[Dec-2022] Download Real CRISC Exam Dumps for candidates 100% Free Dump Files [Q322-Q338]

4/5 - (1 vote)

[Dec-2022] Download Real CRISC Exam Dumps for candidates. 100% Free Dump Files

Prepare Important Exam with CRISC Exam Dumps(2022)

Exam Overview

The CRISC certification exam is made up of 150 multiple-choice questions and the time allotted for its completion is 240 minutes. The candidates can take it in Chinese (Simplified and Traditional), English, German, French, Italian, Korean, Japanese, Spanish, and Turkish. The passing score is 450 points (out of 800).

To register for the test, the students must pay the required fee. For the ISACA members, it is $575, while for the non-members – $760. This exam is administered through the PSI testing centers across the world. You can take it at any time because registration is always on-going. After making payment, you can schedule your test as early as 48 hours. However, make sure that you understand its content before you attempt the exam to avoid retaking it. If you do not pass the test, you will have to pay another fee.

NO.322 Which among the following acts as a trigger for risk response process?

Risk level increases above risk appetite

Risk level increase above risk tolerance

Risk level equates risk appetite

Risk level equates the risk tolerance

Explanation:
The risk response process is triggered when a risk exceeds the enterprise’s risk tolerance level. The acceptable variation relative to the achievement of an objective is termed as risk tolerance. In other words, risk tolerance is the acceptable deviation from the level set by the risk appetite and business objectives. Risk tolerance is defined at the enterprise level by the board and clearly communicated to all stakeholders. A process should be in place to review and approve any exceptions to such standards.

and A are incorrect. Risk appetite level is not relevant in triggering of risk response process. Risk appetite is the amount of risk a company or other entity is willing to accept in pursuit of its mission. This is the responsibility of the board to decide risk appetite of an enterprise. When considering the risk appetite levels for the enterprise, the followingtwo major factors should be taken into account: The enterprise’s objective capacity to absorb loss, e.g., financial loss, reputation damage, etc. The culture towards risk taking-cautious or aggressive. In other words, the amount of loss the enterprise wants to accept in pursue of its objective fulfillment. Answer: D is incorrect. Risk response process is triggered when the risk level increases the risk tolerance level of the enterprise, and not when it just equates the risk tolerance level.

NO.323 Which of the following is a KEY outcome of risk ownership?

Risk-related information is communicated

Risk responsibilities are addressed

Risk-oriented tasks are defined

Business process risk is analyzed

Section: Volume D

NO.324 Which of the following is the MOST effective method for indicating that the risk level is approaching a high or unacceptable level of risk?

Risk register

Cause and effect diagram

Risk indicator

Return on investment

Explanation/Reference:
Explanation:
Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.
Incorrect Answers:
A: A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks.
Typically a risk register contains:
A description of the risk

The impact should this event actually occur

The probability of its occurrence

Risk Score (the multiplication of Probability and Impact)

A summary of the planned response should the event occur

A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the

event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

D: Return On Investment (ROI) is a performance measure used to evaluate the efficiency of an investment or to compare the efficiency of a number of different investments. To calculate ROI, the benefit (return) of an investment is divided by the cost of the investment; the result is expressed as a percentage or a ratio.
The return on investment formula:
ROI= (Gain from investment – Cost of investment) / Cost of investment
In the above formula “gains from investment”, refers to the proceeds obtained from selling the investment of interest.

NO.325 Which of the following should be the risk practitioner’s FIRST course of action when an organization plans to adopt a cloud computing strategy?

Request a budget for implementation

Conduct a threat analysis.

Create a cloud computing policy.

Perform a controls assessment.

NO.326 A risk practitioner is preparing a report to communicate changes in the risk and control environment. The BEST way to engage stakeholder attention is to:

include a roadmap to achieve operational excellence

include a summary linking information to stakeholder needs

publish the report on-demand for stakeholders

include detailed deviations from industry benchmarks

Section: Volume D

NO.327 Out of several risk responses, which of the following risk responses is used for negative risk events?

Enhance

Exploit

Explanation:
Among the given choices only Acceptance response is used for negative risk events. Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can acceptthe risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active. Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk.
Active acceptance is the second strategy and might include developing contingency plans and
reserves to deal with risks.

