Isaca Updated CRISC Exam Questions and Answers by pablo

The most important factor for an organization to consider when developing its IT strategy is the organizational goals and objectives. The organizational goals and objectives are the statements that define the purpose, direction, and desired outcomes of the organization. The organizational goals and objectives help to align the IT strategy with the organization’s mission, vision, values, and strategy, and to ensure that the IT strategy supports and enables the organization’s performance and improvement. The organizational goals and objectives also help to communicate and coordinate the IT strategy with the organization’s stakeholders, such as the board, management, business units, and IT functions, and to facilitate the IT decision-making and reporting processes. The other options are not as important as the organizational goals and objectives, although they may be related to the IT strategy. IT goals and objectives, the organization’s risk appetite statement, and legal and regulatory requirements are all factors that could affect the feasibility and sustainability of the IT strategy, but they do not necessarily reflect or influence the organization’s purpose, direction, and desired outcomes. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.2.1, page 1-9.

If preventive controls cannot be implemented due to technology limitations, the first step to reduce risk is to evaluate alternative controls. Alternative controls are those that can achieve the same or similar objectives as the original preventive controls, but using different methods or technologies. For example, if a firewall cannot be installed due to hardware compatibility issues, an alternative control could be a network segmentation or a proxy server. Evaluating alternative controls requires assessing their feasibility, effectiveness, efficiency, and cost-benefit. Redefining the business process, developing a plan to upgrade technology, and defining a process for monitoring risk are also possible actions to reduce risk, but they are not the first step, and they may not be feasible or desirable in some situations. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-23.

 A vulnerability is a weakness or flaw in the IT system or environment that could be exploited by a threat. A threat event is an occurrence or action that exploits a vulnerability and causes harm or damage to the IT system or environment. The lack of data to measure threat events is the most important factor, because it may affect the accuracy and reliability of the risk assessment and evaluation, and consequently, the risk response and strategy. The lack of data to measure threat events may also create challenges or risks for the organization, such as compliance, legal, reputational, or operational risks, or conflicts or inconsistencies with the organization’s risk appetite, risk objectives, or risk policies. The other options are not as important as the lack of data to measure threat events, although they may also influence the risk response and strategy. The likelihood and impact of threat events, the cost to implement the risk response, and the monetary value of the asset are all factors that could affect the feasibility and sustainability of the risk response and strategy, but they do not necessarily affect the validity and quality of the risk assessment and evaluation

 A risk register is a tool that records and tracks the information about the identified risks, such as the risk description, category, owner, probability, impact, response strategy, status, and action plan. Reviewing the risk register is the best way to help an organization gain insight into its overall risk profile, which is the summary of the nature and level of risk that the organization faces. By reviewing the risk register, the organization can obtain a comprehensive and holistic view of the sources, causes, and consequences of the risks, their likelihood and impact, their interrelationships and dependencies, and their alignment with the risk appetite and tolerance. The risk register can also help the organization to prioritize the risks, allocate the resources, select the risk responses, monitor the risk performance, and evaluate the risk outcomes. References = CRISC Review Manual, 7th Edition, page 99.