2024年最新の実際に出るCRISC問題集には試験のコツがあるPDF試験材料
心強いCRISCPDF問題集はCRISC問題
CRISC認定を取得することで、プロフェッショナルにさまざまなメリットがあります。リスク管理と情報システムコントロールにおける専門知識を示すことで、キャリアの見通しを向上させることができます。また、収益性を高め、プロフェッショナルな成長と昇進の機会を提供することもできます。さらに、CRISC認定は、IT業界の最新の動向やベストプラクティスに対応するためのプロフェッショナルのサポートにもなります。
CRISC試験に合格するには、候補者は、リスク管理と情報システムの制御に関連する原則と概念の深い理解を示す必要があります。この試験は厳密で挑戦的であり、かなりの量の研究と準備が必要です。ただし、試験に合格した人は、ITリスク管理と情報セキュリティの分野で多くのキャリアの機会を開くことができる、非常に尊敬され、貴重な資格情報で報われます。
質問 # 402
Which of the following BEST indicates whether security awareness training is effective?
- A. Course evaluation
- B. User behavior after training
- C. User self-assessment
- D. Quality of training materials
正解：B
解説：
Section: Volume D
質問 # 403
Which of following is NOT used for measurement of Critical Success Factors of the project?
- A. Customer service
- B. Productivity
- C. Quantity
- D. Quality
正解：C
解説：
Explanation/Reference:
Incorrect Answers:
A, B, D: Productivity, quality and customer service are used for evaluating critical service factor of any particular project.
質問 # 404
An organization is planning to outsource its payroll function to an external service provider Which of the following should be the MOST important consideration when selecting the provider?
- A. Disaster recovery plan (DRP) of the system
- B. Right to audit the provider
- C. Transparency of key performance indicators (KPIs)
- D. Internal controls to ensure data privacy
正解：B
質問 # 405
Which of the following is MOST important when developing risk scenarios?
- A. The scenarios include technical consequences.
- B. The scenarios focus on current vulnerabilities.
- C. The scenarios are relevant to the organization.
- D. The scenarios are based on industry best practice.
正解：C
質問 # 406
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor's control environment?
- A. Regulatory examination
- B. Internal audit
- C. External audit
- D. Vendor performance scorecard
正解：C
質問 # 407
You are the project manager of HWD project. It requires installation of some electrical machines. You and the project team decided to hire an electrician as electrical work can be too dangerous to perform. What type of risk response are you following?
- A. Acceptance
- B. Avoidance
- C. Mitigation
- D. Transference
正解：D
解説：
Section: Volume B
Explanation:
As the risk is transferred to the third party (electrician), hence this type of risk response is transference.
Incorrect Answers:
A: Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event. Risk avoidance is applied when the level of risk, even after the applying controls, would be greater than the risk tolerance level of the enterprise.
C: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level. Risk mitigation can utilize various forms of control carefully integrated together.
D: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs.
質問 # 408
Which of the following documents is described in the statement below?
"It is developed along with all processes of the risk management. It contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning."
- A. Risk register
- B. Project charter
- C. Risk management plan
- D. is incorrect. The quality management plan is a component of the project management plan. It describes how the project team will implement the organization's quality policy. The quality management plan addresses quality control (QC), quality assurance (QA), and continuous process improvement for the project. Based on the requirement of the project, the quality management plan may be formal or informal, highly detailed or broadly framed. Answer:B is incorrect. Risk management plan includes roles and responsibilities, risk analysis definitions, timing for reviews, and risk threshold. The Plan Risk Responses process takes input from risk management plan and risk register to define the risk response.
- E. Quality management plan
- F. Explanation:
Risk register is a document that contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning. Risk register is developed along with all processes of the risk management from Plan Risk Management through Monitor and Control Risks.
正解：A
解説：
is incorrect. The project charter is the document that formally authorizes a project. The project charter provides the project manager with the authority to apply organizational resources to project activities.
質問 # 409
Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?
