Isaca Updated CRISC Exam Questions and Answers by dolcie

According to the CRISC 351-400 topic3 Flashcards, the administrative access represents a segregation of duties conflict, which should be of greatest concern to a risk practitioner. Segregation of duties is a principle that aims to prevent fraud, errors, or abuse of power by ensuring that no single person can perform incompatible functions, such as development, testing, and production. By having administrative access to a production application, a software developer can potentially modify the code, bypass the testing and approval process, and deploy the changes without proper authorization or documentation. This can compromise the integrity, availability, and security of the application, and expose the organization to operational, financial, legal, or reputational risks. Therefore, the answer is D. The administrative access represents a segregation of duties conflict. *References

The most effective key risk indicator (KRI) for monitoring risk related to a bring your own device (BYOD) program is the number of incidents originating from BYOD devices, as it directly measures the impact and frequency of the potential threats and vulnerabilities associated with the use of personal devices for accessing company data and systems. A BYOD program can pose various risks to an organization, such as data loss or breach, malware infection, unauthorized access, compliance violation, or device theft or loss12. The number of incidents originating from BYOD devices can help to identify and quantify these risks, and to trigger appropriate risk response actions when the incidents exceed the acceptable thresholds. The other options are not the most effective KRIs, as they do not directly measure the risk level or impact of the BYOD program. The number of users who have signed a BYOD acceptable use policy may indicate the awareness and compliance of the users, but not the actual risk exposure or mitigation. The budget allocated to the BYOD program security controls may indicate the investment and efficiency of the risk management, but not the effectiveness or necessity. The number of devices enrolled in the BYOD program may indicate the scope and scale of the risk, but not the severity or likelihood. References = Key Risk Indicators: A Practical Guide; KRI Framework for Operational Risk Management

Project risk register: A document that records the identified risks, their likelihood, impact, and mitigation strategies for a project1.

Project steering committee: A group of senior stakeholders and experts who oversee and support a project from a higher level2.

Risk mitigation actions: The measures taken to prevent, reduce, or transfer the risks that may affect a project3.

The most important objective of regularly presenting the project risk register to the project steering committee is to track the status of risk mitigation actions. Tracking the status of risk mitigation actions can help the project steering committee to:

Monitor and measure the performance and effectiveness of the risk management process and controls

Evaluate the progress and outcomes of the risk mitigation actions against the project goals and objectives

Identify and resolve any issues, challenges, or gaps in the risk mitigation actions

Provide guidance, feedback, and support to the project manager and the project team

Adjust or revise the risk mitigation actions as needed to reflect the changes in the project scope, schedule, budget, or environment

The other options are not the most important objective of regularly presenting the project risk register to the project steering committee, although they may be relevant or beneficial. Allocating budget for resolution of risk issues, which means assigning financial resources to address and resolve the risks that may affect a project, may be a part of the risk management process, but it is not the primary purpose of presenting the project risk register, which is more focused on tracking and reporting the risk status and actions. Determining if new risk scenarios have been identified, which means finding out if there are any additional or emerging risks that may impact a project, may be a useful outcome of presenting the project risk register, but it is not the main objective, which is more concerned with tracking and reporting the existing risk status and actions. Ensuring the project timeline is on target, which means verifying that the project is progressing according to the planned schedule and milestones, may be a benefit of presenting the project risk register, but it is not the key objective, which is more related to tracking and reporting the risk status and actions.

References = Risk Register: A Project Manager’s Guide with Examples [2023] • Asana, Project Steering Committee: Roles, Best Practices, Challenges, Risk Mitigation: Definition, Strategies, and Examples

Data confidentiality risk is the risk that the data may be accessed, disclosed, or modified by unauthorized parties, resulting in breaches of privacy, trust, or compliance1. Platform as a Service (PaaS) is a cloud computing model that provides a platform for developing, testing, and deploying applications, without requiring the users to manage the underlying infrastructure2. An internally developed payroll application is an application that is created and maintained by the organization itself, rather than by a third-party vendor, and that is used to process and manage the payroll data of the organization’s employees3. The owner of the data confidentiality risk is the person or entity that has the authority and accountability for the data and its protection, and that is responsible for identifying, assessing, and mitigating the risk. The owner of the data confidentiality risk related to an internally developed payroll application that leverages PaaS infrastructure from the cloud is the human resources head, as they are the person who oversees the human resources function and the payroll data of the organization. The human resources head has the best understanding of the sensitivity, value, and usage of the payroll data, and the potential impacts and implications of a data confidentiality breach. The human resources head also has the ability and responsibility to define and implement the policies, procedures, and controls that are necessary to protect the payroll data, and to monitor and report on the performance and compliance of the data confidentiality risk management. The IT infrastructure head, the supplier management head, and the application development head are not the best choices for owning the data confidentiality risk related to an internally developed payroll application that leverages PaaS infrastructure from the cloud, as they do not have the same level of authority and accountability as the human resources head. The IT infrastructure head is the person who oversees the IT infrastructure function and the PaaS infrastructure of the organization. The IT infrastructure head may be involved in providing input and feedback to the human resources head on the data confidentiality risk management, especially those related to the PaaS infrastructure, but they do not have the final say or the overall responsibility for the payroll data and its protection. The supplier management head is the person who oversees the supplier management function and the relationship with the cloud service provider that provides the PaaS infrastructure. The supplier management head may be involved in negotiating and enforcing the service level agreements and the security requirements with the cloud service provider, but they do not have the authority or the expertise to manage the data confidentiality risk of the payroll data. The application development head is the person who oversees the application development function and the development, testing, and deployment of the payroll application. The application development head may be involved in designing and implementing the security features and controls of the payroll application, but they do not have the perspective or the influence to manage the data confidentiality risk of the payroll data. References = 3: Payroll Software: What Is It & How Does It Work? | QuickBooks2: What is Platform as a Service (PaaS)? | IBM1: Data Confidentiality: Identifying and Protecting Assets Against Data … : [Risk Ownership - Risk Management] : [Human Resources and Payroll Security Policy - University of …] : [Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.1: IT Risk Concepts, pp. 17-19.] : [Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.1: Risk Identification, pp. 57-59.] : [Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.1: Control Design, pp. 233-235.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.2: Control Implementation, pp. 243-245.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.3: Control Monitoring and Maintenance, pp. 251-253.]