Isaca Updated CRISC Exam Questions and Answers by siyana

The best control to reduce the likelihood of a successful network attack through social engineering is security awareness training. Security awareness training is a program that educates and trains employees on the common types, techniques, and indicators of social engineering attacks, such as phishing, baiting, pretexting, and quid pro quo12. Security awareness training also teaches employees how to protect themselves and the organization from social engineering attacks, such as by verifying the identity and legitimacy of the sender or caller, avoiding clicking on suspicious links or attachments, reporting any suspicious or unusual activity, and following the organization’s security policies and procedures. Security awareness training can help to reduce the likelihood of a successful network attack through social engineering, because it can increase the employees’ knowledge, skills, and confidence in recognizing and responding to social engineering attempts, and it can also foster a culture of security and responsibility among the employees. The other options are not the best control, although they may be useful or complementary to security awareness training. Automated controls are technical or procedural controls that are performed by a system or a device without human intervention, such as firewalls, antivirus software, encryption, and backups. Automated controls can help to protect the network from external or internal threats, but they may not be effective against social engineering attacks, which rely on humaninteraction and manipulation.Multifactor authentication is a security mechanism that requires users to provide two or more pieces of evidence to verify their identity and access a system or a service, such as a password, a token, a fingerprint, or a facial recognition. Multifactor authentication can help to prevent unauthorized access to the network, but it may not prevent social engineering attacks, which may persuade users to share or compromise their authentication factors. Employee sanctions are disciplinary actions that are taken against employees who violate the organization’s security policies and procedures, such as warnings, fines, suspensions, or terminations. Employee sanctions can help to deter and punish employees who fall victim to or facilitate social engineering attacks, but they may not prevent or reduce the likelihood of social engineering attacks, and they may also create a negative or fearful work environment. References = Avoiding Social Engineering and Phishing Attacks | CISA, What is Social Engineering | Attack Techniques & Prevention Methods …, 10 Types of Social Engineering Attacks - CrowdStrike

 The most important element of a successful risk awareness training program is customizing content for the audience, because this ensures that the training is relevant, engaging, and effective for the learners. Customizing content for the audience means tailoring the training materials and methods to suit the specific needs, preferences, and characteristics of the target group, such as their roles, responsibilities, knowledge, skills, attitudes, and learning styles. Customizing content for the audience can help to achieve the following benefits:

Increase the motivation and interest of the learners, as they can see the value and applicability of the training to their work and goals.

Enhance the comprehension and retention of the learners, as they can relate the training content to their prior knowledge and experience, and use examples and scenarios that are familiar and realistic to them.

Improve the transfer and application of the learners, as they can practice and apply the training content to their actual work situations and challenges, and receive feedback and support that are relevant and useful to them. References = Implementing risk management training and awareness (part 1) 1

According to the CRISC Review Manual, centralized log management is the best way to assist in reconstructing the sequence of events following a security incident across multiple IT systems in the organization’s network, because it enables the collection, correlation, analysis, and retention of log data from various sources. Centralized log management can provide a comprehensive and consistent view of the activities and transactions that occurred before, during, and after the incident, and can facilitate the identification of the root cause, impact, and scope of the incident. The other options are not the best ways to assist in reconstructing the sequence of events, because they do not provide the same level of detail and accuracy as centralized log management. Network monitoring infrastructure is a tool that helps to monitor the performance and availability of the network, but it does not capture the log data from the IT systems. Centralized vulnerability management is a process that helps to identify and remediate the vulnerabilities in the IT systems, but it does not record the events and transactions that occurred on the systems. Incident management process is a process that helps to respond to and resolve the incidents, but it does not provide the log data from the IT systems. References = CRISC Review Manual, 7th Edition, Chapter 5, Section 5.3.2, page 263.

 An analysis of the security logs that illustrate the sequence of events is the most important information for the person responsible for managing the incident, as it can help to identify the source, scope, and impact of the security breach, and to determine the appropriate response actions. An analysis of the security logs can also provide evidence for forensic investigation and legal action, and help to prevent or mitigate future incidents by identifying the root causes and vulnerabilities. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 235. CRISC by Isaca Actual FreeExam Q&As, Question 9. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 235. CRISC Sample Questions 2024, Question 235.