Isaca Updated CRISC Exam Questions and Answers by timur

ACloud Access Security Broker (CASB)acts as a control point between cloud service users and providers to enforce the organization’s security policies consistently across all cloud applications.

CRISC-aligned cloud risk guidance explains:

“CASBs provide visibility, data security, threat protection, and compliance enforcement by applying consistent security controls across all cloud services.”

Therefore, themain issue CASBs addressisinconsistent security policy enforcementbetween on-premise and multiple cloud environments.

Option details:

AandC(SSO and key management) relate to identity or encryption control tools.

Bis unrelated to CASB’s purpose.

Hence,D. Inconsistently applied security policiesis correct.

CRISC Reference:Domain 3 – Risk Response and Mitigation, Topic: Cloud Risk Controls.

According to the CRISC Review Manual, ethics management is the process of ensuring that the enterprise’s values and principles are embedded in its culture and practices. Ethics management helps to promote trust, integrity, accountability, and transparency among the stakeholders. One of the key elements of ethics management is to encourage the reporting of IT risk issues and incidents, and to protect the whistleblowers from any retaliation or negative consequences. Therefore, if employees do not report IT risk issues for fear of consequences, it is the strongest indication that the organization has ethics management issues, as it implies that there is a lack of trust, openness, and support in the organization. The other options are not the strongest indications of ethics management issues, as they are related to other aspects of IT governance,such as audit independence, policy compliance, and risk management framework. References = CRISC Review Manual, 7th Edition, Chapter 1, Section 1.3.2, page 34.

 Understanding Strategic Risk:

Strategic risk refers to the potential losses that can arise from adverse business decisions, improper implementation of decisions, or lack of responsiveness to changes in the business environment.

 Reputational Impact of Cybersecurity Breaches:

A cybersecurity breach can severely damage an organization ' s reputation, affecting customer trust, investor confidence, and market value.

Such impacts go beyond immediate financial losses and can have long-term strategic implications for the organization ' s competitive position and strategic objectives.

 Classification of Risk:

Financial Risk:Direct financial losses due to a breach (e.g., fines, legal costs) but does not cover reputational impacts.

Data Risk:Focuses on the loss or compromise of data but not the broader strategic impact.

Operational Risk:Pertains to disruptions in business operations, while reputational damage influences the organization’s strategic direction and goals.

 Strategic Risk and Reputation:

Reputational damage from a cybersecurity breach can lead to a loss of customer base, reduced market share, and difficulties in strategic partnerships, all of which are strategic concerns.

Addressing reputational risk requires strategic planning, proactive communication, and long-term efforts to rebuild trust and credibility.

 References:

The CRISC Review Manual highlights that reputational risk is a significant aspect of strategic risk, especially following cybersecurity incidents (CRISC Review Manual, Chapter 1: Governance, Section 1.1.3 Importance and Value of IT Risk Management)​​.

 The most important factor to ensure when reviewing an organization’s risk register is that the risk ownership is recorded, as it indicates the authority and responsibility for managing the risk and its associated controls, and facilitates the communication and accountability of the risk management process and activities. The other options are not the most important factors, as they are more related to theidentification, classification, or measurement of the risk, respectively, rather than the management of the risk. References = CRISC Review Manual, 7th Edition, page 101.