Isaca Updated CRISC Exam Questions and Answers by pablo

A threat and vulnerability assessment is a process that identifies and evaluates the potential sources and impacts of risk events on an organization’s assets, processes, and objectives. It also estimates the probability of occurrence and the severity of consequences for each risk event. A threat and vulnerability assessment is the best way to quantify the likelihood of risk materialization, as it provides a numerical or qualitative measure of the risk exposure and the level of uncertainty associated with the risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, p. 68-69

Risk and control self-assessments (RCSAs) are designed to helpbusiness units evaluate their own risks and controls, leading to a deeperunderstanding of inherent and residual riskand more accurate risk profiles.

Data classification is the process of assigning labels or categories to data based on its sensitivity, value, and criticality to the organization. Data classification is the first consideration when analyzing the risk associated with the web application hosted by a cloud service, as it determines the level of protection and controls required for the data. Data classification can help the organization to comply with legal, regulatory, and contractual obligations, such as GDPR,CCPA, and PCI DSS, and to prevent data breaches, leaks, or losses. Data classification can also help the organization to evaluate the suitability and trustworthiness of the cloud service provider, and to negotiate the terms and conditions of the service level agreement (SLA).

The risk practitioner’s primary role during the change is to manage the third-party risk, as this involves identifying, assessing, and mitigating the risks associated with outsourcing the business operations for the emerging technology. The risk practitioner should ensure that the third-party provider has the necessary capabilities, security, and compliance to deliver the expected outcomes and meet the contractual obligations. The risk practitioner should also monitor the performance and service levels of the third-party provider and report any issues or incidents. Developing risk scenarios, managing the threat landscape, and updating risk appetite are all important activities for the risk practitioner, but they are not the primary role during the change. Developing risk scenarios is a technique for identifying and analyzing potential risk events and their impacts. Managing the threat landscape is a process of identifying and responding to the external and internal threats that may affect the organization. Updating risk appetite is a decision that reflects the organization’s willingness to accept or avoid risk in pursuit of its objectives. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 48.