a formal incident response plan, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, under the organization’s defined implementation and exception-management process.
3. C. Conduct a thorough risk assessment and implement compensating controls, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, for this requirement.
4. D. Use the established operations and risk processes to assess the vulnerability, implement approved interim safeguards if needed, define change and incident contingencies, and obtain a risk decision from the authorized owner before production use, within cross-functional operational-accountability boundaries.

Answer choices

1. A. Immediately implement a full-scale emergency response plan, without first reconciling the cost, under the documented operational and governance requirements.
2. B. Implement additional controls to reduce the inherent risk to an acceptable level, under the organization’s defined implementation and exception-management process.
3. C. Accept the inherent risk, documenting the rationale and ongoing monitoring, for the required operational result and control objective.
4. D. Conduct a residual risk assessment to determine the remaining risk after considering the effectiveness of existing controls.

Answer choices

1. A. Renegotiate every vendor contract before reconciling the data, for the described technical objective and its associated operational control requirements, under this approach.
2. B. Establish common data definitions, ownership, lineage, and validation criteria with the relevant control owners and vendors before aggregating the information for reporting, as presented.
3. C. Average the vendor metrics so all providers can be compared on one scale, for the described technical objective and its associated operational control requirements, in the described situation.
4. D. Report each vendor’s figures exactly as received and explain the differences in a footnote, for the described technical objective and its associated operational control requirements, in the described situation.

Answer choices

1. A. Immediately implement compensating controls to reduce the risk to an acceptable level, for the specified implementation requirement.
2. B. Document the risk acceptance decision and maintain a detailed record of the rationale, including stakeholder approvals, within the described context.
3. C. Ignore the risk acceptance decision and escalate the issue to senior management, for the stated implementation and support requirements.
4. D. Conduct a comprehensive audit of the control system’s design and implementation, as the recommended implementation across the complete governed service lifecycle.

Answer choices

1. A. Require every vendor to deploy the same encryption product, for the described technical objective and its associated operational control requirements, for the specified implementation requirement.
2. B. Map and classify the personal data and its lifecycle across the vendor relationships, including purpose, location, access, retention, and disposal, before selecting additional privacy controls, as the recommended response to this scenario.
3. C. Purchase cyber insurance covering all processors, for the described technical objective and its associated operational control requirements, as the selected approach for the stated technical and business outcome, as selected.
4. D. Terminate the vendor with the largest volume of data, for the described technical objective and its associated operational control requirements, under the described technology and security (20%) criteria.