CRISC Exam Dumps - Certified in Risk and Information Systems Control

IT risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of IT-related threats or opportunities on the organization’s objectives, performance, or value creation12.

Business risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of business-related threats or opportunities on the organization’s objectives, performance, or value creation34.

The best way for the risk practitioner to address the concerns of the business executives who question why they have been assigned ownership of IT-related risk scenarios is to describe IT risk scenarios in terms of business risk, which is a technique that involves translating and communicating the IT risk scenarios into the language and context of the business risk scenarios, and highlighting the linkages and dependencies between them56.

Describing IT risk scenarios in terms of business risk is the best way because it helps the business executives to understand and appreciate the relevance and importance of IT risk scenarios, andhow they affect the achievement of the organization’s goals and the delivery of value to the stakeholders56.

Describing IT risk scenarios in terms of business risk is also the best way because it helps the business executives to accept and fulfill their roles and responsibilities as the owners of IT risk scenarios, and to collaborate and coordinate with the IT team and other stakeholders in the risk management process56.

The other options are not the best ways, but rather possible alternatives or supplements that may support or enhance the description of IT risk scenarios in terms of business risk. For example:

Recommending the formation of an executive risk council to oversee IT risk is a way that involves establishing and empowering a group of senior leaders from different business units and functions to provide the strategic direction, guidance, and oversight for the IT risk managementprocess78. However, this way is not the best way because it does not directlyaddress the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be feasible or effective without a clear and common understanding of IT risk scenarios among the council members78.

Providing an estimate of IT system downtime if IT risk materializes is a way that involves quantifying and communicating the potential loss or disruption of the IT systems or services that support the organization’s operations, if the IT risk scenarios occur9 . However, this way is not the best way because it does not fully capture or convey the impact of IT risk scenarios on the organization’s objectives, performance, or valuecreation, and it may not be relevant or meaningful for some IT risk scenarios that are not related to IT system downtime9 .

Educating business executives on IT risk concepts is a way that involves providing and delivering the knowledge and skills on the principles, frameworks, and techniques of IT risk management, and the roles and responsibilities of the IT risk owners and stakeholders . However, this way is not the best way because it does not specifically address the concerns of the business executives who question why they have been assigned ownership of IT risk scenarios, and it may not be sufficient or effective without a practical and contextual application of IT risk concepts to the organization’s situation and goals . References =

1: IT Scenario Analysis in Enterprise Risk Management - ISACA2

2: New Toolkit and Course From ISACA Help Practitioners Develop Risk Scenarios - ISACA1

3: Business Risk - Investopedia3

4: Business Risk: Definition, Types, Examples & How to Manage4

5: Risk IT Framework, ISACA, 2009

6: IT Risk Management Framework, University of Toronto, 2017

7: Executive Risk Council - ISACA5

8: Executive Risk Council: A Guide to Success6

9: IT System Downtime - ISACA7

IT System Downtime: Causes, Costs, and How to Prevent It8

IT Risk Education - ISACA9

IT Risk Education: A Guide to Success

The correct answer is C because corrective action must be initiated by the party that owns the affected business process/risk. The risk report should go to the person or group that can take action, accept the risk, fund the treatment, or direct remediation. The uploaded CRISC notes state: “The PRIMARY objective of risk reporting is to provide the risk owner with information to initiate risk response,” and also state that ownership is best established by mapping identified risk to a specific business process.

The CFO, CRO, and CIO may need to be informed depending on severity, but the business process owner is the best recipient when the purpose is to initiate corrective action.

===========

Risk avoidance involves ceasing activities that expose the organization to significant risks, such as shutting down the sales order system. This decision aligns withRisk Treatment Strategiesaimed at eliminating exposure.

A cyber intrusion is an unauthorized or malicious access to a computer system or network by an attacker. A cyber intrusion can compromise the confidentiality, integrity, or availability of the system or network, as well as the data and services that it hosts. A cyber intrusion can also cause damage, disruption, or theft to the organization or its stakeholders. One of the best ways toprevent cyber intrusion is to strengthen vulnerability remediation efforts, which means to identify and fix the weaknesses or flaws in the system or network that can be exploited by the attackers. Vulnerability remediation efforts can include conducting regularvulnerability assessments, applying security patches and updates, configuring security settings and policies, and implementing security controls and measures. By strengthening vulnerability remediation efforts, the organization can reduce the attack surface and the likelihood of cyber intrusion, as well as enhance the resilience and protection of the system or network. The other options are not the best recommendations for preventing cyber intrusion, although they may be helpful and complementary. Establishing a cyber response plan is a technique to prepare for and respond to a cyber incident, such as a cyber intrusion, by defining the roles, responsibilities, procedures, and resources that are needed to manage and recover from the incident. However, a cyber response plan is a reactive and contingency measure, while strengthening vulnerability remediation efforts is a proactive and preventive measure. Implementing data loss prevention (DLP) tools is a technology that tries to detect and stop sensitive data breaches, or data leakage incidents, in an organization. DLP tools can help to protect the data from being disclosed to an unauthorized person, whether it is deliberate or accidental. However, DLP tools do not prevent cyber intrusion itself, as they only focus on the data, not the system or network. Implementing network segregation is a method to divide a network into smaller segments or subnetworks, each with its own security policies and controls. Network segregation can help to isolate and contain the impact of a cyber intrusion, as well as to limit the access and movement of the attackers within the network. However, network segregation does not prevent cyber intrusion from occurring, as it does not address thevulnerabilities or flaws in the system or network. References = CRISC Review Manual, pages 164-1651; CRISC Review Questions, Answers & Explanations Manual, page 902; What Are Security Controls? - F53; Assessing Security Controls: Keystone of the Risk Management … - ISACA4

