Isaca Updated CRISC Exam Questions and Answers by mylo

 The best key performance indicator (KPI) to measure the effectiveness of a disaster recovery test of critical business processes is the percentage of processes recovered within the recovery time and point objectives. Recovery time objective (RTO) is the maximum acceptable time period within which a business process or an IT service must be restored after a disruption. Recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time before the disruption. The percentage of processes recovered within the RTO and RPO indicates how well the disaster recovery test meets the business continuity and recovery requirements and expectations, and how effectively the disaster recovery plan and procedures are executed. The percentage of processes recovered within the RTO and RPO can also help to identify the gaps, weaknesses, and opportunities for improvement in the disaster recovery capabilities. Percentage of job failures identified and resolved during the recovery process, number of current test plans and procedures, and number of issues and action items resolved during the recovery test are not as good as the percentage of processes recovered within the RTO and RPO, as they do not directly measure the achievement of the recovery objectives, and may not reflect the actual impact and performance of the disaster recovery test. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 130.

The most important factor to have in place to ensure the effectiveness of risk and security metrics reporting is an organizational reporting process. An organizational reporting process is a set of procedures that defines the roles, responsibilities, frequency, format, and distribution of the risk and security metrics reports. An organizational reporting process helps to ensure that the risk and security metrics are relevant, accurate, consistent, and timely, and that they provide useful information for decision making and performance improvement. An organizational reporting process also helps to align the risk and security metrics reporting with the enterprise’s objectives, strategies, and policies, and to communicate the risk and security status and issues to the appropriate stakeholders. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.3.2, page 2421

The most important factor to consider when assessing the residual risk of implementing encryption for data at rest is the key management. Key management is the process of generating, storing, distributing, using, and destroying the cryptographic keys that are used to encrypt and decrypt the data. Key management is essential for ensuring the security, availability, and integrity of the encrypted data, as well as for complying with the legal and regulatory requirements. Poor key management could result in the loss, theft, compromise, or corruption of the keys, which could lead to unauthorized access, data breach, data loss, or data recovery failure. Therefore, key management must be considered to assess the residual risk, which is the risk that remains after the risk treatment, such as encryption, is applied. Data retention requirements, data destruction requirements, and cloud storage architecture are not as important as key management, as they do not directly affect the encryption and decryption of the data, and they may not introduce significant residual risk. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

Ensuring that database changes are correctly applied is the primary reason for monitoring activities performed in a production database environment, as it helps to maintain the integrity, availability, and performance of the database and the applications that depend on it. Database changes are any modifications made to the database structure, configuration, data, or code, such as adding or deleting tables, columns, indexes, or triggers, updating or inserting data, or altering stored procedures or functions. Database changes can have significant impacts on the database functionality and behavior, and may introduce errors, inconsistencies, or vulnerabilities if not applied correctly. Therefore, monitoring database changes is essential to verify that the changes are implemented as intended, comply with the design specifications and standards, and do not cause any adverse effects or conflicts with the existing database or application components.

The other options are not the primary reasons for monitoring activities performed in a production database environment. Enforcing that changes are authorized is an important aspect of database change management, but it is not the main purpose of database monitoring. Database change management is the process of planning, reviewing, approving, and implementing database changes in a controlled and consistent manner. Database change management helps to ensure that the changes are authorized by the appropriate stakeholders, aligned with the business requirements and objectives, and documented and communicated to the relevant parties. Database monitoring can support database change management by providing information and feedback on the change implementation and performance, but it does not enforce the change authorization. Deterring illicit actions of database administrators is a possible benefit of database monitoring, but it is not the primary reason for it. Database administrators are the users who have the highest level of access and privilege to the database, and they are responsible for managing and maintaining the database operations and security. Database monitoring can help to deter illicit actions of database administrators by tracking and auditing their activities and actions on the database, and alerting or escalating any suspicious or malicious behavior. However, database monitoring is not the only or the most effective way to prevent or detect illicit actions of database administrators. Other measures, such as implementing the principle of least privilege, segregating duties, enforcing password policies, and encrypting data, are also necessary to protect the database from unauthorized or improper access or manipulation by database administrators or other users. Preventing system developers from accessing production data is a possible benefit of database monitoring, but it is not the primary reason for it. System developers are the users who design, develop, and test the applications that interact with the database. System developers should not have access to the production data, as it may contain sensitive or confidential information that could be compromised or misused by the developers. System developers should only use test or dummy data for their development and testing purposes. Database monitoring can help to prevent system developers from accessing production data by controlling and restricting their access and privilege to the database, and logging and reporting any unauthorized or inappropriate access attempts. However, database monitoring is not the only or the most effective way to prevent system developers from accessing production data. Other measures, such as implementing access control policies, masking or anonymizing data, and isolating development and production environments, are also necessary to safeguard the production data from system developers or other users. References = Database Monitoring: Basics & Introduction | Splunk, IT Risk Resources | ISACA, Best Practices for Database Performance Monitoring