- A. Response time of the emergency action plan
- B. Cost of downtime due to a disaster
- C. Cost of testing the business continuity plan
- D. Cost of offsite backup premises
正解：B
質問 # 410
Which of the following is PRIMARILY responsible for providing assurance to the board of directors and senior management during the evaluation of a risk management program implementation?
- A. Internal audit
- B. Business units
- C. Risk management
- D. External audit
正解：A
解説：
* Role of Internal Audit:
* Independent Assurance: Internal audit provides an independent assessment of the effectiveness of the risk management program, offering assurance to the board of directors and senior management.
* Objective Evaluation: They evaluate whether the risk management processes are properly designed and operating effectively.
* Responsibilities of Internal Audit:
* Review Risk Management Implementation: Assess how well the risk management program has been implemented and whether it meets the organization's goals.
* Compliance Check: Ensure that the risk management program complies with relevant regulations and standards.
* Reporting: Provide detailed reports to the board and senior management on the effectiveness and efficiency of the risk management program.
* Comparison with Other Options:
* Risk Management: While involved in the implementation, they are not independent and therefore cannot provide objective assurance.
* Business Units: They are responsible for managing risks but not for providing independent assurance.
* External Audit: While they provide assurance, their scope is generally broader and less frequent compared to the continuous oversight by internal audit.
* Best Practices:
* Regular Audits: Conduct regular audits to ensure continuous improvement and alignment with organizational goals.
* Stakeholder Communication: Maintain clear communication channels between internal audit, the board, and senior management.
* CRISC Review Manual: Emphasizes the importance of internal audit in providing assurance to the board and senior management on the effectiveness of the risk management program.
* ISACA Standards: Highlight the critical role of internal audit in risk governance and compliance.
References:
質問 # 411
Which of the following is the BEST way to mitigate the risk to IT infrastructure availability?
- A. Establishing recovery time objectives (RTOs)
- B. Maintaining a risk register
- C. Establishing a disaster recovery plan (DRP)
- D. Maintaining a current list of staff contact delays
正解：B
質問 # 412
An organization retains footage from its data center security camera for 30 days when the policy requires
90-day retention The business owner challenges whether the situation is worth remediating Which of the following is the risk manager s BEST response'
- A. Highlight news articles about data breaches
- B. Identify the regulatory bodies that may highlight this gap
- C. Evaluate the risk as a measure of probable loss
- D. Verify if competitors comply with a similar policy
正解：C
解説：
A risk is the possibility of an event that may have a negative impact on the achievement of an organization's objectives. A risk can be measured by the probability and impact of the event, which indicate the likelihood and consequence of the event. A risk manager is a person who is responsible for performing risk management activities, such as identifying, analyzing, evaluating, treating, monitoring, and communicating risks. When an organization retains footage from its data center security camera for 30 days when the policy requires 90-day retention, the risk manager's best response to the business owner who challenges whether the situation is worth remediating is to evaluate the risk as a measure of probable loss, which means to estimate the potential harm or damage that may result from the non-compliance with the policy. By evaluating the risk as a measure of probable loss, the risk manager can provide the business owner with the rationale and justification for the risk remediation, and help the business owner to understand the cost-benefit analysis of the risk response. References = CRISC Review Manual, 7th Edition, page 63.
質問 # 413
Henry is the project sponsor of the JQ Project and Nancy is the project manager. Henry has asked Nancy to start the risk identification process for the project, but Nancy insists that the project team be involved in the process. Why should the project team be involved in the risk identification?
- A. So that the project team and the project manager can work together to assign risk ownership.
- B. So that the project manager can identify the risk owners for the risks within the project and the needed risk responses.
- C. So that the project team can develop a sense of ownership for the risks and associated risk responsibilities.
- D. So that the project manager isn't the only person identifying the risk events within the project.
正解：C
解説：
Explanation/Reference:
Explanation:
The best answer to include the project team members is that they'll need to develop a sense of ownership for the risks and associated risk responsibilities.
Incorrect Answers:
B: The reason to include the project team is that the project team needs to develop a sense of ownership for the risks and associated risk responsibilities, not to assign risk ownership and risk responses at this point.
