CRISC Reviews Questions

A system availability risk scenario is a situation where a system or a service is not accessible or functional due to a failure or an attack. The likelihood of such a scenario depends on the vulnerabilities or weaknesses that exist in the system or the service, and the threats or attackers that could exploit them. Therefore, by scanning the critical systems or services for vulnerabilitiesand analyzing the results, one can estimate the probability or frequency of a system availability risk scenario1.

A vulnerability scan is a process of identifying and evaluating the potential security risks in a system or a service. A vulnerability scan report provides a list of vulnerabilities that have been detected, categorized by their severity levels, and accompanied by remediation recommendations. By reviewing the report, one can understand the current security posture of the system or the service, and the actions that need to be taken to address the vulnerabilities2.

The other options are not the best ways to determine the likelihood of a system availability risk scenario, but rather some of the factors or outcomes of it. Availability of fault tolerant software is a factor that can reduce the likelihood of a system availability risk scenario, as it means that the software can continue to operate without interruption even if some of its components fail. Fault tolerant software can achieve this by using backup or redundant components, or by implementing error detection and correction mechanisms3. Strategic plan for business growth is an outcome of a system availability risk scenario, as it can affect the organization’s objectives and strategies. A system availability risk scenario can have negative impacts on the organization’s performance, reputation, customer satisfaction, and competitive advantage, and thus hamper its growth potential4. Redundancy of technical infrastructure is a factor that can reduce the likelihood of a system availability risk scenario, as it means that the infrastructure has duplicate or alternativedevices or paths that can take over in case of a failure or an attack. Redundancy of technical infrastructure can ensure network availability and prevent data loss5. References =

Describe the risk scenarios | NZ Digital government

How to Read a Vulnerability Scan Report | Evolve Security

Learn about Fault Tolerant Servers | What is Fault Tolerance?-Stratus

The Importance of Redundancies in Your Infrastructure - INAP

What is Redundancy? - Your IT Department

[CRISC Review Manual, 7th Edition]

Defining risk response options is performed after a risk assessment is completed. A risk assessment is the process of identifying, analyzing, and evaluating the risks that affect the enterprise’s objectives and operations. After a risk assessment is completed, the enterprise needs to define the risk response options, which are the actions that can be taken to address the risks.The risk response options include accepting, avoiding, transferring, mitigating, or exploiting the risks. Defining risk response options helps to select the most appropriate and effective strategy to manage the risks. Defining risk taxonomy, identifying vulnerabilities, and conducting an impact analysis are performed before or during a risk assessment, not after. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.4, page 541

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 644.

The primary reason to have risk owners assigned to entries in the risk register is to ensure that risk is treated appropriately, as risk owners are responsible for implementing the risk response strategies and monitoring the risk status and outcomes. Risk owners are also accountable for the risk and its impact on the enterprise’s objectives and operations. Having risk owners assigned to entries in the risk register helps to clarify the roles and responsibilities, improve the communication and coordination, and enhance the effectiveness and efficiency of the risk management process. Mitigating actions are prioritized, risk entries are regularly updated, and risk exposure is minimized are not the primary reasons to have risk owners assigned to entries in the risk register, but rather the results or benefits of having risk owners assigned to entries in the risk register. References = CRISC by Isaca Actual Free Exam Q&As, question 206; CRISC: Certified in Risk & Information Systems Control Sample Questions, question 206.

The data owner is the person who has the authority and responsibility to classify, label, and protect the information assets of the organization. The data owner is accountable for the risk ofpotential loss of confidential information, as they are the ones who determine the level of protection and access required for the data. The risk manager is responsible for identifying, assessing, and mitigating the risks that may affect the organization, but they are not accountable for the data itself. The end user is the person who uses the information assets for their operational tasks, but they are not accountable for the data protection or classification. The IT department is responsible for providing the technical support and infrastructure for the information assets, but they are not accountable for the data ownership or risk management. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.3: Data Classification, p. 69-70.