CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 35
1. What is the most important benefit of classifying information assets?
A) Linking security requirements to business objectives
B) Allotting risk ownership
C) Defining access rights
D) Identifying controls that should be applied
2. You are the project manager of GHT project. A risk event has occurred in your project and you have identified it. Which of the following tasks you would do in reaction to risk event occurrence? Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Monitor risk
B) Maintain and initiate incident response plans
C) Update risk register
D) Communicate lessons learned from risk events
3. Which of the following parameters would affect the prioritization of the risk responses and development of the risk response plan? Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Importance of the risk
B) Time required to mitigate risk.
C) Effectiveness of the response
D) Cost of the response to reduce risk within tolerance levels
4. Which of the following come under the management class of controls?Each correct answer represents a complete solution. Choose all that apply.(Select 2answers)
A) Risk assessment control
B) Audit and accountability control
C) Program management control
D) Identification and authentication control
5. Which of the following parameters are considered for the selection of risk indicators?Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Size and complexity of the enterprise
B) Type of market in which the enterprise operates
C) Risk appetite and risk tolerance
D) Strategy focus of the enterprise
A) Linking security requirements to business objectives
B) Allotting risk ownership
C) Defining access rights
D) Identifying controls that should be applied
2. You are the project manager of GHT project. A risk event has occurred in your project and you have identified it. Which of the following tasks you would do in reaction to risk event occurrence? Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Monitor risk
B) Maintain and initiate incident response plans
C) Update risk register
D) Communicate lessons learned from risk events
3. Which of the following parameters would affect the prioritization of the risk responses and development of the risk response plan? Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Importance of the risk
B) Time required to mitigate risk.
C) Effectiveness of the response
D) Cost of the response to reduce risk within tolerance levels
4. Which of the following come under the management class of controls?Each correct answer represents a complete solution. Choose all that apply.(Select 2answers)
A) Risk assessment control
B) Audit and accountability control
C) Program management control
D) Identification and authentication control
5. Which of the following parameters are considered for the selection of risk indicators?Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Size and complexity of the enterprise
B) Type of market in which the enterprise operates
C) Risk appetite and risk tolerance
D) Strategy focus of the enterprise
1. Right Answer: D
Explanation: All of the options are directly or indirectly are the advantages of classifying information assets, but the most important benefit amongst them is that appropriate controls can be identified.Incorrect Answers:A, B, C: These all are less significant than identifying controls.
2. Right Answer: A,B,D
Explanation: When the risk events occur then following tasks have to done to react to it: Maintain incident response plans Monitor risk Initiate incident response Communicate lessons learned from risk eventsIncorrect Answers:C: Risk register is updated after applying appropriate risk response and at the time of risk event occurrence.
3. Right Answer: A,C,D
Explanation: The prioritization of the risk responses and development of the risk response plan is influenced by several parameters: Cost of the response to reduce risk within tolerance levels Importance of the risk Capability to implement the response Effectiveness of the response Efficiency of the responseIncorrect Answers:B: Time required to mitigate risk does not influence the prioritization of the risk and development of the risk response plan. It affects the scheduled time of the project.
4. Right Answer: A,C
Explanation: The Management class of controls includes five families. These families include over 40 individual controls. Following is a list of each of the families in theManagement class: Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones. Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour for users. Rules of Behaviour are also called an acceptable use policy. Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability scanning. System and Services Acquisition (SA): The SA family includes any controls related to the purchase of products and services. It also includes controls related to software usage and user installed software. Program Management (PM): This family is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance withFISMA. These controls complement other controls. They don't replace them.Incorrect Answers:B, D: Identification and authentication, and audit and accountability control are technical class of controls.
5. Right Answer: A,B,D
Explanation: Risk indicators are placed at control points within the enterprise and are used to collect data. These collected data are used to measure the risk levels at that point. They also track events or incidents that may indicate a potentially harmful situation.Risk indicators can be in form of logs, alarms and reports. Risk indicators are selected depending on a number of parameters in the internal and external environment, such as: Size and complexity of the enterprise Type of market in which the enterprise operates Strategy focus of the enterpriseIncorrect Answers:C: Risk appetite and risk tolerance are considered when applying various risk responses.
Explanation: All of the options are directly or indirectly are the advantages of classifying information assets, but the most important benefit amongst them is that appropriate controls can be identified.Incorrect Answers:A, B, C: These all are less significant than identifying controls.
2. Right Answer: A,B,D
Explanation: When the risk events occur then following tasks have to done to react to it: Maintain incident response plans Monitor risk Initiate incident response Communicate lessons learned from risk eventsIncorrect Answers:C: Risk register is updated after applying appropriate risk response and at the time of risk event occurrence.
3. Right Answer: A,C,D
Explanation: The prioritization of the risk responses and development of the risk response plan is influenced by several parameters: Cost of the response to reduce risk within tolerance levels Importance of the risk Capability to implement the response Effectiveness of the response Efficiency of the responseIncorrect Answers:B: Time required to mitigate risk does not influence the prioritization of the risk and development of the risk response plan. It affects the scheduled time of the project.
4. Right Answer: A,C
Explanation: The Management class of controls includes five families. These families include over 40 individual controls. Following is a list of each of the families in theManagement class: Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones. Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour for users. Rules of Behaviour are also called an acceptable use policy. Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability scanning. System and Services Acquisition (SA): The SA family includes any controls related to the purchase of products and services. It also includes controls related to software usage and user installed software. Program Management (PM): This family is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance withFISMA. These controls complement other controls. They don't replace them.Incorrect Answers:B, D: Identification and authentication, and audit and accountability control are technical class of controls.
5. Right Answer: A,B,D
Explanation: Risk indicators are placed at control points within the enterprise and are used to collect data. These collected data are used to measure the risk levels at that point. They also track events or incidents that may indicate a potentially harmful situation.Risk indicators can be in form of logs, alarms and reports. Risk indicators are selected depending on a number of parameters in the internal and external environment, such as: Size and complexity of the enterprise Type of market in which the enterprise operates Strategy focus of the enterpriseIncorrect Answers:C: Risk appetite and risk tolerance are considered when applying various risk responses.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment