ISACA Certified in Risk and Information Systems Control - CRISC FREE EXAM DUMPS QUESTIONS & ANSWERS

A. The IT steering committee determined the application recovery priorities. B. The disaster recovery plan (DRP) does not identify a hot site. C. The call list in the plan was last updated a year ago. D. Risk scenarios used for the plan were last tested two years ago.

A. Audit security awareness training materials. B. Conduct social engineering testing. C. Perform a vulnerability assessment. D. Administer an end-of-training quiz.

A. Provide information security awareness training B. Establish an inventory of information assets C. Establish security management processes and procedures D. Define information retention requirements and policies

A. Conduct user acceptance testing. B. Perform a post-implementation review. C. Interview process owners. D. Review the key performance indicators (KPIs).

A. risk-based capital allocation B. risk portfolio C. risk culture D. risk classification methods

A. report identified IT risk scenarios to senior management. B. validate the organization ' s data classification scheme. C. understand the organization ' s information security policy. D. review alignment with the organizations strategy.

A. The risk owner is in a business unit and does not report through the IT department. B. The risk owner is a staff member rather than a department manager. C. The risk owner is not the control owner for associated data controls. D. The risk owner is listed as the department responsible for decision-making.

A. Risk tolerance B. Risk profile C. Risk appetite D. Risk capacity

A. To determine the inherent risk level B. To determine the acceptable risk level C. To determine the current risk level D. To determine the desired risk level

A. Report it to the chief risk officer. B. Advise the employee to forward the email to the phishing team. C. follow incident reporting procedures. D. Advise the employee to permanently delete the email.