Free CRISC Questions Attempt

According to the CRISC Review Manual, monitoring against the configuration standard is the most effective control to maintain the integrity of system configuration files, because it ensures that any unauthorized or unintended changes are detected and corrected. Monitoring against the configuration standard involves comparing the actual configuration of the system with the approved baseline and identifying any deviations or discrepancies. The other options are not the most effective controls, because they do not ensure the integrity of the system configuration files. Recording changes to configuration files is a good practice, but it does not prevent unauthorized or unintended changes from occurring. Implementing automated vulnerability scanning is a preventive control that helps to identify and remediate potential weaknesses in the system, but it does not verify the integrity of the configuration files. Restricting access to configuration documentation is a security measure that limits the exposure of sensitive information, but it does not prevent unauthorized or unintended changes to the configuration files. References = CRISC Review Manual, 7th Edition, Chapter 4, Section 4.2.3, page 184.

The drawback in the use of quantitative risk analysis is that it requires more resources than other methods. Quantitative risk analysis is a method of risk analysis that assigns numeric values to the exposures of assets, the impact and likelihood of risk events, and the cost and benefit of risk responses. Quantitative risk analysis can provide more precise and objective results, and support the risk-based decision making process. However, quantitative risk analysis also requires more resources than other methods, such as data, time, expertise, and tools, to collect, validate, and analyze the quantitative information, and to perform the complex calculations and simulations. Quantitative risk analysis may also be limited by the availability, reliability, and accuracy of the data, and the assumptions and models used. Assigning numeric values to exposures of assets, producing the results in numeric form, and being based on impact analysis of information assets are not drawbacks, but characteristics of quantitative risk analysis. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 49.

 Customer behavior data is the information that reflects how customers interact with a brand, product, or service, such as their preferences, needs, motivations, and feedback1. Collecting customer behavior data through social media advertising can help an organization to understand its target market, improve its customer experience, and optimize its marketing strategies2.

However, collecting customer behavior data through social media advertising also poses significant business risks, especially for a global organization that operates in different countries. Among the four options given, the most important business risk to be considered is the regulatory requirements that may differ in each country. This means that the organization should:

Be aware of the different laws and regulations that govern the collection, processing, storage, and transfer of personal data in each country, such as the GDPR in the EU, the CCPA in California, or the PDPA in Singapore3

Ensure that the organization complies with the relevant data protection and privacy rules and standards in each country, such as obtaining consent, providing notice, ensuring security, and respecting rights4

Avoid or mitigate the potential legal, financial, reputational, or operational consequences of violating the data protection and privacy laws and regulations in each country, such as fines, lawsuits, sanctions, or loss of trust5

References = What is Customer Behavior Data?, How to Collect Customer Behavior Data for Marketing, Data Protection Laws Around the World, Data Protection and Privacy: The Age of Intelligent Machines, The Risks of Non-Compliance with Data Protection Laws

A maturity model is a framework that describes the stages or levels of development and improvement of a certain domain, such as a process, a function, or an organization. A maturity model is most useful to an organization when it provides a reference for progress, meaning that it helps the organization to assess its current state, identify its strengths and weaknesses, set its goals and objectives, and measure itsperformance and improvement over time. A maturity model can also help the organization to compare itself with best practices and standards, but benchmarking against other organizations is not its primary purpose. A maturity model can also help the organization to manage its risks, but defining a qualitative measure of risk or providing risk metrics is not its main function. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.2.1, p. 118-119