ISACA CRISC Exam Dumps – PDF Questions and Testing Engine [Q684-Q700]

* The risk of terminated employee accounts maintaining access is that the former employees or unauthorized parties may use the accounts to access or manipulate the organization’s information systems or resources, and cause harm or damage to the organization and its stakeholders, such as data loss, data breach, system failure, fraud, etc.
* The first step to address the risk of terminated employee accounts maintaining access is to disable user access, which means to revoke or remove the permissions or privileges that allow the accounts to access or use the organization’s information systems or resources. Disabling user access can help the organization to address the risk by providing the following benefits:
* It can prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and reduce or eliminate the potential harm or damage that they may cause for the organization and its stakeholders.
* It can ensure the confidentiality, integrity, availability, and reliability of the organization’s information systems or resources, and protect them from unauthorized access or manipulation.
* It can provide useful evidence and records for the verification and validation of the organization’s access control function, and for the compliance with the organization’s access control policies and standards.
* The other options are not the first steps to address the risk of terminated employee accounts maintaining access, because they do not provide the same level of urgency and effectiveness that disabling user access provides, and they may not be sufficient or appropriate to address the risk.
* Performing a risk assessment is a process of measuring and comparing the likelihood and impact of various risk scenarios, and prioritizing them based on their significance and urgency.
Performing a risk assessment can help the organization to understand and document the risk of terminated employee accounts maintaining access, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be timely or feasible to perform a risk assessment before disabling user access.
* Developing an access control policy is a process of defining and describing the rules or guidelines that specify the expectations and requirements for the organization’s access control function, such as who can access what, when, how, and why. Developing an access control policy can help the organization to establish and communicate the boundaries and objectives for the organization’s access control function, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be relevant or applicable to the existing or emerging risk scenarios that may affect the organization’s access control function.
* Performing a root cause analysis is a process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. Performing a root cause analysis can help the organization to address and correct the risk of terminated employee accounts maintaining access, and prevent or reduce its recurrence or impact, but it is not the first step to address the risk, because it does not prevent or stop the former employees or unauthorized parties from accessing or using the organization’s information systems or resources, and it may not be timely or feasible to perform a root cause analysis before disabling user access. References =
* ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63
* ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 207
* CRISC Practice Quiz and Exam Prep

Section: Volume D

The best approach to identify relevant risk scenarios is to engage line management in risk assessment workshops. Risk scenarios are hypothetical situations that describe how a risk event could occur and what the consequences could be1. Identifying risk scenarios can help to understand and communicate the nature and impact of the risks, and to design and evaluate the risk responses2. To identify relevant risk scenarios, it is important to involve the people who are responsible for or affected by the risks, such as the line managers. Line managers are the managers who oversee the operational activities and processes of the organization, and who report to the senior or executive management3. By engaging line managers in risk assessment workshops, the organization can:
* Leverage the line managers’ knowledge and experience of the operational environment, the business
* objectives, the stakeholder expectations, and the potential threats and opportunities4.
* Encourage the line managers’ participation and collaboration in the risk identification and analysis process, and foster a risk-aware culture and mindset5.
* Enhance the line managers’ ownership and accountability of the risks and the risk responses, and ensure their alignment and commitment to the risk management strategy and objectives6.
The other options are not the best approaches to identify relevant risk scenarios, because:
* Escalating the situation to risk leadership is not an effective or efficient way to identify risk scenarios, as it may bypass or undermine the line managers’ role and responsibility in the risk management process. Risk leadership is the function or role that provides the vision, direction, and guidance for the risk management activities and initiatives of the organization7. Escalating the situation to risk leadership may imply that the line managers are not capable or willing to identify and manage the risks, or that the risk leadership is not aware or involved in the risk management process. This may create confusion, conflict, or distrust among the risk management stakeholders, and reduce the quality and credibility of the risk scenarios.
* Engaging internal audit for risk assessment workshops is not a suitable or appropriate way to identify risk scenarios, as it may violate the independence and objectivity of the internal audit function. Internal audit is an independent and objective assurance and consulting activity that evaluates and improves the effectiveness of the organization’s governance, risk management, and control processes8. Engaging internal audit for risk assessment workshops may compromise the internal audit’s role and mandate, as it may create a conflict of interest or a self-review threat. Internal audit should not be involved in the risk identification and analysis process, but rather provide assurance or advice on the adequacy and reliability of the process.
* Reviewing system and process documentation is not a sufficient or comprehensive way to identify risk scenarios, as it may overlook or miss some important or emerging risks. System and process documentation are the records or artifacts that describe the structure, functions, features, and requirements of the organization’s systems and processes. Reviewing system and process documentation can help to identify some risks that are related to the design, implementation, or operation of the systems and processes, but it cannot capture all the risks that may affect the organization. Some risks may arise from external or internal factors that are not reflected or updated in the system and process documentation, such as changes in the market, technology, regulation, or stakeholder expectations.
References =
* Risk Scenarios Toolkit – ISACA
* Risk Scenarios Starter Pack – ISACA
* Line Manager – CIO Wiki
* Engaging Line Managers in Risk Management – IRM
* Risk Culture – CIO Wiki
* Risk Ownership – CIO Wiki
* Risk Leadership – CIO Wiki
* Internal Audit – CIO Wiki
* [System Documentation – CIO Wiki]