C: While the project manager shouldn't be the only person to identify the risk events, this isn't the best answer.
D: The reason to include the project team is that the project team needs to develop a sense of ownership for the risks and associated risk responsibilities, not to assign risk ownership.
質問 # 414
A risk practitioner has been asked by executives to explain how existing risk treatment plans would affect risk posture at the end of the year. Which of the following is MOST helpful in responding to this request?
- A. Assessing risk with no controls in place
- B. Showing projected residual risk
- C. Providing peer benchmarking results
- D. Assessing risk with current controls in place
正解：B
解説：
Showing projected residual risk is the most helpful way to respond to the request of explaining how existing risk treatment plans would affect risk posture at the end of the year. Residual risk is the level of risk that remains after the implementation of risk responses1. Projected residual risk is the estimated level of risk that will remain at a future point in time, based on the assumptions and expectations of the risk responses2. By showing projected residual risk, the risk practitioner can:
* Demonstrate the effectiveness and efficiency of the risk treatment plans, and how they reduce the risk level from the inherent risk (the risk before the risk responses) to the residual risk3.
* Compare the projected residual risk with the risk appetite and tolerance, which are the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives4. This can help to determine whether the projected residual risk is acceptable or not, and whether the risk treatment plans are consistent and proportional to the risk level5.
* Identify and address any gaps, issues, or challenges that may affect the achievement of the projected residual risk, and recommend and implement appropriate improvement actions or contingency plans6.
The other options are not the most helpful ways to respond to the request, because:
* Assessing risk with no controls in place is not the most helpful way, as it does not reflect the current or future risk posture of the organization. Controls are the measures or actions that are implemented to modify the risk, such as prevent, detect, correct, or mitigate the risk7. Assessing risk with no controls in place can help to measure the inherent risk, but it does not show the impact or outcome of the risk treatment plans.
* Providing peer benchmarking results is not the most helpful way, as it does not reflect the specific or unique risk profile of the organization. Peer benchmarking is the process of comparing the organization's risk level and performance with its peers or competitors, based on a common set of criteria or indicators8. Providing peer benchmarking results can help to provide a reference or a standard for the risk posture, but it does not show the effect or result of the risk treatment plans.
* Assessing risk with current controls in place is not the most helpful way, as it does not reflect the future or projected risk posture of the organization. Assessing risk with current controls in place can help to measure the current residual risk, but it does not show the expected or estimated residual risk at the end of the year.
References =
* Residual Risk - CIO Wiki
* Projected Residual Risk - CIO Wiki
* Risk Treatment Plan - CIO Wiki
* Risk Appetite and Tolerance - CIO Wiki
* Risk Appetite: What It Is and Why It Matters - Gartner
* Risk Monitoring and Review - The National Academies Press
* Control - CIO Wiki
* Benchmarking - CIO Wiki
* [Risk Treatment - CIO Wiki]
質問 # 415
Which of the following is the MAIN reason for documenting the performance of controls?
- A. Justifying return on investment
- B. Demonstrating effective risk mitigation
- C. Providing accurate risk reporting
- D. Obtaining management sign-off
正解：B
解説：
Section: Volume D
Explanation/Reference:
質問 # 416
The PRIMARY reason to implement a formalized risk taxonomy is to:
- A. improve visibility of overall risk exposure.
- B. demonstrate best industry practice.
- C. comply with regulatory requirements.
- D. reduce subjectivity in risk management.
正解：D
解説：
The primary reason to implement a formalized risk taxonomy is to reduce subjectivity in risk management, as it provides a common and consistent language and structure for identifying, classifying, and reporting risks, and facilitates the comparison and aggregation of risks across the organization. The other options are not the primary reasons, as they are more related to the outcomes, benefits, or drivers of risk management, respectively, rather than the reason for risk management. References = CRISC Review Manual, 7th Edition, page 100.
質問 # 417
Which of the following is MOST important to understand when developing key risk indicators (KRIs)?
