CRISC Exam Dumps - Certified in Risk and Information Systems Control

Configuration management is a process that establishes and maintains the consistency and integrity of the IT systems and applications throughout their lifecycle. Configuration management involves identifying, documenting, controlling, and auditing the configuration items, such as hardware, software, data, or services, that comprise the IT systems and applications. Configuration management also involves establishing and enforcing the configuration baselines, which are the approved and authorized states of the configuration items. Implementing configuration management will best help ensure that systems comply with an established baseline before deployment, as it will enable the enterprise to verify that the systems meet the specified requirements, standards, and policies, and to detect and correct any deviations or discrepancies. The other options are not as effective as configuration management, as they involve different aspects or outcomes of the IT systems and applications:

Vulnerability scanning is a process that identifies and analyzes the weaknesses or gaps in the IT systems and applications that could be exploited by threats. Vulnerability scanning helps to assessthe security and compliance of the systems, but it does not ensure that the systems comply with an established baseline before deployment, as it may not cover all the aspects or components of the systems, or may not reflect the latest changes or updates of the systems.

Continuous monitoring and alerting is a process that tracks and reports the performance and status of the IT systems and applications on an ongoing basis. Continuous monitoring and alerting helps to identify and respond to any issues or incidents that affect the availability, integrity, or confidentiality of the systems, but it does not ensure that the systems comply with an established baseline before deployment, as it may not prevent or detect the unauthorized or unintended changes or modifications of the systems, or may not provide sufficient information or evidence to verify the compliance of the systems.

Access controls and active logging are processes that restrict and record the access and activities of the users or entities on the IT systems and applications. Access controls and active logging help to protect and audit the IT systems and applications, but they do not ensure that the systems comply with an established baseline before deployment, as they may not address the configuration or quality issues of the systems, or may not be consistent or comprehensive across the systems. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1.1, pp. 156-157.

The primary reason for periodically monitoring key risk indicators (KRIs) is to detect changes in the risk profile of the enterprise. KRIs are metrics that provide information on the level of exposure to a specific risk or a group of risks. By monitoring KRIs, the enterprise can identifyany deviations from the expected risk level, and take appropriate actions to adjust the risk response or the risk appetite. Monitoring KRIs also helps to validate the effectiveness of risk mitigation controls and the accuracy of risk assessments. Rectifying errors in results of KRIs, reducing costs of risk mitigation controls, and continually improving risk assessments are possible benefits of monitoring KRIs, but they are not the primary reason. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.1.1.2, page 175.

According to the CRISC Review Manual1, the application owner is the person who has the authority and accountability for the achievement of the application objectives and the management of the associated risks. The application owner is responsible for defining the level of resiliency needed for the application, which is the ability of the application to recover from disruptions and continue to operate. The application owner is also responsible for accepting or rejecting the residual risks after the implementation of the disaster recovery controls, which are the measures to restore the application functionality and data in the event of a disaster. Therefore, the risk owner in this scenario is the application owner, as they are the ones who will be affected by the potential impact of the disaster on the application and its objectives. References = CRISC Review Manual1, page 194.

The management action that will most likely change the likelihood rating of a risk scenario related to remote network access is implementing multi-factor authentication. Multi-factor authentication is a technique that requires the user to provide two or more pieces of evidence to verify their identity, such as a password, a token, or a biometric factor. Multi-factor authentication can help to reduce the likelihood of unauthorized or malicious access to theremote network, as it adds an extra layer of security and makes it harder for the attackers to compromise the user credentials. The other options are not as likely to change the likelihood rating of the risk scenario, as they are related to the update, creation, or maintenance of the remote network access, not the verification or protection of the remote network access. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

The software version is the component of a software inventory that best enables the identification and mitigation of known vulnerabilities. The software version is the specific release or update of a software product that has a unique identifier, such as a number or a name. The software version indicates the features, functions, and security patches that are included in the software product. By knowing the software version, the organization can compare it with the latest available version and identify any missing or outdated security fixes. The organization can then mitigate the known vulnerabilities by updating or upgrading the software to the latest version. The other components of a software inventory, such as the assigned software manager, the software support contract expiration, and the software licensing information, are not as directly related tothe identification and mitigation of known vulnerabilities, although they may provide some contextual or administrative information. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.2, page 2-25.

 Cross-site scripting (XSS) and SQL injection are two common types of web application attacks that can compromise the confidentiality, integrity, and availability of data and systems. XSS allows an attacker to inject malicious code into a web page that is viewed by other users, while SQL injection allows an attacker to execute arbitrary commands on a database server by manipulating the input parameters of a web application. Both attacks can result in data theft, unauthorized access, defacement, denial of service, and more.

To mitigate these attacks, the best option is to require the software vendor to remediate the vulnerabilities by applying secure coding practices, such as input validation, output encoding, parameterized queries, and HTML sanitization. These techniques can prevent or limit the impact of XSS and SQL injection by ensuring that user input is not interpreted as code or commands by the web browser or the database server. The software vendor should also provide regular updates and patches to fix any known or newly discovered vulnerabilities.

The other options are not effective or acceptable ways to mitigate these attacks. Monitoring the databases for abnormal activity can help detect and respond to SQL injection attacks, but it does not prevent them from happening or address the root cause of the vulnerability. Approving an exception to allow the software to continue operating can expose the organization to unnecessary risks and liabilities, as well as violate compliance requirements and standards. Accepting the risk and letting the vendor run the software as is can also have serious consequences for the organization, as it implies that the potential impact and likelihood of the attacks are low or acceptable, which may not be the case. References =

IT Risk Resources | ISACA

CRISC Certification | Certified in Risk and Information Systems Control | ISACA

Cross Site Scripting Prevention Cheat Sheet - OWASP

A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm | EURASIP Journal on Information Security | Full Text

Difference Between XSS and SQL Injection - GeeksforGeeks

Implementing automated log monitoring is the best control to detect an advanced persistent threat (APT), which is a stealthy and continuous attack on a target network or system. Automated log monitoring can help to identify anomalous or suspicious activities, such as unusual network traffic, unauthorized access attempts, or data exfiltration, that may indicate the presence of an APT. Utilizing antivirus systems and firewalls, conducting regular penetration tests, and monitoring social media activities are controls that help to prevent or mitigate APTs, but not to detect them. References = Most Asked CRISC Exam Questions and Answers - The Knowledge Academy, question 200.

According to the CRISC Review Manual, recovery time objectives (RTOs) are the maximum acceptable time that an IT system can be inoperable without causing significant damage to the business operations and objectives. RTOs are determined by the business impact analysis (BIA) and are used to define the recovery strategies and priorities. Therefore, if the RTOs do not meet the business requirements, it would be themost significant deficiency in the BCP, as it would imply that the recovery plan is not aligned with the business needs and expectations. The other options are not the most significant deficiencies, as they do not directly affect the recovery time and the business continuity. BCP testing is not necessarily done in conjunction with the DRP, as they have different scopes and objectives. BCP testing can use different methods, such as walk-through, simulation, or full interruption, depending on the purpose and scope of the test. Each business location can have separate BCPs, as long as they are consistent with the enterprise-wide BCP and the business requirements. References = CRISC Review Manual, 7th Edition, Chapter 5, Section 5.2.2, page 240.