Isaca Updated CRISC Exam Questions and Answers by niall

 A source code review is the process of examining and analyzing the source code of an application to identify any vulnerabilities, errors, or flaws that may compromise the security, functionality, or performance of the application. A source code review is the most effective way to identify an application backdoor prior to implementation, as it can detect any hidden or unauthorized code that may allow unauthorized access, bypass security controls, or execute malicious commands. A source code review can also help to improve the quality and reliability of the application, and ensure compliance with the coding standards and best practices. References = CRISC Review Manual, 7th Edition, page 181.

 The key performance indicator (KPI) that best measures the effectiveness of an organization’s disaster recovery program is the percentage of critical systems recovered within the recovery time objective (RTO). The RTO is the acceptable timeframe within which a business process or system must be restored after a disruption. The percentage of critical systems recovered within the RTO indicates how well the disaster recovery program can meet the business continuity requirements and minimize the impact of the disruption. The other options are not as good as the percentage of critical systems recovered within the RTO, as they are related to the efficiency, quality, or scope of the disaster recovery program, not the effectiveness of the disaster recovery program. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Key Performance Indicators, page 183.

The first consideration when establishing a new risk governance program is embedding risk management into the organization. Embedding risk management means integrating risk management principles and practices into the organization’s culture, values, processes, and decision-making. Embedding risk management helps to ensure that risk management is not seen as a separate or isolated activity, but as a part of the organization’s normal operations and strategic objectives. Embedding risk management also helps to create a risk-aware and risk-responsive organization, where risk management is shared and supported by all stakeholders. The other options are not the first consideration, although they may be important steps or components of the risk governance program. Developing an ongoing awareness and training program, creating policies and standards that are easy to comprehend, and completing annual risk assessments on critical resources are all activities that can help to embed risk management into the organization, but they are not the initial or primary consideration. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.2.1, page 1-8.

Before assigning sensitivity levels to information, it is most important to define the information classification policy. The information classification policy is a document that establishes the criteria, categories, roles, responsibilities, and procedures for classifying information according to its sensitivity, value, and criticality. The information classification policy provides the basis, guidance, and consistency for assigning sensitivity levels to information, and ensures that the information is protected and handled appropriately. The other options are not as important as defining the information classification policy, as they are related to the specific steps, activities, or outputs of the information classification process, not the overall structure and quality of the information classification process. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.4: Key Control Indicators, page 211.