Isaca Updated CRISC Exam Questions and Answers by euan

Conducting vulnerability scans is the best way for a risk practitioner to validate the effectiveness of a patching program. Vulnerability scans are automated tools that identify and report on the vulnerabilities in a system or network, such as missing patches, misconfigurations, or outdated software. Vulnerability scans can help the risk practitioner to verify that the patches have been applied correctly and consistently, and that there are no remaining or new vulnerabilities that need to be addressed. Conducting penetration testing, interviewing IT operations personnel, and reviewing change control board documentation are also useful methods to evaluate the patching program, but they are not as comprehensive, objective, or timely as vulnerabilityscans. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.3, page 2-28.

The best course of action for the risk practitioner is to follow the incident reporting procedures established by the organization. This will ensure that the incident is properly documented, escalated, and resolved in a timely and consistent manner. Reporting the incident to the chief risk officer, advising the employee to forward the email to the phishing team, or advising the employee to permanently delete the email are not the best courses of action, as they may not comply with the organization’s policies and standards, and may not address the root cause and impact of the incident. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.2.1, page 193.

 Customer behavior data is the information that reflects how customers interact with a brand, product, or service, such as their preferences, needs, motivations, and feedback1. Collecting customer behavior data through social media advertising can help an organization to understand its target market, improve its customer experience, and optimize its marketing strategies2.

However, collecting customer behavior data through social media advertising also poses significant business risks, especially for a global organization that operates in different countries. Among the four options given, the most important business risk to be considered is the regulatory requirements that may differ in each country. This means that the organization should:

Be aware of the different laws and regulations that govern the collection, processing, storage, and transfer of personal data in each country, such as the GDPR in the EU, the CCPA in California, or the PDPA in Singapore3

Ensure that the organization complies with the relevant data protection and privacy rules and standards in each country, such as obtaining consent, providing notice, ensuring security, and respecting rights4

Avoid or mitigate the potential legal, financial, reputational, or operational consequences of violating the data protection and privacy laws and regulations in each country, such as fines, lawsuits, sanctions, or loss of trust5

References = What is Customer Behavior Data?, How to Collect Customer Behavior Data for Marketing, Data Protection Laws Around the World, Data Protection and Privacy: The Age of Intelligent Machines, The Risks of Non-Compliance with Data Protection Laws

The lack of due diligence for the recommended cloud vendor should be of greatest concern to the risk practitioner, because it exposes the organization to potential risks and issues related to the security, reliability, performance, and compliance of the cloud service provider. Due diligence is a process of conducting a thorough investigation and evaluation of a potential vendor or partnerbefore entering into a contractual relationship. Due diligence helps to verify the vendor’s credentials, capabilities, reputation, and track record, and to identify any red flags or gaps that may affect the quality or suitability of the service. Cloud computing is a model of delivering IT services over the internet, where the service provider owns and manages the IT infrastructure, platforms, or applications, and the customer pays only for the resources or functions they use. Cloud computing can offer cost savings, scalability, and flexibility for the business, but it also introduces new risks and challenges, such as data privacy, security breaches, vendor lock-in, service outages, or regulatory compliance. Therefore, performing due diligence for the recommended cloud vendor is essential to ensure that the organization’s expectations and requirements are met, and that the risks and issues are identified and addressed. The business introducing new SaaS solutions without IT approval, the maintenance of IT infrastructure being outsourced to an IaaS provider, and the architecture responsibilities not being clearly defined are all possible concerns for the risk practitioner, but they are not the greatest concern, as they can bemitigated or resolved with appropriate controls, policies, or agreements. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.2.1, page 183