Isaca Updated CRISC Exam Questions and Answers by elle

The correct answer isBbecausered team exercisesare the best method to identify weaknesses in the technical environment that an attacker could exploit to gain access. A red team exercise simulates realistic attacker behavior and therefore provides a direct and practical way to discover exploitable security weaknesses across systems, defenses, and operational response capabilities.

The other options are not as effective:

A. Threat modelingis useful for identifying possible attack paths and design weaknesses, but it is more analytical than practical.

C. System testingis broad and may not focus specifically on adversarial exploitation.

D. Control self-assessments (CSAs)rely on internal review and are less effective for uncovering attacker-leveraged technical weaknesses.

Exact Extracts supporting the answer:

“To detect vulnerabilities in Internet-facing systems penetration testing is primarily used as it simulates real attacker actions to test security defenses.”

“For a system owner penetration testing offers the greatest level of assurance regarding the effectiveness of implemented security controls.”

“For an Internet-facing application penetration testing is the most effective control assessment type.”

“The BEST way to ensure a corporate network ' s security against external attacks is to perform periodic penetration testing.”

“After various infrastructure changes are made is the best time to perform a penetration test as changes are likely to introduce new exposures.”

These extracts support the principle that simulated attacker activity is the strongest way to identify technical weaknesses exploitable by attackers. Among the given choices,red team exercisesare the closest and best match to that objective.

===========

The best way to mitigate an identified risk scenario is to execute a risk response plan. A risk response plan is a document that describes the actions and resources that are needed to address the risk scenario. A risk response plan can include one or more of the following strategies: avoid, transfer, mitigate, accept, or exploit. By executing a risk response plan, the organization can reduce the likelihood and/or impact of the risk scenario, or take advantage of the opportunities that the risk scenario may present. The other options are not as effective as executing a riskresponse plan, as they are related to the awareness, assessment, or monitoring of the risk scenario, not the actual treatment of the risk scenario. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.2: IT Risk Response Options, page 133.

The best way to mitigate the risk associated with infrastructure updates is to implement a change control process. A change control process is a set of procedures that ensures that any changes to the infrastructure are planned, approved, tested, implemented, and documented in a consistent and controlled manner. A change control process helps to reduce the risk of errors, conflicts, disruptions, or security breaches that could result from infrastructure updates. A change controlprocess also helps to monitor and evaluate the impact and effectiveness of the changes, and to ensure that they align with the enterprise’s objectives and requirements. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.3.1, page 1391

The average time to provision user accounts is the most useful indicator to measure the efficiency of an identity and access management (IAM) process, because it reflects how quickly and smoothly the process can grant access to the appropriate users. The average time to provision user accounts can be calculated by dividing the total time spent on provisioning user accounts by the number of user accounts provisioned in a given period. A lower average time indicates a more efficient IAM process, as it means that users can access the resources they need without unnecessary delays or errors. A higher average time may indicate problems or bottlenecks in the IAM process, such as manual steps, complex workflows, lack of automation, or insufficient resources. The average time to provision user accounts can also be compared across different applications, systems, or business units to identify areas for improvement or best practices. The other options are less useful indicators to measure the efficiency of an IAM process. The number of tickets for provisioning new accounts shows the demand for the IAM process, but not how well the process meets the demand. The password reset volume per month shows the frequency of password-related issues, but not how effectively the IAM process handles them. The average account lockout time shows the impact of account lockouts on user productivity, but not howefficiently the IAM process prevents or resolves them. References = Top Identity and Access Management Metrics