Isaca Updated CRISC Exam Questions and Answers by timur

The type of control that has been applied when an organization provides legal text explaining the rights and expected behavior of users accessing a system from geographic locations that have strong privacy regulations is directive. A directive control is a control that guides or instructs the users or the staff on the policies, procedures, or standards that they need to follow or comply with when performing their tasks or activities. A directive control can help to prevent or reduce the risk of non-compliance, errors, or violations, by ensuring that the users or the staff are aware and informed of the expectations and requirements of the organization or the system. A directive control can also help to enforce the accountability and responsibility of the users or the staff, and to support the audit and monitoring of their actions and behaviors. Providing legal text explaining the rights and expected behavior of users accessing a system from geographic locations that have strong privacy regulations is an example of a directive control, as it informs the users of the legal obligations and consequences of using the system, and instructs them on how to protect their privacy and the privacy of others. Detective, preventive, and compensating are not the correct types of control, as they do not match the definition or the purpose of the control that has been applied. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

Conducting root cause analyses for risk events is the first recommendation that a risk practitioner should make when an increasing trend of risk events and subsequent losses has been identified, as this helps to identify the underlying causes and sources of the risk events, and to determine the appropriate actions to address them. Root cause analysis is a systematic process of collecting and analyzing data, finding the root causes, and implementing solutions to prevent recurrence or reduce the impact of the risk events. Educating personnel on risk mitigation strategies, integrating the risk event and incident management processes, and implementing controls to prevent future risk events are not the first recommendations, but rather the possible outcomes or actions of conducting root cause analyses for risk events. References = CRISC Certified in Risk and Information Systems Control – Question208; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 208.

The most helpful way to mitigate the risk associated with an application under development not meeting business objectives is to include key stakeholders in the review of user requirements, because this ensures that the application is designed and developed according to the needs and expectations of the end users and the business owners. Including key stakeholders in the review of user requirements also helps to avoid scope creep, requirement changes, or miscommunication that may affect the quality, functionality, or usability of the application. The other options are not the most helpful ways to mitigate the risk, although they may also be useful in reducing the likelihood or impact of the risk. Identifying threats that may compromise enterprise architecture (EA), including diverse business scenarios in user acceptance testing (UAT), and performing risk assessments during the business case development stage are examples of preventive or detective controls that aim to identify and address the potential issues or problems that may arise during the application development process, but they do not address the alignment of the application with the business objectives. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

 The most important consideration when implementing ethical remote work monitoring is to inform the employees of how they are being monitored, because this respects their privacy rights and expectations, and ensures their consent and compliance with the monitoring policy. Informing the employees of how they are being monitored also helps to build trust and transparency between the employer and the employees, and reduces the potential legal or ethical issues that may arise from the monitoring activities. The other options are not the most important considerations, although they may also be relevant for ethical remote work monitoring. Monitoring only during official hours of business, reporting on nonproductive employees to management, and integrating multiple data monitoring sources into security incident response procedures are examples of operational or technical aspects of remote work monitoring, not ethical aspects. References = CRISC: Certified in Risk & Information Systems Control Sample Questions