Isaca Updated CRISC Exam Questions and Answers by romi

The most likely factor to change as a result of a zero-day vulnerability being discovered in a globally used brand of hardware server that allows hackers to gain access to affected IT systems is the risk likelihood. Risk likelihood is the probability or frequency of a risk event occurring, or the possibility of a risk event occurring within a given time period. Risk likelihood is one of the key dimensions of risk analysis, along with the risk impact. Risk likelihood helps to determine the severity and priority of the risk, and to select the most appropriate and effective risk response. Risk likelihood also helps to evaluate the cost-benefit and trade-off of the risk response, and to measure the residual risk and the risk performance. The risk likelihood is likely to change as a result of a zero-day vulnerability, because a zero-day vulnerability is a security flaw that has been discovered but not yet patched by the vendor, which means that it can be exploited by hackers before the affected systems can be updated or protected. A zero-day vulnerability increases the risk likelihood, because it creates a window of opportunity for hackers to launch attacks that could compromise the affected systems, and because it may not be detected or prevented by the existing security controls or measures. The other options are not as likely to change as the risk likelihood, although they may also be affected or influenced by the zero-day vulnerability. Control effectiveness, risk appetite, and key risk indicator (KRI) are all factors that could change as a result of a zero-day vulnerability, but they are not the most likely factor to change. Control effectiveness is the extent to which the risk controls or responses achieve the intended risk objectives or outcomes. Control effectiveness could change as a result of a zero-day vulnerability, because the existing controls may not be able to detect or prevent the exploitation of the vulnerability, or because new or additional controls may be needed to address the vulnerability. However, control effectiveness is not the most likely factor to change, because it depends on the type and level of the controls that are already in place or that can be implemented, and because it may not change until the vulnerability is actually exploited or the risk response is executed. Risk appetite is the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives. Risk appetite could change as a result of a zero-day vulnerability, because the vulnerability could affect the organization’s objectives or operations, and because the organization may need to adjust its risk tolerance or threshold to cope with the vulnerability. However, risk appetite is not the most likely factor to change, because it is a strategic and long-term decision that is driven by the organization’s mission, vision, values, and strategy, and because it may not change until the vulnerability is resolved or the risk impact is realized. Key risk indicator (KRI) is a metric that measures the likelihood and impact of risks, and helps monitor and prioritize the most critical risks. KRI could change as a result of a zero-day vulnerability, because the vulnerability could increase the likelihood and impact of the risks, and because the organization may need to update or revise its KRI to reflect the current risk situation. However, KRI is not the most likely factor to change, because it is a monitoring and reporting tool that is derived from the risk analysis and response, and because it may not change until the vulnerability is exploited or the risk response is implemented. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-25.

The best way to enable a risk practitioner to understand management’s approach to organizational risk is to know the risk appetite and risk tolerance of the organization. Risk appetite is the amount and type of risk that an organization is willing to pursue, retain, or take in order to achieve its objectives. Risk tolerance is the amount and type of risk that an organization is willing to accept in relation to specific performance measures, such as availability, reliability, or security. Risk appetite and risk tolerance reflect the management’s attitude, preferences, and expectations towards risk, and guide the risk management process, such as risk identification, assessment, response, and monitoring. The other options are not as effective as knowing the risk appetite and risk tolerance, although they may provide some input or context for understanding the management’s approach to organizational risk. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.2.1, page 1-8.

The first thing that should be done from a governance perspective to secure the information assets of a newly incorporated enterprise is to establish an inventory of information assets. An inventory of information assets is a document that lists and categorizes all the information assets that the organization owns, uses, or manages, such as data, documents, systems, applications, and devices. An inventory of information assets helps to identify and classify the information assets based on their value, sensitivity, and criticality, and to determine the appropriate level of protection and control for each asset. An inventory of information assets also helps to support the development and implementation of other information security activities, such as risk assessment, policy formulation, awareness training, and incident response. The other options are not the first thing that should be done, although they may be important steps or components of the information security governance. Defining information retention requirements and policies, providing information security awareness training, and establishing security management processes and procedures are all activities that can help to secure the information assets, but they require the prior knowledge and understanding of the information assets. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.1.1, page 3-3.

Software as a Service (SaaS) is a cloud computing model that provides software applications over the internet, without requiring the users to install or maintain them on their own devices. SaaS vendors are responsible for hosting, managing, and updating the software applications, and providing technical support and security to the users. The key performance indicator (KPI) that would best measure the risk of a service outage when using a SaaS vendor is the frequency and duration of unplanned downtime, which is the amount and length of time that the software applications are unavailable or inaccessible due to unexpected events, such as network failures, server crashes, power outages, cyberattacks, etc. The frequency and duration of unplanned downtime indicate the reliability and availability of the SaaS vendor, and the potential impact of the service outage on the users’ business operations and productivity. References = 3