CRISC Exam Dumps - Certified in Risk and Information Systems Control

Noncompliance cost reflects the impact or penalties from deviating from policies. Per ISACA governance best practices, exceptions should only be granted when this cost is understood and deemed acceptable relative to business needs.

The best way to ensure ongoing control effectiveness is to measure trends in control performance. This will help to monitor and evaluate how well the controls are achieving their objectives, and to identify any deviations or anomalies that may indicate control failures or weaknesses. Measuring trends in control performance also helps to provide feedback and assurance to the stakeholders and decision makers, and to support continuous improvement andoptimization of the control environment. Establishing policies and procedures, periodically reviewing control design, and obtaining management control attestations are good practices, but they are not the best way to ensure control effectiveness. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1.2, page 1071

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 650.

When the cost of mitigating a risk exceeds the benefit,organizations may adjust their risk toleranceto accept a higher level of risk. Thus, financial feasibility influences how much risk the organization is willing to accept.

Multi-factor authentication (MFA) added to an FTP connection is typically used as acompensating controlwhen the primary mechanism (e.g., legacy FTP protocol without strong encryption or modern authentication support) cannot be fully replaced in the short term. A compensating control provides an alternative safeguard that meets the intent of a required control and affords comparable or enhanced protection. MFA strengthens authentication and reduces the likelihood of unauthorized access, thereby compensating for inherent weaknesses in the underlying protocol or environment. Detective controls identify events after they occur (e.g., logging, monitoring). Deterrent controls discourage attempts (e.g., warning banners, visible cameras). Corrective controls act after an event to restore the system (e.g., backups, patches). Here, MFA is proactive, implemented in place of or in addition to the required stronger protocol, making “compensating” the most appropriate category.

A digital certificate is a document that contains the public key and the identity of the owner of the public key, and is signed by a trusted third party called a certificate authority (CA)1. A digital certificate can be used to ensure the message reaches the intended recipient without alteration, by using the following steps2:

The sender encrypts the message with the recipient’s public key, which can only be decrypted by the recipient’s private key. This ensures the confidentiality of the message, as only the intended recipient can read it.

The sender signs the message with their own private key, which can be verified by anyone who has their public key. This ensures the integrity and authenticity of the message, as it proves that the message has not been tampered with and that it comes from the sender.

The sender attaches their digital certificate to the message, which contains their public key and their identity, and is signed by a CA. This ensures the validity and trustworthiness of the sender’s public key and identity, as it confirms that they have been verified by a CA.

The recipient receives the message and the digital certificate, and verifies the signature of the CA on the digital certificate. This ensures that the digital certificate is genuine and has not been forged or revoked.

The recipient uses the public key from the digital certificate to verify the signature of the sender on the message. This ensures that the message has not been altered and that it comes from the sender.

The recipient uses their own private key to decrypt the message. This ensures that they can read the message.

Therefore, adding a digital certificate is the best way to ensure the message reaches the intended recipient without alteration, as it provides encryption, digital signature, and certificate verification, which are the three main components of secure email communication3. Applying multi-factor authentication, adding a hash to the message, and adding a secret key are not the best ways to ensure the message reaches the intended recipient without alteration, as they do not provide all the components of secure email communication. Applying multi-factor authentication is a technique that requires the user to provide two or more pieces of evidence to prove their identity, such as a password, a code, or a biometric factor4. Multi-factor authentication can enhance the security of the email account, but it does not protect the message itselffrom being intercepted, modified, or impersonated. Adding a hash to the message is a technique that involves applying a mathematical function to the message to generate a fixed-length value, called a hash or a digest, that uniquely represents the message5. A hash can be used to verify the integrity of the message, as any change in the message will result in a different hash. However, ahash does not provide confidentiality or authenticity of the message, as it does not encrypt themessage or identify the sender. Adding a secret key is a technique that involves using a single key, known only to the sender and the recipient, to encrypt and decrypt the message6. A secret key can provide confidentiality of the message, as only the sender and the recipient can read it. However, a secret key does not provide integrity or authenticity of the message, as it does not prevent the message from being altered or spoofed. Moreover, a secret key requires a secure way of exchanging the key between the sender and the recipient, which may not be feasible or reliable over email. References = 1: What is a digital certificate? | Norton2: How to Send Secure Emails in 2023 | A Guide to Secure Email - ProPrivacy3: Secure Email: A Complete Guide for 2023 - StartMail4: What is Multi-Factor Authentication (MFA)? | Duo Security5: What is a Hash Function? | Definition and FAQs6: [What is Symmetric Encryption? | Definition and FAQs]

When preparing a risk status report for periodic review by senior management, it is most important to ensure the report includes risk exposure in business terms. Risk exposure is the potential loss or harm that may result from a risk event. Expressing risk exposure in business terms can help senior management to understand the impact and significance of the risk on the organization’s objectives, performance, and value. A detailed view of individual risk exposures, a summary of incidents that have impacted the organization, and recommendations by an independent risk assessor are other possible contents of the report, but they are not as important as risk exposure in business terms. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 10; CRISC Review Manual, 6th Edition, page 140.

The security risk associated with wearable technology in the workplace is the possibility and impact of unauthorized access, disclosure, or use of the data or information that are collected, stored, or transmitted by the wearable devices, such as smartwatches, fitness trackers, or glasses, that are worn or used by the employees12.

The first step in managing the security risk associated with wearable technology in the workplace is to identify the potential risk, which is the process of recognizing and describing the sources,causes, and consequences of the risk, and the potential impacts on the organization’s objectives, performance, and value creation34.

Identifying the potential risk is the first step because it provides the basis and input for the subsequent steps of the risk management process, such as assessing, treating, monitoring, and communicating the risk34.

Identifying the potential risk is also the first step because it enables the organization to understand and prioritize the risk, and to allocate the appropriate resources and controls for the risk management process34.

The other options are not the first step, but rather possible subsequent steps that may depend on or follow the identification of the potential risk. For example:

Monitoring employee usage is a step that involves collecting and analyzing data and information on the frequency, duration, and purpose of the wearable devices that are used by the employees, and detecting and reporting any deviations, anomalies, or issues that may indicate a security risk5 . However, this step is not the first step because it requires theidentification of the potential risk to provide the guidance and standards for the monitoring process5 .

Assessing the potential risk is a step that involves estimating and evaluating the likelihood and impact of the risk, and the level of risk exposure or tolerance for the organization34. However, this step is not the first step because it requires the identification of the potential risk to provide the information and data for the assessment process34.

Developing risk awareness training is a step that involves educating and training the employees and other stakeholders on the security risks and best practices associated with the wearable technology, and informing them of their roles, obligations, and responsibilities for the risk management process . However, this step is not the first step because it requires the identification of the potential risk to provide the content and objectives for the training process . References =

1: Wearable Devices in the Workplace: Security Threats and Protection1

2: 10 security risks of wearables | CSO Online2

3: Risk IT Framework, ISACA, 2009

4: IT Risk Management Framework, University of Toronto, 2017

5: Continuous Monitoring - ISACA3

Continuous Monitoring: A New Approach to Risk Management - ISACA Journal4

What Is Security Awareness Training and Why Is It Important? - Kaspersky5

Security Awareness Training - Cybersecurity Education Online | Proofpoint US