Isaca Updated CRISC Exam Questions and Answers by siyana

Implementing mock phishing exercises is the most effective way to validate organizational awareness of cybersecurity risk, because it helps to measure and test the knowledge and behavior of the employees regarding the detection and prevention of phishing attacks, which are one of the most common and dangerous forms of cybersecurity risk. A phishing attack is a fraudulent attempt to obtain sensitive or confidential information, such as usernames, passwords, or credit card details, by impersonating a legitimate or trusted entity, such as a bank, a government agency, or a colleague, through email, phone, or other communication channels. A mock phishing exercise is a simulated phishing attack that is conducted by the organization or a thirdparty to assess the level of awareness and readiness of the employees to recognize and respond to phishing attacks, and to provide feedback and training to improve their skills andknowledge. Implementing mock phishing exercises is the most effective way, as it helps to validate the actual and practical awareness of cybersecurity risk, and to identify and address the gaps or weaknesses in the employees’ awareness and behavior. Conducting security awareness training, updating the information security policy, and requiring two-factor authentication are all useful ways to enhance organizational awareness of cybersecurity risk, but they are not the most effective way, as they do not directly validate the awareness and behavior of the employees regarding phishing attacks. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.2, page 158

A key risk indicator (KRI) is a metric that measures the changes in the level of risk exposure, such as by monitoring the risk drivers, triggers, or events. A KRI indicates a reduction in the percentage of appropriately patched servers means that the enterprise is not applying the latest security updates or fixes to its servers, which could expose them to vulnerabilities or threats. The best course of action for the risk practitioner when a KRI indicates a reduction in the percentage of appropriately patched servers is to determine changes in the risk level. The risk level is the measure of the impact and likelihood of the risk, and it should be consistent and comparable across the enterprise and over time. By determining changes in the risklevel, the risk practitioner can assess the current or emerging risks, and decide on the appropriate risk response strategy and actions. The other options are not the best course of action, as they involve different aspects or outcomes of the risk management process:

Outsource the vulnerability management process means that the enterprise transfers the responsibility or burden of identifying, analyzing, prioritizing, and remediating the vulnerabilities in the IT systems and applications to a third party, such as a vendor or a contractor. This may not be a feasible or effective way to address the risk of unpatched servers, as it may not reduce the exposure or impact of the risk, or may introduce new risks, such as contractual disputes, quality issues, or intellectual property rights.

Review the patch management process means that the enterprise evaluates the existing procedures and practices for applying the security updates or fixes to the servers, and identifies the gaps or weaknesses that need to be addressed. This may be a useful step in the risk management process, but it is not the best course of action, as it may not provide immediate or sufficient information or action to address the risk of unpatched servers, or may not account for the uncertainties or complexities of the risk.

Add agenda item to the next risk committee meeting means that the enterprise communicates the risk of unpatched servers to the senior executives who oversee the enterprise-wide risk management program, and provide guidance and direction to the risk owners and practitioners. This may be a helpful step in the risk management process, but it is not the best course of action, as it may not provide timely or adequate information or action to address the risk of unpatched servers, or may not reflect the urgency or priority of the risk. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.3.2.1, pp. 171-172.

According to the CRISC Review Manual1, an acceptable usage policy is a document that defines the rules and guidelines for the appropriate and secure use of IT resources within an organization. It helps to mitigate data leakage risk by establishing the roles and responsibilities of users, the types and purposes of data that can be shared or transmitted, the authorized methods and channels of communication, the security controls and measures to protect data, and the consequences of non-compliance. An acceptable usage policy also educates and raises awareness among users about the potential risks and threats associated with instant messaging and other forms of online communication. Therefore, before implementing instant messaging within an organization using a public solution, an acceptable usage policy should be in place to mitigate data leakage risk. References = CRISC Review Manual1, page 237.