CRISC Questions Bank

A KRI is a measure used by an organization to measure the health of a particular risk. In this case, the risk practitioner is developing a metric to measure the risk associated with security threats that were not identified by antivirus software12.

References

1Standardized Scoring for Security and Risk Metrics - ISACA

2Key Performance Indicators for Security Governance, Part 1 - ISACA

 A recovery time objective (RTO) is the maximum acceptable time that a business process or function can be disrupted or unavailable before it causes significant damage or loss to the organization. A business continuity plan (BCP) is a document that describes how the organization will resume its critical business operations in the event of a disaster or disruption. A disaster recovery plan (DRP) is a document that describes how the organization will restore its IT systems and infrastructure in the event of a disaster or disruption. The RTO defined in the BCP and the DRP should be consistent and aligned, as they both support the continuity and recovery of the business. If the RTO defined in the BCP is shorter than the RTO defined in the DRP, it means that the BCP expects the business process or function to be restored faster than the DRP can provide. This can create a gap or a conflict between the BCP and the DRP, and can compromise the effectiveness and efficiency of the continuity and recovery efforts. Therefore, the best way for the risk practitioner to address this concern is to communicate the discrepancy to the DR manager for follow-up, meaning that the risk practitioner should report the issue and its implications to the DR manager, who is responsible for developing and maintaining the DRP. The DR manager should review the discrepancy and determine whether it is justified or not, and whether it requires any adjustment or alignment of the RTOs in the BCP and the DRP. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.4.2, p. 206-207

Implementing a data masking process is the best method to mitigate the risk of an unauthorized employee viewing confidential data in a database. Data masking is the process of replacing sensitive data with fictitious but realistic data, such as changing names, addresses, phone numbers, etc. Data masking protects the privacy and confidentiality of the data, while still allowing for testing, analysis, or training purposes. Implementing role-based access control, including sanctions in NDAs, and installing a DLP tool are also useful methods to reduce the risk of data exposure, but they are not as effective as data masking, which prevents the data from being accessed in the first place. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.1, page 3-21.

 The primary objective for requiring an independent review of an organization’s IT risk management process should be to assess gaps in IT risk management operations and strategicfocus, as this helps to identify the strengths and weaknesses of the current process, and to provide recommendations for improvement and alignment with the enterprise’s objectives and environment. An independent review is an objective and unbiased evaluation of the IT risk management process by a qualified and competent party that is not involved in the process. An independent review can help to ensure the quality, effectiveness, and efficiency of the IT risk management process, as well as to enhance the credibility and confidence of the process. Confirming that IT risk assessment results are expressed as business impact, verifying implemented controls to reduce the likelihood of threat materialization, and ensuring IT risk management is focused on mitigating potential risk are not the primary objectives for requiring an independent review of an organization’s IT risk management process, but rather the expected outcomes or benefits of the independent review. References = CRISC Certified in Risk and Information Systems Control – Question219; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 219.