Changed CRISC Exam Questions

The best way to mitigate the risk to IT infrastructure availability is to establish a disaster recovery plan (DRP), because a DRP is a document that defines the procedures and resources needed to restore the IT infrastructure and resume the critical business functions in the event of a disaster or disruption. A DRP helps to minimize the downtime, data loss, and financial impact of a disaster, and ensures the continuity of operations and services. The other options are not the best ways to mitigate the risk to IT infrastructure availability, although they may also be helpful in supporting the DRP. Establishing recovery time objectives (RTOs), maintaining a current list of staff contact details, and maintaining a risk register are examples of planning or monitoring activities that aim to define the requirements, roles, and responsibilities for the disaster recovery process, but they do not address the actual implementation or execution of the DRP. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

 The most important consideration when communicating the risk associated with technology end-of-life to business owners is the cost and benefit of the risk response options. Technology end-of-life is the situation when a technology product or service is no longer supported by the vendor or manufacturer, and may pose security, compatibility, or performance issues. The risk practitioner should communicate the cost and benefit of the possible risk responses, such as replacing, upgrading, or maintaining the technology, to the business owners, and help them to make informed and rational decisions. Security and availability, maintainability and reliability, and performance and productivity are other possible considerations, but they are not as important as the cost and benefit. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.

 Cost-benefit analysis is the most helpful tool to show risk reduction based on when developing risk treatment alternatives for a business case, because it compares the expected costs and benefits of each alternative and helps to select the most optimal and feasible one. Cost-benefit analysis also helps to justify the investment and resources required for the risk treatment plan and to demonstrate the value and return of the risk reduction. The other options are not the most helpful tools, although they may also be considered when developing risk treatment alternatives. Risk appetite, regulatory guidelines, and control efficiency are examples of factors or criteria that influence the selection of risk treatment alternatives, but they do not show the risk reduction based on the alternatives. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

 According to the CRISC Review Manual1, single sign-on (SSO) is a method of authentication that allows a user to access multiple systems or applications with a single set of credentials. SSO can improve user convenience and productivity, but it also introduces some security risks. The greatest concern as a result of a single sign-on implementation is that unauthorized access may be gained to multiple systems, as this can compromise the confidentiality, integrity, and availability of the data and resources stored on those systems. If an attacker obtains the SSO credentials of a user, either by phishing, malware, or other means, they can Laccess all the systems or applications that the user is authorized for, without any additional authentication or verification. This can expose the organization to various threats, such as data leakage, theft, loss, corruption, manipulation, or misuse2345. References = CRISC Review Manual1, page 240, 253.