Which of the following items is considered as an objective of the three dimensional model within the framework described in COSO ERM?
Answer(s): B
The COSO ERM (Enterprise Risk Management) frame work is a 3-dimensional model. The dimensions and their components include:Strategic Objectives - includes strategic, operations, reporting, and compliance.Risk Components - includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring. Organizational Levels - include subsidiary, business unit, division, and entity-level.The COSO ERM framework contains eight risk components: Internal EnvironmentObjective Settings Event Identification Risk Assessment Risk Response Control ActivitiesInformation and Communication MonitoringSection 404 of the Sarbanes-Oley act specifies a three dimensional model- COSO ERM, comprised of Internal control components, Internal control objectives, and organization entities. All the items listed are components except Financial reporting which is an internal control objective.Incorrect Answers:A, C, D: They are the Internal control components, not the Internal control objectives.
NIST SP 800-53 identifies controls in three primary classes. What are they?
Answer(s): C
NIST SP 800-53 is used to review security in any organization, that is, in reviewing physical security. The Physical and Environmental Protection family includes 19 different controls. Organizations use these controls for better physical security. These controls are reviewed to determine if they are relevant to a particular organization or not. Many of the controls described include additional references that provide more details on how to implement them. The National Institute of Standards and Technology (NIST) SP 800-53 rev 3 identifies 18 families of controls. It groups these controls into three classes:Technical Operational Management
While defining the risk management strategies, what are the major parts to be determined first? Each correct answer represents a part of the solution. Choose two.
Answer(s): B,C
While defining the risk management strategies, risk professional should first identify and analyze the objectives of the organization and the risk tolerance. Once the objectives of enterprise are known, risk professional can detect the possible risks which can occur in accomplishing those objectives. Analyzing the risk tolerance would help in identifying the priorities of risk which is the latter steps in risk management. Hence these two do the basic framework in risk management.Incorrect Answers:A: IT architecture complexity is related to the risk assessment and not the risk management, as it does much help in evaluating each significant risk identified.D: Risk assessment is one of the various phases that occur while managing risks, which uses quantitative and qualitative approach to evaluate risks. Hence risk assessment criteria is only a part of this framework.
Which of the following are true for quantitative analysis?Each correct answer represents a complete solution. Choose three.
Answer(s): B,C,D
As quantitative analysis is data driven, it: Allows data classification and counting.Allows statistical models to be constructed, which help in explaining what is being observed. Generalizes findings for a larger population and direct comparisons between two different sets of data or observations.Produces statistically reliable results.Allows discovery of phenomena which are likely to be genuine and merely occurs by chance.Incorrect Answers:A: Risk factors are expressed in terms of high/medium/low in qualitative analysis, and not in quantitative analysis.
Ned is the project manager of the HNN project for your company. Ned has asked you to help him complete some probability distributions for his project. What portion of the project will you most likely use for probability distributions?
Risk probability distributions are likely to be utilized in uncertain values, such as time and cost estimates for a project.Incorrect Answers:A: Risk probability distributions do not typically interact with the bias towards risks in new resources. B: Risk probability distributions are not likely to be used with risk probability and impact matrices.D: Risk probability distributions are not likely the risk identification.
Share your comments for ISACA CRISC exam with other users:
great case study
the questions in this exam dumps is valid. i passed my test last monday. i only whish they had their pricing in inr instead of usd. but it is still worth it.
q40 the answer is not d, why are you giving incorrect answers? snapshot consolidation is used to merge the snapshot delta disk files to the vm base disk
thanks, very relevant
wrong answer. it is true not false.
please i need the mo-100 questions
very good use full
very valid questions
will these question help me to clear pl-300 exam?
please provide me with these dumps questions. thanks
in the pdf downloaded is write google cloud database engineer i think that it isnt the correct exam
i think you have the answers wrong regarding question: "what are three core principles of web content accessibility guidelines (wcag)? answer: robust, operable, understandable
these questions are not valid , they dont come for the exam now
question looks valid
good for practice
need more q&a to go ahead
question 59 - a newly-created role is not assigned to any user, nor granted to any other role. answer is b https://docs.snowflake.com/en/user-guide/security-access-control-overview
just passed my exam today. i saw all of these questions in my text today. so i can confirm this is a valid dump.
needed dumps
very helpful
will post once the exam is finished
relevant questions
just clear exam on 10/06/2202 dumps is valid all questions are came same in dumps only 2 new questions total 46 questions 1 case study with 5 question no lab/simulation in my exam please check the answers best of luck
q.112 - correct answer is c - the event registry is a module that provides event definitions. answer a - not correct as it is the definition of event log
good and useful.
good questions
good content
totally not correct answers. 21. you have one gcp account running in your default region and zone and another account running in a non-default region and zone. you want to start a new compute engine instance in these two google cloud platform accounts using the command line interface. what should you do? correct: create two configurations using gcloud config configurations create [name]. run gcloud config configurations activate [name] to switch between accounts when running the commands to start the compute engine instances.
kindly upload the dumps
still learning
excellent way to learn
help so much
understand sql col.
i would give 5 stars to this website as i studied for az-800 exam from here. it has all the relevant material available for preparation. i got 890/1000 on the test.