When a high-risk security breach occurs, which of the following would be MOST important to the person responsible for managing the incident?
Correct Answer: A
An analysis of the security logs that illustrate the sequence of events is the most important information for the person responsible for managing the incident, as it can help to identify the source, scope, and impact of the security breach, and to determine the appropriate response actions. An analysis of the security logs can also provide evidence for forensic investigation and legal action, and help to prevent or mitigate future incidents by identifying the root causes and vulnerabilities. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question 235. CRISC by Isaca Actual Free Exam Q&As, Question 9. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 235. CRISC Sample Questions 2024, Question 235.
Question 952
A risk practitioner is reviewing a vendor contract and finds there is no clause to control privileged access to the organization's systems by vendor employees. Which of the following is the risk practitioner's BEST course of action?
Correct Answer: A
Question 953
A risk practitioner discovers that an IT operations team manager bypassed web filtering controls by using a mobile device, in violation of the network security policy. Which of the following should the risk practitioner do FIRST?
Correct Answer: A
According to the CRISC exam content outline2, one of the tasks of a risk practitioner is to "report on risk, in line with organizational reporting requirements, to enable decision making and escalation". Therefore, the first thing that the risk practitioner should do after discovering a policy violation is to report the incident to the appropriate authority, such as the IT security manager or the risk management committee. This will ensure that the incident is properly documented, investigated, and resolved, and that any potential impact or consequences are minimized. The other options are not the first actions that the risk practitioner should take. Planning a security awareness session (B) may be a preventive measure to avoid future incidents, but it does not address the current one. Assessing the new risk may be part of the risk response process, but it should be done after reporting the incident and gathering more information. Updating the risk register (D) may be a result of the risk assessment and response, but it should not be done before reporting the incident and following the organizational procedures.
Question 954
Which of the following aspect of monitoring tool ensures that the monitoring tool has the ability to keep up with the growth of an enterprise?
Correct Answer: A
is incorrect. It ensures that monitoring software is able to change at the same speed as technology applications and infrastructure to be effective over time. Answer: B is incorrect. For software to be effective, it must be customizable to the specific needs of an enterprise. Hence customizability ensures that end users can adapt the software. Answer: D is incorrect. The impact on performance has nothing related to the ability of monitoring tool to keep up with the growth of enterprise.
Question 955
Which of the following would BEST mitigate the risk associated with reputational damage from inappropriate use of social media sites by employees?
Correct Answer: D
The best way to mitigate the risk of reputational damage from inappropriate use of social media sites by employees is to implement training and awareness programs that educate them on the acceptable and unacceptable use of social media, the potential consequences of violating the policy, and the best practices for protecting the organization's reputation and information. Training and awareness programs can also help to foster a culture of risk awareness and responsibility among employees, and encourage them to report any incidents or issues related to social media use. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.2.4, page 131.
