最新CRISC合格保証試験問題集には正確で最新な問題があります [Q408-Q428]

Rate this post

最新CRISC合格保証試験問題集には正確で最新な問題があります

CRISC試験ブレーン問題集で学習注釈と理論

認定されたリスクおよび情報システム管理（CRISC）認定は、情報システム監査および制御協会（ISACA）から授与された世界的に認められた資格情報です。 CRISC認定は、組織の情報システム内でリスクの特定と管理を担当するIT専門家向けに設計されています。認定は、リスク評価、リスク管理、リスク対応、およびリスクモニタリングに焦点を当てています。

CRISC試験の準備をするには、個人がITリスク管理と情報セキュリティで最低3年の経験を持たなければなりません。この試験では、リスクの識別、評価、対応、監視が含まれる4つのドメインをカバーしています。この試験はコンピューターベースのテストであり、150の複数選択の質問で構成されています。試験は完了するのに4時間かかり、個人は800人中450人のうち450人を獲得するために獲得する必要があります。

質問 408
What is the FIRST phase of IS monitoring and maintenance process?

Report result

Prioritizing risks

Implement monitoring

Identifying controls

質問 409
Which of the following is the MOST effective way to integrate risk and compliance management?

Embedding risk management into compliance decision-making

Designing corrective actions to improve risk response capabilities

Embedding risk management into processes that are aligned with business drivers

Conducting regular self-assessments to verify compliance

質問 410
What are the responsibilities of the CRO?
Each correct answer represents a complete solution. Choose three.

Managing the risk assessment process

Implement corrective actions

Advising Board of Directors

Managing the supporting risk management function

質問 411
Which of the following BEST balances the costs and benefits of managing IT risk*?

Prioritizing and addressing risk in line with risk appetite
. Eliminating risk through preventive and detective controls

Considering risk that can be shared with a third party

Evaluating the probability and impact of risk scenarios

質問 412
Which of the following is MOST important to have in place to ensure the effectiveness of risk and security metrics reporting?

Organizational reporting process

Incident reporting procedures

Regularly scheduled audits

Incident management policy

質問 413
Which of the following is MOST helpful in defining an early-warning threshold associated with insufficient network bandwidth”

Average bandwidth usage

Peak bandwidth usage

Total bandwidth usage

Bandwidth used during business hours

質問 414
The PRIMARY purpose of IT control status reporting is to:

ensure compliance with IT governance strategy.

assist internal audit in evaluating and initiating remediation efforts.

benchmark IT controls with Industry standards.

facilitate the comparison of the current and desired states.

質問 415
Which of the following come under the management class of controls?
Each correct answer represents a complete solution. Choose all that apply.

Risk assessment control

Audit and accountability control

Program management control

Identification and authentication control

Explanation:
The Management class of controls includes five families. These families include over 40 individual controls. Following is a list of each of the families in the Management class: Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones. Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour for users. Rules of Behaviour are also called an acceptable use policy. Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability scanning. System and Services Acquisition (SA): The SA family includes any controls related to the purchase of products and services. It also includes controls related to software usage and user installed software. Program Management (PM): This family is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance with FISMA. These controls complement other controls. They don’t replace them.

質問 416
The best way to test the operational effectiveness of a data backup procedure is to:

inspect a selection of audit trails and backup logs

conduct an audit of files stored offsite

demonstrate a successful recovery from backup files

interview employees to compare actual with expected procedures

質問 417
A review of an organization’s controls has determined its data loss prevention (DLP) system is currently failing to detect outgoing emails containing credit card data.
Which of the following would be MOST impacted?

Risk appetite

Residual risk

Key risk indicators (KRIs)

Inherent risk

質問 418
Which of the following would be the GREATEST challenge when implementing a corporate risk framework for a global organization?

Privacy risk controls

Business continuity

Risk taxonomy

Management support

質問 419
Which of the following parameters are considered for the selection of risk indicators?
Each correct answer represents a part of the solution. Choose three.

Size and complexity of the enterprise

Type of market in which the enterprise operates

Risk appetite and risk tolerance

Strategy focus of the enterprise

質問 420
A business unit has decided to accept the risk of implementing an off-the-shelf, commercial software package that uses weak password controls. The BEST course of action would be to:

obtain management approval for policy exception.

develop an improved password software routine.

select another application with strong password controls.

continue the implementation with no changes.

質問 421
The BEST metric to demonstrate that servers are configured securely is the total number of servers:

exceeding availability thresholds

experiencing hardware failures

exceeding current patching standards.

meeting the baseline for hardening.

質問 422
Which of The following is the MOST relevant information to include in a risk management strategy?

Quantified risk triggers

Cost of controls

Regulatory requirements

Organizational goals

質問 423
You are the project manager of the GHY Project for your company. You need to complete a project management process that will be on the lookout for new risks, changing risks, and risks that are now outdated.
Which project management process is responsible for these actions?

Risk planning

Risk monitoring and controlling

Risk identification

Risk analysis

質問 424
You are the risk professional of your enterprise. Your enterprise has introduced new systems in many departments. The business requirements that were to be addressed by the new system are still unfulfilled, and the process has been a waste of resources. Even if the system is implemented, it will most likely be underutilized and not maintained making it obsolete in a short period of time. What kind of risk is it?

Inherent risk

Business risk

Project risk

Residual risk

質問 425
It is MOST important for a risk practitioner to have an awareness of an organization s processes in order to:

perform a business impact analysis.

identify potential sources of risk.

establish risk guidelines.

understand control design.

質問 426
During a routine check, a system administrator identifies unusual activity indicating an intruder within a firewall.
Which of the following controls has MOST likely been compromised?

Authentication

Identification

Data validation

Data integrity

質問 427
You are the project manager of your enterprise. While performing risk management, you are given a task to identify where your enterprise stands in certain practice and also to suggest the priorities for improvements. Which of the following models would you use to accomplish this task?

Capability maturity model

Decision tree model

Fishbone model

Simulation tree model

質問 428
When reviewing a risk response strategy, senior management’s PRIMARY focus should be placed on the:

cost-benefit analysis.

investment portfolio.

key performance indicators (KPIs).

alignment with risk appetite.

CRISC認定を取得することは、情報システムリスク管理の分野において優れた専門性とプロフェッショナリズムに対する個人の取り組みを示します。この認定は、個人が情報システムリスクを特定、評価、管理し、情報システムコントロールを設計および実装するために必要な知識とスキルを持っていることを証明します。また、CRISC認定は、世界中の雇用主によって広く認知され尊重されているため、就職市場において競争優位性を提供します。

合格させるISACA CRISCテスト練習問題試験問題集：https://www.passtest.jp/ISACA/CRISC-shiken.html