Isaca Updated CRISC Exam Questions and Answers by mathias

According to the ISACA Risk and Information Systems Control study guide and handbook, the most comprehensive approach to capture the risk scenario of collecting and storing credit card information is event tree analysis (ETA). ETA is a forward, top-down, logical modeling technique that explores the responses and outcomes of a single initiating event, such as a data breach or a cyberattack. ETA can help to identify all possible consequences of the scenario, such as financial losses, reputational damages, legal liabilities, regulatory penalties, and customer dissatisfaction. ETA can also help to assess the probabilities of the outcomes and the effectiveness of the controls and mitigation strategies12

1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25

The observation from a third-party service provider review that would be of greatest concern to a risk practitioner is that the service level agreements (SLAs) have not been met over the last quarter, as it indicates a significant performance issue or breach that may affect the quality, functionality, or security of the outsourced services, and may require a remediation or escalation action. The other options are not the greatest concerns, as they may not indicate a performance issue or breach, but rather a contractual, personnel, or financial issue, respectively, that may not affect the outsourced services directly or significantly. References = CRISC Review Manual, 7th Edition, page 111.

The best way to resolve the concern where a control process has been implemented in response to a new regulatory requirement, but has significantly reduced productivity, is to escalate the issue to senior management. Senior management is the highest level of authority and responsibility in the organization, and they are responsible for setting the strategic direction, objectives, and risk appetite of the organization. Senior management should also oversee the risk management process, and ensure that the controls are aligned with the organization’s goals and values. Escalating the issue to senior management can help to find a balance between complying with the regulatory requirement and maintaining the productivity of the organization. The other options are not as effective or desirable as escalating the issue to senior management, because they either ignore the problem, violate the regulation, or compromise the control.

The management action that will most likely change the likelihood rating of a risk scenario related to remote network access is implementing multi-factor authentication. Multi-factor authentication is a technique that requires the user to provide two or more pieces of evidence to verify their identity, such as a password, a token, or a biometric factor. Multi-factor authentication can help to reduce the likelihood of unauthorized or malicious access to theremote network, as it adds an extra layer of security and makes it harder for the attackers to compromise the user credentials. The other options are not as likely to change the likelihood rating of the risk scenario, as they are related to the update, creation, or maintenance of the remote network access, not the verification or protection of the remote network access. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.