Isaca Updated CRISC Exam Questions and Answers by lilianna

 Performing a gap analysis is the best recommendation for a risk practitioner upon learning of an updated cybersecurity regulation that could impact the organization. A gap analysis can help identify the current state of compliance, the desired state of compliance, and the actions needed to achieve compliance. Conducting system testing, implementing compensating controls, and updating security policies are possible actions that may result from the gap analysis, but they arenot the best initial recommendation. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 1; CRISC Review Manual, 6th Edition, page 143.

Comprehensive and Detailed Explanation From Exact Extract:

A decrease in risk appetite typically results in tighter tolerances and thresholds for KRIs, as the organization becomes less willing to accept certain levels of risk. KPIs and risk objectives may also be impacted but are less directly tied to appetite shifts. Risk trends reflect historical data rather than appetite settings

According to the CRISC Review Manual (Digital Version), a vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A delayed removal of employee access is a vulnerability, as it allows former employees to retain access to the organization’s IT assets and processes, which could lead to unauthorized disclosure, modification, or destruction of data or resources. A delayed removal of employee access could be caused by poor personnel management, lack of security awareness, or inadequate access control policies and procedures.

References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.5: IT Risk Identification Methods and Techniques, pp. 32-331