- A. KRI thresholds
- B. Stakeholder requirements
- C. Control environment
- D. Integrity of the source data
正解：B
解説：
Key risk indicators (KRIs) are metrics used by organizations to monitor and assess potential risks that may impact their objectives and performance. KRIs also provide early warning signals that help organizations identify, analyze, and address risks before they escalate into significant issues1. The most important factor to understand when developing KRIs is stakeholder requirements, which are the needs and expectations of the persons or entities that have an interest or influence in the organization's risk management2. By understanding stakeholder requirements, the organization can ensure that the KRIs are aligned with the organization's strategy, vision, and mission, and that they reflect the current and emerging risks and their potential consequences. Understanding stakeholder requirements can also help to establish and communicate the roles and responsibilities of the stakeholders, and to enforce the accountability and performance of the risk management. KRI thresholds, integrity of the source data, and control environment are not the most important factors to understand when developing KRIs, as they do not provide the same level of insight and relevance as stakeholder requirements. KRI thresholds are the values or ranges that indicate the level of risk exposure and the need for action or escalation3. KRI thresholds can help to measure and monitor the performance and compliance of the risk management, but they do not ensure that the KRIs are appropriate and accurate for the organization's risk profile. Integrity of the source data is the quality and reliability of the data that are used to support or enable the development of KRIs4. Integrity of the source data can enhance the validity and consistency of the KRIs, but it does not ensure that the KRIs are comprehensive and compatible with the organization's risk environment. Control environment is the set of policies, processes, and systems that provide the foundation and structure for the risk management5. Control environment can improve the security and efficiency of the risk management, but it does not ensure that the KRIs are relevant and realistic for the organization's risk objectives and strategies. References = 1: Key Risk Indicators: A Practical Guide | SafetyCulture2: Stakeholder Requirements - an overview | ScienceDirect Topics3: Risk Threshold: Definition, Meaning & Example - PM Study Circle4: Data Integrity - an overview | ScienceDirect Topics5: Control Environment - an overview | ScienceDirect Topics : [Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.1: Key Risk Indicators, pp. 181-185.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.1: Control Design, pp. 233-235.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.2: Control Implementation, pp. 243-245.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.3: Control Monitoring and Maintenance, pp. 251-253.]
質問 # 418
You are the risk professional in Bluewell Inc. A risk is identified and enterprise wants to quickly implement control by applying technical solution that deviates from the company's policies. What you should do?
- A. Recommend revision of the current policy
- B. Conduct a risk assessment and allow or disallow based on the outcome
- C. Explanation:
If it is necessary to quickly implement control by applying technical solution that deviates from the company's policies, then risk assessment should be conducted to clarify the risk. It is up to the management to accept the risk or to mitigate it. - D. Recommend against implementation because it violates the company's policies
- E. Recommend a risk assessment and subsequent implementation only if residual risk is accepted
正解：E
解説：
is incorrect. Risk professional can only recommend the risk assessment if the company's policies is violating, but it can only be conducted when the management allows. Answer: A is incorrect. As in this case it is important to mitigate the risk, hence risk professional should once recommend a risk assessment. Though the decision for the conduction of risk assessment in case of violation of company's policy, is taken by management. Answer: B is incorrect. The recommendation to revise the current policy should not be triggered by a single request.
質問 # 419
Suppose you are working in Company Inc. and you are using risk scenarios for estimating the likelihood and impact of the significant risks on this organization. Which of the following assessment are you doing?
- A. Risk assessment
- B. IT security assessment
- C. Threat and vulnerability assessment
- D. IT audit
正解：C
解説：
Explanation/Reference:
Explanation:
Threat and vulnerability assessment consider the full spectrum of risks. It identifies the likelihood of occurrence of risks and impact of the significant risks on the organization using the risk scenarios. For example: Natural threats can be evaluated by using historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, etc.
Incorrect Answers:
A, B: These use either some technical evaluation tool or assessment methodologies to evaluate risk but do not use risk scenarios.
D: Risk assessment uses quantitative and qualitative analysis approaches to evaluate each significant risk identified.