 The risk treatment response that should be reflected in the risk register when an IT department decides to keep the data center in-house instead of outsourcing it to an overseas location is risk avoidance. Risk avoidance is a risk response strategy that involves eliminating the source of the risk, or changing the plan or scope of the activity, to avoid the risk altogether. Risk avoidance can help to reduce the risk exposure and impact to zero, by removing the possibility of the risk occurrence. In this case, the IT department avoids the risk of outsourcing the data center to an overseas location, which could involve various threats, vulnerabilities, and uncertainties, such as data security, legal compliance, service quality, communication, or cultural issues. By keeping the data center in-house, the IT department maintains the control and ownership of the data center, and eliminates the potential risk associated with the outsourcing. Risk mitigation, risk acceptance, and risk transfer are not the correct risk treatment responses, as they do not reflect the actual decision and action taken by the IT department, and they do not eliminate the risk source or occurrence. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 51.

Nonrepudiation is the ability to prevent or deny the parties involved in an electronic transaction from disputing or rejecting the validity or authenticity of the transaction. Nonrepudiation ensures that the parties cannot claim that they did not send or receive the transaction, or that the transaction was altered or tampered with.

The tool that helps ensure compliance with a nonrepudiation policy requirement for electronic transactions is digital signatures, which are the electronic equivalents of handwritten signatures that are used to verify the identity and integrity of the sender and the content of the transaction. Digital signatures are generated by applying a cryptographic algorithm to the transaction, using the sender’s private key, which is a secret and unique code that only the sender knows and possesses. The digital signature can be verified by the receiver or any third party, using the sender’s public key, which is a code that is publicly available and corresponds to the sender’s private key. The digital signature can prove that the transaction was sent by the sender, and that the transaction was not altered or tampered with during the transmission.

The other options are not the tools that help ensure compliance with a nonrepudiation policy requirement for electronic transactions, because they do not provide the same level ofverification and validation that digital signatures provide, and they may not be sufficient or effective to prevent or deny the parties from disputing or rejecting the transaction.

Encrypted passwords are the passwords that are converted into a secret or unreadable form, using a cryptographic algorithm, to protect them from unauthorized access or disclosure. Encrypted passwords can help to ensure the confidentiality and security of the passwords, but they are not the tools that help ensure compliance with a nonrepudiation policy requirement for electronic transactions, because they do not verify the identity and integrity of the sender and the content of the transaction, and they may not prevent or deny the parties from disputing or rejecting the transaction.

One-time passwords are the passwords that are valid or usable for only one session or transaction, and that are randomly generated or derived from a dynamic factor, such as time, location, or device. One-time passwords can help to enhance the security and authentication of the parties involved in the transaction, but they are not the tools that help ensure compliance with a nonrepudiation policy requirement for electronic transactions, because they do not verify the identity and integrity of the sender and the content of the transaction, and they may not prevent or deny the parties from disputing or rejecting the transaction.

Digital certificates are the electronic documents that contain the information and credentials of the parties involved in the transaction, such as their name, public key, expirationdate, etc., and that are issued and signed by a trusted authority or entity, such as a certificate authority or a digital signature provider. Digital certificates can help to establish and confirm the identity and trustworthiness of the parties involved in the transaction, but they are not the tools that help ensure compliance with a nonrepudiation policy requirement for electronic transactions, because they do not verify the identity and integrity of the sender and the content of the transaction, and they may not prevent or deny the parties from disputing or rejecting the transaction. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 197

CRISC Practice Quiz and Exam Prep

 Risk scenarios provide the MOST helpful information in identifying risk in an organization, because they describe the possible events, causes, effects, and impacts of a risk on the organization’s objectives and processes. Risk scenarios help to identify the sources, drivers, and indicators of risk, as well as the potential consequences and likelihood of occurrence. The other options are not as helpful as risk scenarios, because:

Option A: Risk registers are tools to document and track the identified risks, their characteristics, and their status, but they do not provide information on how to identify risks in the first place.

Option B: Risk analysis is a process to assess the likelihood and impact of the identified risks, and to prioritize them based on their severity, but it does not provide information on how to identify risks in the first place.

Option D: Risk responses are actions to address the identified risks, either by reducing, transferring, avoiding, or accepting them, but they do not provide information on how to identify risks in the first place. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 105.