CRISC Exam Dumps - Certified in Risk and Information Systems Control

Senior management’s role in the RACI model when tasked with reviewing monthly status reports provided by risk owners is accountable, as it means that they have the ultimate authority and responsibility to approve or reject the risk management decisions and actions, and to oversee the risk management performance and outcomes. The other options are not the correct roles, as they imply different levels or types of involvement or participation in the risk management process, such as being informed, responsible, or consulted, respectively. References = CRISC Review Manual, 7th Edition, page 101.

 According to the CRISC Review Manual, formal approval of the account by the user’s manager is the best evidence that a user account has been properly authorized, because it ensures that the user’s role and access rights are consistent with the business needs and the principle of least privilege. The user’s manager is responsible for verifying the user’s identity, job function, and access requirements, and for approving or rejecting the account request. The other options are not the best evidence of proper authorization, because they do not involve the user’s manager’s approval. An email from the user accepting the account is a confirmation of the account creation, but it does not indicate that the account was authorized by the user’s manager. Notification from human resources that the account is active is an administrative process that does not verify the user’s access rights and role. User privileges matching the request form is a verification of the account configuration, but it does not ensure that the request form was approved by the user’s manager. References = CRISC Review Manual, 7th Edition, Chapter 4, Section 4.1.2, page 163.

The correct answer isDbecause the most important reason for usingimmutable backupsfrom a data protection and regulatory compliance perspective is that the datacannot be tampered with. The key compliance value of immutability is preserving integrity and protecting records from unauthorized alteration or deletion. This is especially important when proving that protected data and retained records remain trustworthy.

The other options are less important in this context:

A. Immutable backups can be used for data recovery testingis beneficial, but not the main regulatory reason.

B. Data contains time stamps that indicate when it was backed upis useful information, but not the core compliance value.

C. Immutable backups enable effective disaster recovery responseis important operationally, but the question emphasizes data protection and regulatory compliance.

Exact Extracts supporting the answer:

“The BEST method that provides message integrity authentication of the sender ' s identity and nonrepudiation is digital signatures.”

“The MOST important consideration when transmitting personal information across networks is ensuring the privacy of the personal information.”

“The purpose of system certification is to demonstrate that security controls and processes are assessed for effectiveness.”

“The MOST important principle of data protection that a risk practitioner should advocate for is that data should be accurate.”

These extracts support that from a compliance and data protection perspective, preserving integrity and preventing tampering is the highest concern. Therefore,Dis the best answer.

===========

Key Control Indicators (KCIs) are metrics used to monitor the performance of controls. Their primary benefit is the early detection of control degradation, allowing organizations to take corrective actions before issues escalate into significant problems.

The very first action in vulnerability management is confirmingwhether the affected technology exists in the organization’s environment.

CRISC notes:

“Before prioritizing or mitigating, it is critical to determine whether the enterprise uses the affected asset or service.”

If the organization isnot usingthe affected technology, no further response is required.

After that, severity and mitigating controls are reviewed.

Hence,Cis correct.

CRISC Reference:Domain 2 – IT Risk Assessment, Topic: Vulnerability and Asset Validation.

Identifying specific risk events provides the foundational input for creating relevant and actionable risk scenarios. These scenarios form the basis of assessing potential impacts and determining effective controls. This is a key step in theRisk Identification and Assessmentprocess.

The correct answer isBbecausered team exercisesare the best method to identify weaknesses in the technical environment that an attacker could exploit to gain access. A red team exercise simulates realistic attacker behavior and therefore provides a direct and practical way to discover exploitable security weaknesses across systems, defenses, and operational response capabilities.

The other options are not as effective:

A. Threat modelingis useful for identifying possible attack paths and design weaknesses, but it is more analytical than practical.

C. System testingis broad and may not focus specifically on adversarial exploitation.

D. Control self-assessments (CSAs)rely on internal review and are less effective for uncovering attacker-leveraged technical weaknesses.

Exact Extracts supporting the answer:

“To detect vulnerabilities in Internet-facing systems penetration testing is primarily used as it simulates real attacker actions to test security defenses.”

“For a system owner penetration testing offers the greatest level of assurance regarding the effectiveness of implemented security controls.”

“For an Internet-facing application penetration testing is the most effective control assessment type.”

“The BEST way to ensure a corporate network ' s security against external attacks is to perform periodic penetration testing.”

“After various infrastructure changes are made is the best time to perform a penetration test as changes are likely to introduce new exposures.”

These extracts support the principle that simulated attacker activity is the strongest way to identify technical weaknesses exploitable by attackers. Among the given choices,red team exercisesare the closest and best match to that objective.

===========

Risk appetite and tolerance reflect strategic priorities. As business and external environments evolve, regular updates ensure that risk responses and decisions remain aligned with organizational goals and acceptable boundaries.