CRISC Exam Dumps - Certified in Risk and Information Systems Control

According to the CRISC Review Manual, notifying network administrators before testing is the best mitigating control to reduce the risk introduced when conducting penetration tests, because it helps to avoid any disruption or damage to the network services and systems. Penetration testing is a technique that simulates an attack on the network to identify and exploit the vulnerabilities and weaknesses. Notifying network administrators before testing allows them to prepare for the test, monitor the test activities, and respond to any incidents or issues that may arise during the test. The other options are not the best mitigating controls, because they do not address the risk of network disruption or damage. Requiring the vendor to sign a nondisclosure agreement is a legal measure that protects the confidentiality of the network information, but it does not prevent the vendor from causing any harm to the network. Clearly defining the project scope is a planning activity that sets the boundaries and objectives of the test, but it does not ensure the safety and availability of the network. Performing background checks on the vendor is a due diligence activity that verifies the vendor’s credentials and reputation, but it does not guarantee the vendor’s performance or behavior. References = CRISC Review Manual, 7th Edition, Chapter 4, Section 4.2.2, page 181.

ï‚· Importance of a Risk Register:

A risk register is a critical tool for documenting, tracking, and managing risks within an organization. It serves as a central repository for all identified risks, detailing their status, impact, likelihood, and the actions taken to mitigate them.

A regularly updated risk register demonstrates an active and ongoing risk management process, reflecting the organization ' s commitment to identifying and addressing risks promptly.

ï‚· Evidence of Robust Risk Management:

The risk register shows the organization ' s proactive approach to risk management by continuously monitoring and updating risks.

It provides transparency and accountability, allowing stakeholders to see how risks are being managed and mitigated over time.

Regular updates ensure that new risks are identified and existing risks are reassessed, indicating a dynamic and responsive risk management practice.

ï‚· Comparing Other Options:

Management-Approved Risk Dashboard:While useful for summarizing risk information, a dashboard does not provide the detailed, ongoing updates and comprehensive tracking found in a risk register.

Current Control Framework:A control framework outlines the controls in place but does not detail specific risks or their management.

Regularly Updated Risk Management Procedures:Procedures are important but do not provide the same level of detailed risk tracking and management as a risk register.

ï‚· References:

The CRISC Review Manual emphasizes the importance of a risk register in consolidating and tracking risk data, making it an essential component of robust risk management practices (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.6 Risk Register)​​ .

A third-party security assessment report is the most helpful to ensure effective security controls for a cloud service provider, because it provides an independent and objective evaluation of the cloud provider’s security posture, policies, and practices. A third-party security assessment report can help to verify and validate the cloud provider’s compliance with the relevant standards, regulations, and best practices, such as ISO 27001, PCI DSS, NIST, or CSA. A third-party security assessment report can also help to identify and address any gaps, weaknesses, or vulnerabilities in the cloud provider’s security controls, and to provide recommendations and guidance for improvement. A third-party security assessment report can also help to increase the trust and confidence of the cloud customers, and to facilitate the due diligence and risk management processes. The other options are less helpful to ensure effective security controls for a cloud service provider. A control self-assessment is a process that enables the cloud provider to assess its own security controls, using a predefined framework or questionnaire. However, a control self-assessment may not be as reliable or comprehensive as a third-party security assessment report, as it may be biased, incomplete, or inaccurate, and it may not cover all the aspects or dimensions of security. Internal audit reports from the vendor are documents that provide the results and findings of the internal audits conducted by the cloud provider’s ownauditors, to verify and validate the effectiveness and efficiency of the securitycontrols. However, internal audit reports from the vendor may not be as credible or trustworthy as a third-party security assessment report, as they may be influenced by the cloud provider’s interests, objectives, or agenda, and they may not follow the same standards or criteria as the external auditors. Service level agreement monitoring is a process that measures and evaluates the performance and availability of the cloud services, based on the predefined metrics and targets agreed between the cloud provider and the cloud customer. However, service level agreement monitoring may not be sufficient or relevant to ensure effective security controls for a cloud service provider, as it may not address the security aspects or requirements of the cloud services, such as confidentiality, integrity, or accountability, and it may not reflect the actual security risks or incidents that may occur in the cloud environment. References = Cloud Security Controls: Key Elements and 4 Control Frameworks 1

