CRISC Exam Questions and Answers | Exam-Dumps (Page: 36)

QUESTION: 176

Which of the following are the security plans adopted by the organization? Each correct answer represents a complete solution. (Choose three.)

Business continuity plan
Backup plan
Disaster recovery plan
Project management plan

Answer(s): A,B,C

Explanation:

Organizations create different security plans to address different scenarios. Many of the security plans are common to most organizations.

Most used security plans found in many organizations are: Business continuity plan
Disaster recovery plan Backup plan
Incident response plan

Incorrect Answers:
D: Project management plan is not a security plan, but a plan which describes the implementation of the project.

Reveal Solution Next Question

QUESTION: 177

Which of the following guidelines should be followed for effective risk management? Each correct answer represents a complete solution. Choose three.

Promote and support consistent performance in risk management
Promote fair and open communication
Focus on enterprise's objective
Balance the costs and benefits of managing risk

Answer(s): B,C,D

Explanation:

The primary function of the enterprise is to meet its objective. Each business activity for fulfilling enterprise's objective carries both risk and opportunity, therefore objective should be considered while managing risk.

Open and fair communication should me there for effective risk management. Open, accurate, timely and transparent information on lT risk is exchanged and serves as the basis for all risk-related decisions.

Cost-benefit analysis should be done for proper weighing the total costs expected against the total benefits expected, which is the major aspect of risk management.

Incorrect Answers:
A: For effective risk management, there should be continuous improvement, not consistent. Because of the dynamic nature of risk, risk management is an iterative, perpetual and ongoing process; that's why, continuous improvement is required.

Reveal Solution Next Question

QUESTION: 178

According to the Section-302 of the Sarbanes-Oxley Act of 2002, what does certification of reports implies? Each correct answer represents a complete solution. Choose three.

The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date at the time to report.
The financial statement does not contain any materially untrue or misleading information.
The signing officer has reviewed the report.
The signing officer has presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.

Answer(s): B,C,D

Explanation:

Section 302 of Sarbanes-Oxley act has the tremendous impact on the risk management solution adopted by corporations. This section specifies that the reports must be certified by the CEO, CFO, or other senior officer performing similar functions.

Certification of reports establishes:
The signing officer has reviewed the report.
The financial statement does not contain, to the knowledge of signing officer, any materially untrue or misleading information and represent fairly all financial conditions and results of the enterprise’s operations. The signing officers:
- are responsible for establishing and maintaining internal controls
- have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made - known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared
- have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report
- have presented in the report their conclusions about the effectiveness of their internal controls base on their evaluation as of that date

The signing officer have disclosed to external auditors, audit committee, and other directors:
- all significant deficiencies in the design or operation of internal controls which could adversely affect the reliability of the reported financial data
- any fraud, whether or not material, that involves management or other employees who have a significant role in the internal controls of the enterprise

The signing officer have indicated in the report any internal controls or changes to those internal controls which have been implemented since they were evaluated.

Incorrect Answers:
A: The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report, not at the time of the report.

Reveal Solution Next Question

QUESTION: 179

Thomas is a key stakeholder in your project. Thomas has requested several changes to the project scope for the project you are managing.

Upon review of the proposed changes, you have discovered that these new requirements are laden with risks and you recommend to the change control board that the changes be excluded from the project scope. The change control board agrees with you. What component of the change control system communicates the approval or denial of a proposed change request?

Configuration management system
Integrated change control
Change log
Scope change control system

Answer(s): B

Explanation:

Integrated change control is responsible for facilitating, documenting, and dispersing information on a proposed change to the project scope.

Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.

Incorrect Answers:
A: The configuration management system controls and documents changes to the project's product C: The change log documents approved changes in the project scope.
D: The scope change control system controls changes that are permitted to the project scope.

Reveal Solution Next Question

QUESTION: 180

Which of the following process ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule?

Risk management
Risk response integration
Risk response implementation
Risk response tracking

Answer(s): D

Explanation:

Risk response tracking tracks the ongoing status of risk mitigation processes as part of risk response process. This tracking ensures that the risk response strategy remains active and that proposed controls are implemented according to schedule. When an enterprise is conscious of a risk, but does not have an appropriate risk response strategy, then it leads to the increase of the liability of the organization to adverse publicity or even civil or criminal penalties.

Incorrect Answers:
A: Risk management provides an approach for individuals and groups to make a decision on how to deal with potentially harmful situations

B: Integrating risk response options to address more than one risk together, help in achieving greater efficiency.

The use of techniques that are versatile and enterprise-wide, rather than individual solutions provides better justification for risk response strategies and related costs.

C: Implementation of risk response ensures that the risks analyzed in risk analysis process are being lowered to level that the enterprise can accept, by applying appropriate controls.

Reveal Solution Next Question

ISACA CRISC Exam (page: 36) ISACA Certified in Risk and Information Systems Control Updated on: 25-Dec-2025

QUESTION: 176

Explanation:

QUESTION: 177

Explanation:

QUESTION: 178

Explanation:

QUESTION: 179

Explanation:

QUESTION: 180

Explanation:

ISACA CRISC Exam (page: 36)
ISACA Certified in Risk and Information Systems Control
Updated on: 25-Dec-2025