Free Access ISACA.CRISC.v2025-07-19.q999 Practice Test (Page 173)

Question 856

Which of the following is the BEST key performance indicator (KPI) to measure the effectiveness of an anti- virus program?

A.Frequency of anti-virus software updates

B.Number of alerts generated by the anti-virus software

C.Percentage of IT assets with current malware definitions

D.Number of false positives detected over a period of time

Question 857

Which of the following is the MOST important objective of the information system control?

A.Business objectives are achieved and undesired risk events are detected and corrected

B.Ensuring effective and efficient operations

C.Developing business continuity and disaster recovery plans

D.Safeguarding assets

E.Explanation:
The basic purpose of Information System control in an organization is to ensure that the business objectives are achieved and undesired risk events are detected and corrected. Some of the IS control objectives are given below : Safeguarding assets Assuring integrity of sensitive and critical application system environments Assuring integrity of general operating system Ensuring effective and efficient operations Fulfilling user requirements, organizational policies and procedures, and applicable laws and regulations Changing management Developing business continuity and disaster recovery plans Developing incident response and handling plans Hence the most important objective is to ensure that business objectives are achieved and undesired risk events are detected and corrected.

Question 858

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

A.Project management plan

B.Project communications plan

C.Project contractual relationship with the vendor

D.Project scope statement

E.Explanation:
When new risks are identified as part of the scope additions, Walter should update the risk register
and the project management plan to reflect the responses to the risk event.

F.is incorrect. The project scope statement is changed as part of the scope approval that
has already happened.

G.is incorrect. The contractual relationship won't change with the vendor as far as project
risks are concerned.

Question 859

Which of the following is MOST important for a risk practitioner to consider when determining the control requirements for data privacy arising from emerging technologies?

A.internal audit recommendations

B.Laws and regulations

C.Policies and procedures

D.Standards and frameworks

Correct Answer: B

The most important factor for a risk practitioner to consider when determining the control requirements for data privacy arising from emerging technologies is the laws and regulations that apply to the organization and the technologies. Laws and regulations are the legal and ethical obligations that the organization must comply with when collecting, processing, storing, and sharing personal data. Laws and regulations can vary depending on the jurisdiction, sector, and type of data involved, and they can impose different requirements and restrictions on the use of emerging technologies that may affect data privacy. For example, the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) in the United States, and the Personal Data Protection Act (PDPA) in Singapore are some of the laws and regulations that govern data privacy and protection in different regions and contexts123. A risk practitioner should consider the laws and regulations when determining the control requirements for data privacy arising from emerging technologies, because they can help to ensure that the organization respects the rights and interests of the data subjects, avoids legal and reputational risks, and maintains trust and accountability. The other options are not the most important factor, although they may be relevant or influential to the control requirements for data privacy arising from emerging technologies. Internal audit recommendations are the suggestions and feedback from the internal audit function, which evaluates and improves the effectiveness of the governance, risk management, and control systems of the organization, but they do not supersede or replace the laws and regulations. Policies and procedures are the rules and guidelines that define how the organization operates and conducts its activities, but they should be aligned and consistent with the laws and regulations. Standards and frameworks are the best practices and benchmarks that are adopted by the organization to guide and support its processes and performance, but they should be compatible and compliant with the laws and regulations. References = Emerging privacy-enhancing technologies: Current regulatory and policy approaches | en | OECD, Data and Cybersecurity: 2023 Regulatory Challenges - KPMG, Ethical Dilemmas and Privacy Issues in Emerging Technologies: A ... - MDPI

Question 860

Which of the following is MOST helpful in aligning IT risk with business objectives?

A.Performing a business impact analysis (BIA)

B.Integrating the results of top-down risk scenario analyses

C.Introducing an approved IT governance framework

D.Implementing a risk classification system

Other Version: 6491ISACA.CRISC.v2024-09-11.q999; 7512ISACA.CRISC.v2022-10-10.q527; 12561ISACA.CRISC.v2022-08-23.q834; 15340ISACA.CRISC.v2022-05-05.q821; 66ISACA.Examboosts.CRISC.v2021-09-26.by.erica.460q.pdf

Latest Upload: 105OCEG.GRCP.v2025-09-11.q211; 104HP.HPE0-V27.v2025-09-11.q78; 118Oracle.1Z0-1057-23.v2025-09-10.q47; 152Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 131SAP.C-S4EWM-2023.v2025-09-08.q83; 166TheSecOpsGroup.CNSP.v2025-09-08.q20; 225CFAInstitute.ESG-Investing.v2025-09-08.q173; 175PECB.ISO-IEC-27001-Lead-Implementer.v2025-09-06.q132; 151Salesforce.Data-Architect.v2025-09-05.q216; 148Adobe.AD0-E605.v2025-09-05.q50

Question 856

Question 857

Question 858

Question 859

Question 860

Download PDF File