HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: Certified in Risk and Information Systems Control (CRISC)
Provider: ISACA
Exam code: CRISC (ISACA identifies the exam by certification name; no separate numeric exam code
listed)
Exam duration: 4 hours
Question count: 150 multiple-choice questions
Passing score: 450 on a 200–800 scaled score
Exam fee (USD): ISACA member: US$575; nonmember: US$760 (confirm current regional taxes and
checkout price)

Course Questions

10 Questions

An organization is implementing an enterprise risk management program. What should the risk practitioner do FIRST?

A. Select a risk software tool B. Understand business objectives, governance, and risk appetite C. Create a list of controls without context D. Transfer all risks to the IT department

A new cloud service will store sensitive business data. What is the best initial risk activity?

A. Accept the service without review B. Identify assets, threats, vulnerabilities, dependencies, and business impact C. Start with a penetration test only D. Wait until an incident occurs

Two risks have equal likelihood, but one could interrupt a critical service and the other affects a noncritical test system. Which should receive greater attention?

A. The test system because it is easier to fix B. The critical service risk due to greater business impact C. Both must always be ranked identically D. Neither requires treatment

A risk exceeds the organization's approved tolerance. What should the risk owner do?

A. Ignore the tolerance B. Select and implement an appropriate treatment or obtain authorized exception/acceptance C. Delete the risk register entry D. Transfer accountability to the auditor

A security team identifies a business risk but does not own the affected process. Who should be accountable for deciding whether to accept the business risk?

A. Any security analyst B. The authorized business risk owner C. The software developer alone D. The external auditor

A risk register lists risks but has no owners, treatment plans, or due dates. What is the main deficiency?

A. The register has too much detail B. It does not support accountability, tracking, and treatment execution C. It should contain passwords instead D. Risk registers are never useful

A control is documented but has never been tested. How should its effectiveness be treated?

A. Assume it is effective because it is documented B. Validate design and operating effectiveness using appropriate evidence C. Remove it from the risk process D. Mark the risk as eliminated

A supplier will process sensitive data and has privileged network access. What is the best risk-management approach?

A. Trust the supplier without evidence B. Perform risk-based due diligence, define contractual requirements, and monitor the relationship C. Give the supplier permanent unrestricted access D. Assess the supplier only after contract expiry

A risk manager wants early warning that privileged access is expanding beyond approved levels. Which metric is most useful?

A. Number of office desks B. Trend in excessive or unreviewed privileged accounts C. Total number of emails sent D. Number of project meetings

Executives need to decide whether to fund a mitigation project. Which report is most useful?

A. A raw technical vulnerability export only B. Business impact, likelihood, residual risk, treatment options, cost, and expected risk reduction C. A list of vendor logos D. A report without assumptions

₹4999.00 ₹1999.00

Enroll Now

CRISC