Free Access ISACA.CRISC.v2022-05-05.q821 Practice Test (Page 15)

Question 66

A risk practitioner has observed that there is an increasing trend of users sending sensitive information by email without using encryption. Which of the following would be the MOST effective approach to mitigate the risk associated with data loss?

A.Block unencrypted outgoing emails which contain sensitive data.

B.Implement a tool to create and distribute violation reports

C.Raise awareness of encryption requirements for sensitive data.

D.Implement a progressive disciplinary process for email violations.

Question 67

The acceptance of control costs that exceed risk exposure is MOST likely an example of:

A.corporate culture misalignment.

B.high risk tolerance

C.corporate culture alignment.

D.low risk tolerance.

Question 68

Which of the following is the BEST key control indicator (KCI) for risk related to IT infrastructure failure?

A.Percentage of systems with outdated virus protection

B.Number of times the recovery plan is reviewed

C.Percentage of employees who can work remotely

D.Number of successful recovery plan tests

Question 69

Which of the following role carriers is accounted for analyzing risks, maintaining risk profile, and risk-aware decisions?

A.Business management

B.Business process owner

C.Chief information officer (CIO)

D.Chief risk officer (CRO)

Question 70

You are the project manager of GHT project. Your hardware vendor left you a voicemail saying that the delivery of the equipment you have ordered would not arrive on time. She wanted to give you a heads-up and asked that you return the call. Which of the following statements is TRUE?

A.This is a residual risk.

B.This is a trigger.

C.This is a contingency plan.

D.This is a secondary risk.

E.Explanation:
Triggers are warning signs of an upcoming risk event. Here delay in delivery signifies that there
may be a risk event like delay in completion of project. Hence it is referred to as a trigger.

F.is incorrect. A contingency plan is a plan devised for a specific situation when things go
wrong. Contingency plans are often devised by governments or businesses who want to be
prepared for anything that could happen.
Here there are no such plans.

G.is incorrect. Residual risk is the risk that remains after applying controls. But here in this
scenario, risk event has not occurred yet.

Other Version: 3354ISACA.CRISC.v2025-07-19.q999; 6471ISACA.CRISC.v2024-09-11.q999; 7512ISACA.CRISC.v2022-10-10.q527; 12549ISACA.CRISC.v2022-08-23.q834; 66ISACA.Examboosts.CRISC.v2021-09-26.by.erica.460q.pdf

Latest Upload: 105OCEG.GRCP.v2025-09-11.q211; 104HP.HPE0-V27.v2025-09-11.q78; 118Oracle.1Z0-1057-23.v2025-09-10.q47; 150Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 131SAP.C-S4EWM-2023.v2025-09-08.q83; 164TheSecOpsGroup.CNSP.v2025-09-08.q20; 223CFAInstitute.ESG-Investing.v2025-09-08.q173; 158PECB.ISO-IEC-27001-Lead-Implementer.v2025-09-06.q132; 149Salesforce.Data-Architect.v2025-09-05.q216; 144Adobe.AD0-E605.v2025-09-05.q50

Question 66

Question 67

Question 68

Question 69

Question 70

Download PDF File