According to the Guide to Implementing an IT Risk Management Framework, the first activity that should be performed when establishing IT risk management processes is to assess the goals and culture of the organization. This is because the goals and culture of the organization define the context and scope of the IT risk management process, and influence the risk appetite and tolerance of the organization. By assessing the goals and culture of the organization, the IT risk manager can align the IT risk management process with the organization’s strategy, vision, mission, values, and objectives. The IT risk manager can also identify the key stakeholders, roles, and responsibilities involved in the IT risk management process, and ensure that they have the necessary skills, knowledge, and resources to perform their tasks effectively. Additionally, the IT risk manager can establish the communication and reporting mechanisms for the IT risk management process, and ensure that they are consistent with the organization’s culture and expectations. References = Guide to Implementing an IT Risk Management Framework, An Overview of the Risk Management Process

Inherent risk reflects exposure before controls. Whenregulatory requirementschange, they can alter compliance obligations, legal exposure, and the baseline inherent risk of processes.

ISACA’s CRISC framework specifies:

“Significant changes to regulatory or legal environments are triggers for reassessing inherent and residual risk.”

A(risk tolerance) affects acceptance, not inherent risk itself.

C(KRIs) andD(benchmarks) measure and compare risk but do not trigger reassessment directly.

Hence,Bis correct.

CRISC Reference:Domain 2 – IT Risk Assessment, Topic: Risk Triggers and Environmental Changes.

The MOST important stakeholders to include during the initial risk identification process for a business application are the business process owners, because they are the ones who have the authority and responsibility for the business processes that are supported or enabled by the business application. The business process owners can provide valuable input and feedback on the business objectives, requirements, and expectations of the business application, as well as thepotential risks, impacts, and opportunities that may affect the business processes and outcomes. The other options are not as important as the business process owners, because:

Option B: Business process consumers are the ones who use or benefit from the business processes that are supported or enabled by the business application, such as customers, employees, or partners. They can provide useful information and perspectives on the user needs, preferences, and satisfaction of the business application, but they are not as important as the business process owners, who have the ultimate accountability and authority for the business processes and outcomes.

Option C: Application architecture team is the one who designs and develops the technical architecture and components of the business application, such as the hardware, software, network, and data. They can provide technical expertise and guidance on the feasibility, functionality, and security of the business application, but they are not as important as the business process owners, who have the primary stake and interest in the business application and its alignment with the business processes and objectives.

Option D: Internal audit is the one who provides independent assurance and consulting services on the governance, risk management, and control processes of the organization, including the business application. They can provide objective and impartial evaluation and recommendation on the effectiveness and efficiency of the business application and its compliance with the internal and external standards and regulations, but they are not as important as the businessprocess owners, who have the direct involvement and influence on the business application and its performance and value. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 103.

Warning banners on login screens serve as deterrent controls. Deterrent controls are designed to discourage individuals from attempting unauthorized actions by warning them of potential consequences.

Purpose of Warning Banners

Warning banners provide clear notice to users, both authorized and unauthorized, that their activities may be monitored and that unauthorized access is prohibited.

They serve as a legal disclaimer, which can be crucial in prosecuting unauthorized access attempts.

Effectiveness as a Deterrent Control

The primary function of a warning banner is to deter potential intruders by making them aware of the surveillance and legal implications of unauthorized access.

For authorized users, it reinforces awareness of the organization ' s security policies and acceptable use agreements.

Comparison with Other Control Types

A. Corrective: These controls are used to correct or restore systems after an incident.

B. Preventive: These controls are designed to prevent security incidents from occurring.

C. Detective: These controls are used to detect and alert about security incidents.

D. Deterrent: These controls are intended to discourage individuals from performing unauthorized activities.

References

Sybex-CISSP-Official-Study-Guide-9-Edition.pdf, p. 829, detailing the role of warning banners as deterrent controls​​.

The risk profile is the most important thing to reassess when an organization implements new technologies that enable the use of robotic process automation (RPA). The risk profile is a comprehensive and dynamic view of the organization’s risks, their ratings, responses, and status. RPA can introduce new risks or change the existing risks related to the organization’s objectives, operations, and performance. For example, RPA can create risks such as system failures, databreaches, compliance violations, human errors, or ethical dilemmas. Therefore, the organization should reassess its risk profile to identify, assess, treat, monitor, and review the risks associated with RPA, and to ensure that the risk management strategy is aligned with the business needs and expectations.