質問 # 420
A department allows multiple users to perform maintenance on a system using a single set of credentials. A risk practitioner determined this practice to be high-risk. Which of the following is the MOST effective way to mitigate this risk?
- A. Audit trail review
- B. Data encryption at rest
- C. Multi-factor authentication
- D. Single sign-on
正解：A
質問 # 421
Which of the following provides the MOST reliable evidence to support conclusions after completing an information systems controls assessment?
- A. Risk and control self-assessment (CSA) reports
- B. Control environment narratives
- C. Confirmation from industry peers
- D. Information generated by the systems
正解：D
解説：
The source that provides the most reliable evidence to support conclusions after completing an information systems controls assessment is the information generated by the systems, as it reflects the actual and objective data and results of the system operations and performance, and can be verified and tested against the control objectives and criteria. The other options are not the most reliable sources, as they may be subjective, biased, or incomplete, and may not reflect the actual or current state of the system controls, respectively. References = CRISC Review Manual, 7th Edition, page 154.
質問 # 422
An organization operates in an environment where the impact of ransomware attacks is high, with a low likelihood. After quantifying the impact of the risk associated with ransomware attacks exceeds the organization's risk appetite and tolerance, which of the following is the risk practitioner's BEST recommendation?
- A. Adjust the organization's risk appetite and tolerance.
- B. Ensure business continuity assessments are up to date.
- C. Obtain adequate cybersecurity insurance coverage.
- D. Obtain certification to a global information security standard.
正解：B
質問 # 423
An organization uses one centralized single sign-on (SSO) control to cover many applications. Which of the following is the BEST course of action when a new application is added to the environment after testing of the SSO control has been completed?
- A. Re-evaluate the control during (he next assessment
- B. Review the corresponding change control documentation
- C. Initiate a retest of the full control
- D. Retest the control using the new application as the only sample.
正解：C
解説：
The best course of action when a new application is added to the environment after testing of the SSO control has been completed is to initiate a retest of the full control, as it may reveal any new issues or gaps that the new application may introduce to the SSO control, and ensure that the control remains effective and adequate.
Retesting the control using the new application as the only sample, reviewing the corresponding change control documentation, and re-evaluating the control during the next assessment are not the best courses of action, as they may not provide sufficient assurance, evidence, or timeliness of the control testing, respectively. References = CRISC Review Manual, 7th Edition, page 154.
質問 # 424
Which of the following would BEST help to address the risk associated with malicious outsiders modifying application data?
- A. Acceptable use policies
- B. Multi-factor authentication
- C. Activation of control audits
- D. Role-based access controls
正解：B
質問 # 425
What are the key control activities to be done to ensure business alignment?
Each correct answer represents a part of the solution. Choose two.
- A. Define the business requirements for the management of data by IT
- B. Periodically identify critical data that affect business operations
- C. Establish an independent test task force that keeps track of all events
- D. Conduct IT continuity tests on a regular basis or when there are major changes in the IT infrastructure
正解：A、B
解説：
Section: Volume D
Explanation:
Business alignment require following control activities:
* Defining the business requirements for the management of data by IT.
* Periodically identifying critical data that affect business operations, in alignment with the risk management model and IT service as well as the business continuity plan.
Incorrect Answers:
B: Conducting IT continuity tests on a regular basis or when there are major changes in the IT infrastructure is done for testing IT continuity plan. It does not ensure alignment with business.
D: This is not a valid answer.
質問 # 426
Which of the following BEST enables senior management lo compare the ratings of risk scenarios?
- A. Risk heat map
- B. Key performance indicators (KPIs)
- C. Control self-assessment (CSA)
- D. Key risk indicators (KRIs)
正解：A
質問 # 427
......
結果を保証するには最新2024年11月無料：https://jp.fast2test.com/CRISC-premium-file.html
正真正銘のCRISC問題集で無料PDF問題で合格させる：https://drive.google.com/open?id=1p_OjPRaWkElIj0hf8XPmaUFRJFrGZqPn