Isaca Updated CRISC Exam Questions and Answers by yasmine

The best recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization is to conduct a simulated phishing attack, as it tests the awareness and behavior of the employees in responding to a realistic and targeted email scam, and identifies the areas and individuals that need improvement or training. Updating spam filters, revising the acceptable use policy, and strengthening disciplinary procedures are not the best recommendations, as they may not address the human factor of the risk, or may be too reactive or punitive, respectively. References = CRISC Review Manual, 7th Edition, page 155.

The most useful information to determine mitigating controls when a core data center went offline abruptly for several hours affecting many transactions across multiple locations is the root cause analysis. Root cause analysis is a technique that identifies the underlying factors or reasons that caused the problem or incident. Root cause analysis can help to understand the nature, scope,and impact of the problem or incident, and to prevent or reduce the recurrence or severity of the problem or incident in the future. Root cause analysis can also help to identify and prioritize the appropriate mitigating controls that address the root causes of the problem or incident. The other options are not as useful as root cause analysis, as they are related to the investigation, evaluation, or measurement of the problem or incident, not the resolution or prevention of the problem or incident. References = Risk and Information Systems ControlStudy Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.4: Key Control Indicators, page 211.

The correct answer isBbecause a change in business strategy that affects an application’srecovery point objective (RPO)means the organization’s assessment of business criticality, recovery requirements, and time-sensitive dependencies has changed. These are determined through thebusiness impact analysis (BIA). The BIA is the key document and process used to identify critical business functions, dependencies, and recovery requirements such as recovery objectives.

The other options are less appropriate:

A. IT inventorylists assets, but it does not determine business recovery requirements.

C. Risk registermay eventually reflect related risk changes, but the primary source that drives recovery objective updates is the BIA.

D. CMDBrecords configuration items and relationships, but not business-driven recovery requirements at the same level as a BIA.

Exact Extracts supporting the answer:

“The main outcome of a business impact analysis (BIA) is the criticality of business processes.”

“The most useful process in developing a series of recovery time objectives is business impact analysis.”

“A business impact analysis is primarily used to evaluate the impact of disruption on an enterprise’s ability to operate over time.”

“The objective of a business impact analysis is best described as the identification of time-sensitive critical business functions and interdependencies.”

“To best help an enterprise analyze risk incidents and related interdependencies to determine the impact on enterprise goals is a business impact analysis.”

These extracts show that recovery requirements are business-driven and are established through the BIA. Therefore, if business strategy changes and RPO must be increased, thebusiness impact analysismust be updated.

===========

According to the CRISC Manual, developing IT risk scenarios must align with business objectives to ensure the scenarios are relevant and meaningful. A top-down approach driven by organizational objectives ensures scenarios are contextually appropriate and address what matters most to the enterprise. This ensures that risk management supports the enterprise’s ability to achieve its mission and goals.