Isaca Updated CRISC Exam Questions and Answers by benji

According to the CRISC Review Manual1, control process efficiency is the degree to which a control process achieves its intended objectives with minimum resources, time, and cost. The primary objective for automating controls is to improve control process efficiency, as automation can help to reduce human errors, increase consistency and accuracy, enhance scalability and flexibility, and optimize performance and productivity. Automation can also help to achieve other objectives, such as facilitating continuous control monitoring, complying with functional requirements, and reducing the need for audit reviews, but these are not the primary objective for automating controls. References = CRISC Review Manual1, page 202.

A security policy exception is a deviation from the established security policy that is granted to an individual or a group for a specific purpose or period of time. A security policy exception may be necessary when the security policy is too restrictive, outdated, or incompatible with the business requirements or objectives. However, a security policy exception also introduces a risk to the organization, as it may weaken the security posture, expose the organization to threats or vulnerabilities, or violate the compliance or regulatory obligations. Therefore, an upward trend in the number of security policy exceptions approved should be of most concern, as it indicates that the security policy is not effective or aligned with the organization’s needs and goals, and that the organization is accepting more risk than desired. The other options are not as concerning as the number of security policy exceptions approved, because they do not imply a direct or immediate risk to the organization, but rather reflect the normal or expected activities of the security management process, as explained below:

A. Number of business change management requests is a metric that measures the volume and frequency of the requests to modify the business processes, systems, or functions. An upward trend in this metric may indicate that the organization is undergoing a transformation, innovation, or improvement, which may have positive or negative impacts on the organization’s performance and security. However, this metric does not necessarily imply a risk to the organization, as the change management requests may be properly assessed, approved, and implemented, following the established change management procedures and controls.

B. Number of revisions to security policy is a metric that measures the amount and extent of the changes made to the security policy over time. An upward trend in this metric may indicate that the security policy is being updated, refined, or enhanced, which may improve or maintain the security posture and compliance of the organization. However, this metric does not necessarily imply a risk to the organization, as the revisions to the security policy may be based on the best practices, standards, and expectations for security management, and may be communicated and enforced effectively across the organization.

D. Number of changes to firewall rules is a metric that measures the number and type of the modifications made to the firewall configuration, which controls the incoming and outgoing network traffic based on predefined rules. An upward trend in this metric may indicate that the firewall is being adjusted, optimized, or customized, which may increase or decrease the firewall performance and security. However, this metric does not necessarily imply a risk to the organization, as the changes to the firewall rules may be justified, authorized, and validated, following the established firewall management procedures and controls. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 115. Security Policy Exceptions: What Are They and How to Manage Them, Security Policy Exceptions: How to Handle Them in a Secure Manner, Security Policy Exceptions: A Necessary Evil?

The best method for identifying vulnerabilities is periodic network scanning. Network scanning is a process of scanning and probing the network devices, systems, and applications to discover and analyze their security weaknesses, such as configuration errors, outdated software, or open ports. Network scanning can help to identify the vulnerabilities that could be exploited by attackers to gain unauthorized access, compromise data, or disrupt services. Periodic network scanning is the best method, because it can provide a regular and comprehensive view of the network security posture, and it can detect and address the new or emerging vulnerabilities in a timely manner. Periodic network scanning can also help to comply with the legal and regulatory requirements and standards for network security, such as the ISO/IEC 27001, the NIST SP 800-53, or the PCI DSS123. The other options are not the best method, although they may be useful or complementary to periodic network scanning. Batch job failure monitoring is a process of monitoring and reporting the failures or errors that occur during the execution of batch jobs, such as data processing, backup, or synchronization. Batch job failure monitoring can help to identify the operational or technical issues that affect the performance or availability of the network services, but it does not directly identify the security vulnerabilities or the potential threats. Annual penetration testing is a process of simulating a real-world attack on the network devices, systems, and applications to evaluate their security defenses and resilience. Penetration testing can help to identify and exploit the vulnerabilities that could be used by attackers to compromise the network security, and to provide recommendations for improvement. However, annual penetration testing is not the best method, because it is not frequent or consistent enough to keep up with the changing and evolving network security landscape, and it may not cover all the network components or scenarios. Risk assessments are a process of identifying, analyzing, and evaluating the risks associated with the network devices, systems, and applications. Risk assessments can help to estimate the probability and impact of the vulnerabilities and the threats, and to prioritize and respond to the risks accordingly. However, risk assessments are not the same as or a substitute for vulnerability identification, as they rely on the vulnerability information as an input, rather than an output. References = Vulnerability Testing: Methods, Tools, and 10 Best Practices, ISO/IEC 27001 Information Security Management, NIST SP 800-53 Rev. 5

The risk owner is primarily accountable for risk treatment decisions, as they are the person or entity with the authority and responsibility to manage a particular risk. The risk owner should evaluate the available risk response options, select the most appropriate one, implement the chosen response, and monitor its effectiveness. The risk owner should also communicate and report on the risk status and any issues or changes. The business manager, data owner, and risk manager are not primarily accountable for risk treatment decisions, although they may be involved in the risk management process. The business manager is responsible for the overall performance and objectives of a business unit or function. The data owner is responsible for the security and quality of a specific data asset. The risk manager is responsible for facilitating and coordinating the risk management activities across the organization. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 47.