The best way to mitigate the risk of customer identity theft is to implement layered security. Layered security
is a defense-in-depth approach that applies multiple and diverse security controls at different levels and stages
of the information system and the data lifecycle. Layered security can include physical, technical, and
administrative controls, such as locks, firewalls, encryption, authentication, authorization, backup, audit, and
policy. Layered security can help to protect the customer data and identity from unauthorized access, use,
modification, disclosure, or destruction, by creating multiple barriers and deterrents for potential attackers,
and by reducing the impact and likelihood of a successful breach. Layered security can also help to comply
with the legal and regulatory requirements and standards for data privacy and protection, such as the Gramm-
Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and the Payment Card Industry Data
Security Standard (PCI DSS)123.The other options are not the best way to mitigate the risk of customer
identity theft, although they may be useful or complementary to layered security. Implementing monitoring
techniques is a part of the layered security approach, but it is not sufficient, as it mainly focuses on detecting
and responding to the incidents, rather than preventing or deterring them. Outsourcing to a local processor is a
business decision that may or may not improve the security of the customer data and identity, depending on
the quality and reliability of the service provider, and the terms and conditions of the outsourcing contract.
Conducting an awareness campaign is a good practice that can help to educate and inform the customers and
the employees about the common types, methods, and indicators of identity theft, and the best practices and
precautions to prevent or report it, but it does not directly apply or enforce any security controls to the
information system or the data.

A critical patch is a software update that fixes a security vulnerability or a bug that may affect the
performance, functionality, or reliability of a system or a network. A critical patch implementation is a
process that applies the software update to the system or network in a timely and effective manner. The failure
of a critical patch implementation is a situation where the software update is not applied or not applied
correctly, which may expose the system or network to various threats, such as data theft, data corruption, data
leakage, or denial of service. The failure of a critical patch implementation would be reflected in an
organization’s risk profile by increasing the residual risk. Residual risk is the risk that remains after the risk
response, which means the risk that is not avoided, transferred, or mitigated by the existing controls or
measures. The failure of a critical patch implementation would increase the residual risk, as it would reduce
the effectiveness or efficiency of the existing controls or measures that are supposed to address the security
vulnerability or the bug. The failure of a critical patch implementation would also increase the likelihood or
impact of the potential threats, as well as the exposure or consequences of the system or network. The other
options are not the correct changes that would be reflected in an organization’s risk profile after the failure of
a critical patch implementation, although they may be affected or related. Risk tolerance is the degree of
variation from the risk appetite that the organization is not willing to accept. Risk tolerance may be decreased
by the failure of a critical patch implementation, as the organization may become more cautious or
conservative in accepting the risk, but it is not a direct or immediate change in the risk profile. Inherent risk is
the risk that exists in the absence of any controls or measures, which means the risk that is inherent to the
system or network or the environment. Inherent risk may be increased by the failure of a critical patch
implementation, as the system or network may become more vulnerable or susceptible to the threats, but it is
not a change in the risk profile, as the risk profile considers the existing controls or measures. Risk appetite is
the amount and type of risk that the organization is willing to accept in pursuit of its objectives. Risk appetite
may be decreasedby the failure of a critical patch implementation, as the organization may become less
willing orable to accept the risk, but it is not a change in the risk profile, as the risk profile reflects the actual
or current risk level, not the desired or expected risk level. References = CRISC Review Manual, pages 32-
331; CRISC Review Questions, Answers & Explanations Manual, page 972; What is a Critical Patch? –
Definition from Techopedia3; What is Residual Risk? – Definition from Techopedia4

is incorrect. Someone sees company’s secret formula or password comes under loss of confidentiality.

Explanation/Reference:
Explanation:
A threat is any event which have the potential to cause a loss. In other word, it is any activity that represents a possible danger. The loss or danger is directly related to one of the following:
Loss of confidentiality- Someone sees a password or a company’s secret formula, this is referred to as

loss of confidentiality. Loss of integrity- An e-mail message is modified in transit, a virus infects a file, or someone makes unauthorized changes to a Web site is referred to as loss of integrity.
Loss of availability- An e-mail server is down and no one has e-mail access, or a file server is down so

data files aren’t available comes under loss of availability.
Threat identification is the process of creating a list of threats. This list attempts to identify all the possible threats to an organization. The list can be extensive.
Threats are often sub-categorized as under:
External or internal- External threats are outside the boundary of the organization. They can also be

thought of as risks that are outside the control of the organization. While internal threats are within the boundary of the organization. They could be related to employees or other personnel who have access to company resources. Internal threats can be related to any hardware or software controlled by the business.
Natural or man-made- Natural threats are often related to weather such as hurricanes, tornadoes, and

ice storms. Natural disasters like earthquakes and tsunamis are also natural threats. A human or man- made threat is any threat which is caused by a person. Any attempt to harm resources is a man-made threat. Fire could be man-made or natural depending on how the fire is started.
Intentional or accidental- An attempt to compromise confidentiality, integrity, or availability is intentional.

