Isaca Updated CRISC Exam Questions and Answers by jakub

Biometric systems are preventive controls designed to restrict access to authorized personnel only, thereby proactively mitigating unauthorized access risks. This aligns withAccess and Authentication Controlprinciples in risk management.

 The most likely effect on the associated risk when the effectiveness of a control has decreased is that the residual risk changes. Residual risk is the risk that remains after the implementation of risk responses or controls. If the control becomes less effective, the residual risk will increase, as the risk exposure and impact will be higher than expected. The risk impact, the risk classification, and the inherent risk are not likely to change when the effectiveness of a control has decreased, as they are more related to the nature and characteristics of the risk, rather than the control performance. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.4, page 541

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 652.

 The best key performance indicator (KPI) of the effectiveness of the policy requiring staff members to take a minimum of five consecutive days leave per year to mitigate the risk ofmalicious insider activities is the percentage of staff members taking leave according to the policy. A KPI is a quantifiable measure that evaluates the performance of a process, activity, or outcome against a predefined target or objective. The percentage of staff members taking leave according to the policy is the best KPI, because it directly measures the compliance and adherence of the staff members to the policy, which is the main objective of the policy. The policy aims to reduce the risk of malicious insider activities by forcing the staff members to take a break from their work, which can help to deter, detect, or prevent any fraudulent or unauthorized actions, such as data theft, sabotage, or manipulation12. The percentage of staffmembers taking leave according to the policy can also help to evaluate the effectiveness and efficiency of the policy implementation and enforcement, and to identify and address any gaps or issues in the policy design or execution. The other options are not the best KPI, although they may be related or influential to the policy effectiveness. The number of malicious activities occurring during staff members’ leave is a measure of the occurrence and impact of the risk events that the policy aims to mitigate, but it is not a direct measure of the policy performance or compliance. The number of malicious activities occurring during staff members’ leave may also be affected by other factors or controls, such as the security systems, the audit procedures, or the external threats, which may not reflect the policy effectiveness. The percentage of staff members seeking exception to the policy is a measure of the resistance or dissatisfaction of the staff members to the policy, but it is not a direct measure of the policy performance or compliance. The percentage of staff members seeking exception to the policy may also be influenced by other factors or circumstances, such as the workload, the personal preferences, or the organizational culture, which may not indicate the policy effectiveness. The financial loss incurred due to malicious activities during staff members’ leave is a measure of the consequence and severity of the risk events that the policy aims to mitigate, but it is not a direct measure of the policy performance or compliance. The financial loss incurred due to malicious activities during staff members’ leave may also vary depending on the type, scale, or frequency of the malicious activities, or the recovery or compensation actions, which may not represent the policy effectiveness. References = How To Measure Risk Management KPI & Metrics - ERM Software, Key Performance Indicators (KPIs): The Ultimate Guide - ClearPoint Strategy

 The data owner is accountable for the confidentiality of the data that is outsourced to a third party with servers located in a foreign country. The data owner is the person or entity that has the authority and responsibility to classify, label, and protect the data according to the organization’s policies and standards. The data owner is also responsible for defining the data access rights and privileges, and for ensuring that the data is handled in compliance with the applicable laws and regulations. The data owner retains the accountability for the data even when it is outsourced to a third party, and must monitor and evaluate the security performance and compliance of the service provider. The third-party data custodian, the data custodian, and the regional office executive are not accountable for the confidentiality of the data, as they have different roles and responsibilities in the outsourcing process. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.1.2, page 2461

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 654.