CRISC Exam Dumps - Certified in Risk and Information Systems Control

Embedding risk management into processes that are aligned with business drivers is the most effective way to integrate risk and compliance management, as it ensures that the risk management objectives and activities are consistent and supportive of the enterprise’s strategic goals and values. It also enables the identification and management of risks and compliance requirements across the enterprise, and the optimization of risk and compliance resources and performance. Embedding risk management into compliance decision-making, designing corrective actions to improve risk response capabilities, and conducting regular self-assessments to verify compliance are not ways to integrate risk and compliance management, but rather components or outcomes of the risk and compliance management process. References = CRISC Practice Quiz and Exam Prep; CRISC: Certified in Risk & Information Systems Control Sample Questions, question 202.

Risk assessment is a key process that identifies, analyzes, and evaluates the risks associated with the implementation of an emerging technology. It helps to determine the potential impact and likelihood of the risks, as well as the appropriate risk responses and controls. Lack of risk assessment can lead to poor decision making, inadequate risk mitigation, and unexpected consequences. Therefore, it should be of greatest concern to a risk practitioner reviewing the implementation of an emerging technology. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.2.1, p. 226-227

The most important element of an organization’s risk register to update following the commissioning of a new financial reporting system is the risk rating of affected financial processes. A risk rating is a measure of the level and nature of the risk exposure, based on the impact and likelihood of the risk events. A risk rating can help to prioritize and respond to the risks, and to monitor and report the risk status. A new financial reporting system may introduce new or different risks, or change the existing risks, that could affect the financial processes of the organization, such as data quality, accuracy, timeliness, compliance, or security. Therefore, the risk rating of affected financial processes should be updated to reflect the current risk situation and to ensure that the risk register is accurate and complete. Key risk indicators (KRIs), the owner of the financial reporting process, and the list of relevant financial controls are not as important as the risk rating of affected financial processes, as they are not directly affected by the commissioning of a new financial reporting system, and they do not measure the risk exposure and impact of the financial processes. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 48.

User accounts provisioning is the process of creating, managing, and modifying user accounts within a system or an application, based on the user’s roles, responsibilities, and requirements. User accounts provisioning is an essential part of identity and access management (IAM), which aims to ensure the confidentiality, integrity, and availability of the system or the application, and the information or resources that it handles or supports1.

The best key performance indicator (KPI) for monitoring adherence to an organization’s user accounts provisioning practices is the percentage of accounts without documented approval, because it can help to measure how well the organization follows the policies, standards, and procedures for user accounts provisioning, and how effectively the organization controls and audits the user accounts provisioning activities. The percentage of accounts without documented approval can indicate:

The level of compliance and accountability of the user accounts provisioning process, and the extent to which the user accounts provisioning requests and actions are authorized and verified by the appropriate parties, such as managers, IT staff, or security officers

The level of risk and exposure of the user accounts provisioning process, and the likelihood and impact of unauthorized or inappropriate user accounts provisioning, such as granting excessive or unnecessary access privileges, creating duplicate or fraudulent accounts, or violating legal or regulatory requirements

The level of quality and efficiency of the user accounts provisioning process, and the ability and capacity of the organization to manage and maintain the user accounts provisioning records and documents, such as forms, logs, or reports23

The other options are not the best KPIs for monitoring adherence to an organization’s user accounts provisioning practices, but rather some of the factors or outcomes of it. User accounts with default passwords are user accounts that have not changed their passwords from the initial or default values that are assigned by the system or the application. User accounts with default passwords are a factor that can increase the risk of unauthorized or malicious access to the system or the application, as the default passwords may be easily guessed or compromised by attackers. Active accounts belonging to former personnel are user accounts that have not been deactivated or deleted after the users have left the organization. Active accounts belonging to former personnel are an outcome of ineffective or inefficient user accounts deprovisioning, which is the process of revoking or removing the user accounts and access privileges when they are no longer needed or valid. Accounts with dormant activity are user accounts that have not been used or accessed for a long period of time. Accounts with dormant activity are an outcome of poor or inconsistent user accounts management, which is the process of updating or modifying the user accounts and access privileges according to the changes or needs of the users or the organization4. References =

