Isaca Updated CRISC Exam Questions and Answers by elle

The completion of a project for implementing a new control would most likely require a risk practitioner to update the risk register. The risk register is a document that records the identified risks, their analysis, and their responses. The completion of a project for implementing a new control means that a risk response has been executed and a new control has been established. This may affect the likelihood and/or impact of the related risks, and the residual risk level. Therefore, the risk practitioner should update the risk register to reflect the current status and outcome of the risk response and the new control. The other options are not as likely to require a risk practitioner to update the risk register, as they are related to the reporting, planning, or assessment of the risks or the controls, not the implementation or completion of the risk response or the new control. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.4: IT Risk Response, page 87.

The primary objective of collecting information and reviewing documentation when performing periodic risk analysis is to identify new or emerging risk issues that may affect the enterprise’s objectives, processes, or resources. This helps to update the risk profile and prioritize the risk responses accordingly. Satisfying audit requirements, surveying and analyzing historical risk data, and understanding internal and external threat agents are secondary objectives that support the primary objective of risk identification. References = Risk IT Framework, 2nd Edition, page 22; CRISC Review Manual, 6th Edition, page 64.

Centralizing IT systems is a process of consolidating and integrating the IT systems or resources in the organization into a single or unified platform or location. Centralizing IT systems helps to improve risk reporting, because it helps to simplify and standardize the risk management process and activities, and to enhance the visibility and transparency of the IT risks and controls. Centralizing IT systems also helps to improve risk reporting, because it helps to facilitate and automate the risk data collection, analysis, and evaluation, and to provide consistent and comprehensive risk information and insights to the organization’s stakeholders, such as the board, management, business units, and IT functions. The other options are not the greatest benefit of centralizing IT systems, although they may be related to the risk management process. Risk classification, risk monitoring, and risk identification are all activities that can help to support or improve the risk management process, but they do not necessarily benefit from centralizing IT systems

The next step to determine the risk exposure after a vulnerability assessment of a web-facing application is to perform a penetration test. A penetration test is a simulated attack on the application to exploit the identified vulnerabilities and measure the potential impact and likelihood of a successful breach. A penetration test can help to quantify and prioritize the risks associated with the web-facing application. Code review, gap assessment, and business impact analysis (BIA) are other possible steps, but they are not as effective as a penetration test. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.