A, and B are incorrect. These all are used to deal with opportunities or positive risks,
and not with negative risks.

NO.328 You are the project manager of GHT project. You have initiated the project and conducted the feasibility study.
What result would you get after conducting feasibility study?
Each correct answer represents a complete solution. (Choose two.)

Recommend alternatives and course of action

Risk response plan

Project management plan

Results of criteria analyzed, like costs, benefits, risk, resources required and organizational impact

Section: Volume B
Explanation:
The completed feasibility study results should include a cost/benefit analysis report that:
* Provides the results of criteria analyzed (e.g., costs, benefits, risk, resources required and organizational impact)
* Recommends one of the alternatives and a course of action
Incorrect Answers:
B, C: Project management plan and risk response plan are the results of plan project management and plan risk response, respectively. They are not the result of feasibility study.

NO.329 Which of the following is true for risk management frameworks, standards and practices?
Each correct answer represents a part of the solution. Choose three.

They act as a guide to focus efforts of variant teams.

They result in increase in cost of training, operation and performance improvement.

They provide a systematic view of “things to be considered” that could harm clients or an enterprise.

They assist in achieving business objectives quickly and easily.

Section: Volume C
Explanation:
Frameworks, standards and practices are necessary as:
* They provide a systematic view of “things to be considered” that could harm clients or an enterprise.
* They act as a guide to focus efforts of variant teams.
* They save time and revenue, such as training costs, operational costs and performance improvement costs.
* They assist in achieving business objectives quickly and easily.

NO.330 Which of the following is the PRIMARY reason for conducting peer reviews of risk analysis?

To enhance compliance with standards

To minimize subjectivity of assessments

To increase consensus among peers

To provide assessments for benchmarking

NO.331 Which of the following is the MOST important requirement for monitoring key risk indicators (KRIs) using log analysis?

Collecting logs from the entire set of IT systems

Providing accurate logs in a timely manner

Implementing an automated log analysis tool

Obtaining logs in an easily readable format

Section: Volume D

NO.332 Which of the following is the MAIN reason for analyzing risk scenarios?

Establishing a risk appetite

Identifying additional risk scenarios

Updating the heat map

Assessing loss expectancy

Section: Volume D

NO.333 Which of the following would BEST help secure online financial transactions from improper users?

Multi-factor authentication

Periodic review of audit trails

Multi-level authorization

Review of log-in attempts

Section: Volume D
Explanation

NO.334 You work as a project manager for SoftTech Inc. You are working with the project stakeholders to begin the qualitative risk analysis process. Which of the following inputs will be needed for the qualitative risk analysis process in your project?
Each correct answer represents a complete solution. Choose all that apply.

Project scope statement

Cost management plan

Risk register

Organizational process assets

Explanation:
The primary goal of qualitative risk analysis is to determine proportion of effect and theoretical response. The inputs to the Qualitative Risk Analysis process are: Organizational process assets Project Scope Statement Risk Management Plan Risk Register

is incorrect. The cost management plan is the input to the perform quantitative risk analysis process.

NO.335 Of the following, who is accountable for ensuing the effectiveness of a control to mitigate risk?

Control owner

Risk manager

Control operator

Risk treatment owner

NO.336 Which among the following is the BEST reason for defining a risk response?

To eliminate risk from the enterprise

To ensure that the residual risk is within the limits of the risk appetite and tolerance

To overview current status of risk

To mitigate risk

Explanation/Reference:
Explanation:
The purpose of defining a risk response is to ensure that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is based on selecting the correct, prioritized response to risk, based on the level of risk, the enterprise’s risk tolerance and the cost or benefit of the particular risk response option.
Incorrect Answers:
A: Risk cannot be completely eliminated from the enterprise.
C: This is not a valid answer.
D: Mitigation of risk is itself the risk response process, not the reason behind this.

NO.337 Which of the following would be the result of a significant increase in the motivation of a malicious threat actor?

Increase in mitigating control costs

Increase in risk event impact

Increase in risk event likelihood

Increase in cybersecurity premium

NO.338 Which of the following is the MOST important responsibility of a risk owner?

Testing control design

Accepting residual risk

Establishing business information criteria

Establishing the risk register

Loading …