Isaca Certification CRISC Exam Questions and Answers PDF

The most helpful factor to align when defining thresholds for control key performance indicators (KPIs) is the control performance with the risk tolerance of business owners. Control KPIs are metrics that measurethe effectiveness and efficiency of the controls that are implemented to mitigate the risks. By aligning the control performance with the risk tolerance of business owners, the thresholds for control KPIs can reflect the acceptable level of risk and the desired level of control for the business processes and objectives. Information risk assessments with enterprise risk assessments, key risk indicators (KRIs) with risk appetite of the business, andcontrol KPIs with audit findings are other possible factors to align, but they are not as helpful as control performance with risk tolerance of business owners. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.

The best way to mitigate the security risk associated with the inappropriate use of enterprise applications on the BYOD devices is to implement BYOD mobile device management (MDM) controls. MDM controls are software tools or services that allow the organization to remotely manage, monitor, and secure the BYOD devices and the enterprise applications and data on them. MDM controls can help to enforce security policies, restrict unauthorized access, encrypt sensitive data, wipe data in case of loss or theft, and update or patch applications. The other options are not as effective as implementing MDM controls, as they are related to the review, awareness, or recovery of the BYOD devices and applications, not the prevention or protection of the security risk. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

The best key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed successfully within the expected time frame. This KPI can help to evaluate how well the security patching process meets the predefined objectives and standards, and how timely the patches are applied to reduce the risk exposure. The percentage of patches installed by the security administration team, successfully during the first attempt, or without causing an unplanned system outage are other possible KPIs, but they are not as relevant as the percentage of patches installed successfully within the expected time frame. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.

The most useful input to the parent company’s risk practitioner when developing risk scenarios for the post-acquisition phase is the risk registers of both companies. The risk register is a document that records the details of the risks, such as their sources, causes, consequences, likelihood, impact, and responses. By reviewing the risk registers of both companies, the risk practitioner can identify the existing and potential risks that may affect the post-acquisition integration, performance, and value. The risk management framework, the IT balanced scorecard, and the most recent internal audit findings are other possible inputs, but they are not as useful as the risk registers. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 11; CRISC Review Manual, 6th Edition, page 144.