Selected CRISC Isaca Certification Questions Answers

A threat and vulnerability assessment is a process that identifies and evaluates the potential sources and impacts of risk events on an organization’s assets, processes, and objectives. It also estimates the probability of occurrence and the severity of consequences for each risk event. A threat and vulnerability assessment is the best way to quantify the likelihood of risk materialization, as it provides a numerical or qualitative measure of the risk exposure and the level of uncertainty associated with the risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, p. 68-69

A key performance indicator (KPI) is a metric that measures the achievement of a specific goal or objective. A KPI should be relevant, measurable, achievable, realistic, and time-bound. For measuring the effectiveness of an antivirus program, a possible goal is to ensure that all IT assets are protected from malware infections. A KPI that can measure this goal is the percentage of IT assets with current malware definitions, which indicates how well the antivirus program can detect and prevent the latest malware threats. The higher the percentage, the more effective the antivirus program is. Therefore, this is the best KPI among the given options. References =

Cybersecurity KPIs to Track + Examples — RiskOptics - Reciprocity

Which of the following is the BEST key performance indicator (KPI) to …

Indicators - Program Evaluation - CDC

 Key control indicators (KCIs) are metrics that measure how well a specific control is performing in reducing the causes, consequences, or likelihood of a risk1. Key risk indicators (KRIs) are metrics that measure changes in the risk exposure or the potential impact of a risk2. By linking an effective KCI to relevant KRIs, the organization can monitor changes in the risk environment and assess how the control is influencing the risk level3. This can help the organization to:

Identify emerging or escalating risks and take timely and appropriate actions

Evaluate the effectiveness and efficiency of the control and make improvements if needed

Align the control with the risk appetite and tolerance of the organization

Communicate the risk and control status to stakeholders and regulators

References = Risk and Information Systems Control Study Manual, Chapter 6: Risk Response and Mitigation4

The business process owner is the person or entity that has the accountability and authority to manage a business process and its outcomes. The business process owner would be the most appropriate owner of the risk associated with an IT control gap in a key process, as they are responsible for ensuring that the process meets its objectives and delivers value to the enterprise. The business process owner should also ensure that the process is aligned with the enterprise’s strategy and risk appetite, and that the process risks are identified, assessed, and mitigated effectively. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 247. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 247. CRISC Sample Questions 2024, Question 247. CRISC by Isaca Actual Free Exam Q&As, Question 9.