While employee mistakes or user errors are accidental threats. A faulty application that corrupts data could also be considered accidental.

An incident is an unplanned event that disrupts or degrades the normal operation or performance of an IT service, system, or network1. An incident can cause various negative impacts, such as service outages, data losses, security breaches, or customer dissatisfaction2. An incident can recur if the underlying cause or problem of the incident is not properly identified and resolved3.
The best course of action to help reduce the probability of an incident recurring is to perform root cause analysis. Root cause analysis is a systematic process of finding and eliminating the fundamental cause or problem that led to the incident4. Root cause analysis can help to:
* Prevent or minimize the recurrence of the incident by addressing the source of the problem, not just the symptoms or effects
* Identify and implement corrective or preventive actions that can effectively resolve or mitigate the problem
* Learn from the incident and improve the IT service, system, or network quality and reliability
* Enhance the incident management and problem management processes and capabilities5 References = What is an Incident?, Incident Management – Wikipedia, Problem Management – Wikipedia, Root Cause Analysis – Wikipedia, Root Cause Analysis: A Guide for Business Leaders

According to the ERM – Step 3 – Risk Treatment article, risk transfer is a risk treatment option that involves
passing ownership and/or liability of a risk to a third party, such as an insurance company, a contractor, or a
supplier. Risk transfer is usually adopted when the organization does not have the capability or the resources
to manage the risk internally, or when the cost of transferring the risk is lower than the cost of retaining the
risk. In this case, the organization has outsourced its lease payment process to a service provider who lacks
evidence of compliance with a necessary regulatory standard. This means that the organization has transferred
the risk of non-compliance to the service provider, who is now responsible for ensuring that the lease payment
process meets the regulatory requirements. Therefore, the answer is B. Transfer. References = ERM – Step 3 –
Risk Treatment

Understanding Strategic Risk:
Strategic risk refers to the potential losses that can arise from adverse business decisions, improper
implementation of decisions, or lack of responsiveness to changes in the business environment.
Reputational Impact of Cybersecurity Breaches:
A cybersecurity breach can severely damage an organization’s reputation, affecting customer trust, investor
confidence, and market value.
Such impacts go beyond immediate financial losses and can have long-term strategic implications for the
organization’s competitive position and strategic objectives.
Classification of Risk:
Financial Risk:Direct financial losses due to a breach (e.g., fines, legal costs) but does not cover reputational
impacts.
Data Risk:Focuses on the loss or compromise of data but not the broader strategic impact.
Operational Risk:Pertains to disruptions in business operations, while reputational damage influences the
organization’s strategic direction and goals.
Strategic Risk and Reputation:
Reputational damage from a cybersecurity breach can lead to a loss of customer base, reduced market share,
and difficulties in strategic partnerships, all of which are strategic concerns.
Addressing reputational risk requires strategic planning, proactive communication, and long-term efforts to
rebuild trust and credibility.
References:
The CRISC Review Manual highlights that reputational risk is a significant aspect of strategic risk, especially
following cybersecurity incidents (CRISC Review Manual, Chapter 1: Governance, Section 1.1.3 Importance
and Value of IT Risk Management).

The most relevant source to reference when updating security awareness training materials is the recent
security incidents reported by competitors. This can help to illustrate the real-world threats and consequences
of poor security practices, and to motivate the employees to follow the security policies and procedures. Risk
management framework, risk register, and global security standards are other sources that may be useful, but
they are not as relevant as the recent security incidents. References = ISACA Certified in Risk and
Information Systems Control (CRISC) Certification Exam Question and Answers, question 9; CRISC Review
Manual, 6th Edition, page 214.

Accepting residual risk is the most important responsibility of a risk owner, as it implies that the risk owner is
accountable for the risk and its impact on the enterprise’s objectives and operations. Residual risk is the risk
that remains after the implementation of controls, and it should be aligned with the risk appetite and tolerance
of the enterprise. The risk owner is responsible for implementing the risk response strategies and monitoring
the risk status and outcomes, as well as for reporting and escalating the risk issues and incidents. Testing
control design, establishing business information criteria, and establishing the risk register are not the most
important responsibilities of a risk owner, but rather the tasks or activities that the risk owner may performor
delegate as part of the risk management process. References = CRISC Certified in Risk and Information
Systems Control – Question218; ISACA Certified in Risk and Information Systems Control (CRISC)
Certification Exam Question and Answers, question 218.

The most important factor for senior management to review during an acquisition is the risk appetite and tolerance of the target organization. The risk appetite and tolerance reflect the amount and type of risk that an organization is willing to accept in pursuit of its objectives. By reviewing the risk appetite and tolerance of the target organization, senior management can determine if they are compatible with their own, and if the acquisition will create any significant risk exposure or opportunity for the acquiring organization. Risk framework and methodology, key risk indicator (KRI) thresholds, and risk communication plan are other factors that may be reviewed, but they are not as important as the risk appetite and tolerance. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.