User Provisioning for SaaS Apps: Top 10 Best Practices | Resmo

Top Identity and Access Management Metrics

KPI-driven approach to Identity & Access Management - Elimity

[CRISC Review Manual, 7th Edition]

Authentication logs are records of the attempts and results of logging into an IT system, network, or application, such as the user name, password, date, time, location, or device1. Authentication logs can help to verify and audit the identity and access of the users, and to detect and investigate any unauthorized or suspicious login activities, such as failed or repeated attempts, or unusual patterns or locations2.

Among the four options given, the discovery that authentication logs have been disabled should be of greatest concern to the organization. This is because disabling authentication logs can:

Prevent or hinder the organization from monitoring and controlling the access and activity of the users, especially the disgruntled, terminated IT administrator who may have malicious intentions or insider knowledge

Enable or facilitate the disgruntled, terminated IT administrator or other attackers to bypass or compromise the authentication mechanisms or policies, and gain unauthorized or elevated access to the IT systems, networks, or applications

Conceal or erase the evidence or traces of the login attempts or actions of the disgruntled, terminated IT administrator or other attackers, and make it difficult or impossible to identify, investigate, or prosecute them

Indicate or imply that the disgruntled, terminated IT administrator or other attackers have already breached or compromised the IT systems, networks, or applications, and have disabled the authentication logs to cover their tracks or avoid detection3

References = What is Authentication Logging?, Authentication Logging - Wikipedia, Fired admin cripples former employer’s network using old credentials

 Risk monitoring is the process of tracking and evaluating the performance and effectiveness of the risk management process and controls, and identifying any changes or emerging risks that may affect the enterprise’s objectives and strategy. The primary benefit of risk monitoring is that it facilitates risk-aware decision making, as it provides timely and relevant information and feedback to the decision-makers and stakeholders, and enables them to adjust the risk strategy and response actions accordingly. Risk monitoring also helps to ensure that the risk management process is aligned with the enterprise’s risk appetite and tolerance, and supports the achievement of the enterprise’s goals and value creation. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 239. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 239. CRISC Sample Questions 2024, Question 239.

Multi-factor authentication is the most effective way to mitigate the risk of unauthorized access to the system, as it requires the users to provide more than one piece of evidence to prove their identity, such as a password, a token, a biometric feature, etc. This reduces the likelihood of compromising the credentials and ensures that only authorized users can perform maintenance on the system.

Single sign-on is a convenience feature that allows users to access multiple systems with one set of credentials, but it does not address the risk of sharing credentials among multiple users.

Audit trail review is a detective control that can help identify and investigate unauthorized access to the system, but it does not prevent or mitigate the risk of credential compromise.

Data encryption at rest is a security measure that protects the data stored on the system from unauthorized access, but it does not prevent or mitigate the risk of credential compromise. References = CRISC Review Manual, 7th Edition, ISACA, 2020, page 107-108.

 A bring your own device (BYOD) initiative allows employees to use their personal devices, such as smartphones, tablets, or laptops, for work purposes. This can provide benefits such as increased productivity, flexibility, and employee satisfaction. However, it also introduces significant risks, such as data loss, data leakage, malware infection, unauthorized access, and compliance violations. Among these risks, data loss is of greatest concern for an organization, as it can have severe consequences, such as reputational damage, legal liability, financial loss, and competitive disadvantage. Data loss can occur due to various reasons, such as device theft, loss, damage, or disposal, accidental deletion, unauthorized transfer, or malicious attack. Therefore, an organization considering the adoption of a BYOD initiative should implement appropriate controls, such as encryption, authentication, remote wipe, backup, and data classification, to protect the data stored or accessed on the personal devices. References = Bring Your Own Device (BYOD) Policy: What You Need to Know, BYOD Risks: What You Need to Know, BYOD Security: 8 Risks and How to Mitigate Them