CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 18
1. You are working in an enterprise. Your enterprise owned various risks. Which among the following is MOST likely to own the risk to an information system that supports a critical business process?
A) System users
B) Senior management
C) IT director
D) Risk management department
2. Which of the following components ensures that risks are examined for all new proposed change requests in the change control system?
A) Configuration management
B) Scope change control
C) Risk monitoring and control
D) Integrated change control
3. Which of the following are true for threats?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) They can become more imminent as time goes by, or it can diminish
B) They can result in risks from external sources
C) They are possibility
D) They are real
E) They will arise and stay in place until they are properly dealt.
4. Which of the following statements BEST describes policy?
A) A minimum threshold of information security controls that must be implemented
B) A checklist of steps that must be completed to ensure information security
C) An overall statement of information security scope and direction
D) A technology-dependent statement of best practices
5. You are the project manager of GHT project. You have analyzed the risk and applied appropriate controls. In turn, you got residual risk as a result of this. Residual risk can be used to determine which of the following?(Select 2answers)
A) Status of enterprise's risk
B) Appropriate controls to be applied next
C) The area that requires more control
D) Whether the benefits of such controls outweigh the costs
A) System users
B) Senior management
C) IT director
D) Risk management department
2. Which of the following components ensures that risks are examined for all new proposed change requests in the change control system?
A) Configuration management
B) Scope change control
C) Risk monitoring and control
D) Integrated change control
3. Which of the following are true for threats?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) They can become more imminent as time goes by, or it can diminish
B) They can result in risks from external sources
C) They are possibility
D) They are real
E) They will arise and stay in place until they are properly dealt.
4. Which of the following statements BEST describes policy?
A) A minimum threshold of information security controls that must be implemented
B) A checklist of steps that must be completed to ensure information security
C) An overall statement of information security scope and direction
D) A technology-dependent statement of best practices
5. You are the project manager of GHT project. You have analyzed the risk and applied appropriate controls. In turn, you got residual risk as a result of this. Residual risk can be used to determine which of the following?(Select 2answers)
A) Status of enterprise's risk
B) Appropriate controls to be applied next
C) The area that requires more control
D) Whether the benefits of such controls outweigh the costs
1. Right Answer: B
Explanation: Senior management is responsible for the acceptance and mitigation of all risk. Hence they will also own the risk to an information system that supports a critical business process.Incorrect Answers:A: The system users are responsible for utilizing the system properly and following procedures, but they do not own the risk.C: The IT director manages the IT systems on behalf of the business owners.D: The risk management department determines and reports on level of risk, but does not own the risk. Risk is owned by senior management.
2. Right Answer: D
Explanation: Integrated change control is the component that is responsible for reviewing all aspects of a change's impact on a project - including risks that may be introduced by the new change.Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.Incorrect Answers:A: Configuration management controls and documents changes to the features and functions of the product scope.B: Scope change control focuses on the processes to allow changes to enter the project scope.C: Risk monitoring and control is not part of the change control system, so this choice is not valid.
3. Right Answer: A,B,D
Explanation: Threat is an act of coercion wherein an act is proposed to elicit a negative response. Threats are real, while the vulnerabilities are a possibility. They can result in risks from external sources, and can become imminent by time or can diminish.Incorrect Answers:C, E: These two are true for vulnerability, but not threat. Unlike the threat, vulnerabilities are possibility and can result in risks from internal sources. They will arise and stay in place until they are properly dealt.
4. Right Answer: C
Explanation: A policy is an executive mandate which helps in identifying a topic that contains particular risks to avoid or prevent. Policies are high-level documents signed by a person of high authority with the power to force cooperation. The policy is a simple document stating that a particular high-level control objective is important to the organization's success. Policies are usually only one page in length. The authority of the person mandating a policy will determine the scope of implementation.Hence in other words, policy is an overall statement of information security scope and direction.Incorrect Answers:A, B, D: These are not the valid definitions of the policy.
5. Right Answer: C,D
Explanation: Residual risk can be used by management to determine: Which areas require more control Whether the benefits of such controls outweigh the costs As residual risk is the output that comes after applying appropriate controls, so it can also estimate the area which need more sophisticated control. If the cost of control is large that its benefits then no control is applied, hence residual risk can determine benefits of these controls over cost.Incorrect Answers:A: Status of enterprise's risk can be determined only after risk monitoring.B: Appropriate control can only be determined as the result of risk assessment, not through residual risk.
Explanation: Senior management is responsible for the acceptance and mitigation of all risk. Hence they will also own the risk to an information system that supports a critical business process.Incorrect Answers:A: The system users are responsible for utilizing the system properly and following procedures, but they do not own the risk.C: The IT director manages the IT systems on behalf of the business owners.D: The risk management department determines and reports on level of risk, but does not own the risk. Risk is owned by senior management.
2. Right Answer: D
Explanation: Integrated change control is the component that is responsible for reviewing all aspects of a change's impact on a project - including risks that may be introduced by the new change.Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.Incorrect Answers:A: Configuration management controls and documents changes to the features and functions of the product scope.B: Scope change control focuses on the processes to allow changes to enter the project scope.C: Risk monitoring and control is not part of the change control system, so this choice is not valid.
3. Right Answer: A,B,D
Explanation: Threat is an act of coercion wherein an act is proposed to elicit a negative response. Threats are real, while the vulnerabilities are a possibility. They can result in risks from external sources, and can become imminent by time or can diminish.Incorrect Answers:C, E: These two are true for vulnerability, but not threat. Unlike the threat, vulnerabilities are possibility and can result in risks from internal sources. They will arise and stay in place until they are properly dealt.
4. Right Answer: C
Explanation: A policy is an executive mandate which helps in identifying a topic that contains particular risks to avoid or prevent. Policies are high-level documents signed by a person of high authority with the power to force cooperation. The policy is a simple document stating that a particular high-level control objective is important to the organization's success. Policies are usually only one page in length. The authority of the person mandating a policy will determine the scope of implementation.Hence in other words, policy is an overall statement of information security scope and direction.Incorrect Answers:A, B, D: These are not the valid definitions of the policy.
5. Right Answer: C,D
Explanation: Residual risk can be used by management to determine: Which areas require more control Whether the benefits of such controls outweigh the costs As residual risk is the output that comes after applying appropriate controls, so it can also estimate the area which need more sophisticated control. If the cost of control is large that its benefits then no control is applied, hence residual risk can determine benefits of these controls over cost.Incorrect Answers:A: Status of enterprise's risk can be determined only after risk monitoring.B: Appropriate control can only be determined as the result of risk assessment, not through residual risk.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment