Isaca Updated CRISC Exam Questions and Answers by indy

Data classification is the process of assigning labels or categories to data based on its sensitivity, value, and criticality to the organization. Data classification is the first consideration when analyzing the risk associated with the web application hosted by a cloud service, as it determines the level of protection and controls required for the data. Data classification can help the organization to comply with legal, regulatory, and contractual obligations, such as GDPR, CCPA, and PCI DSS, and to prevent data breaches, leaks, or losses. Data classification can also help the organization to evaluate the suitability and trustworthiness of the cloud service provider, and to negotiate the terms and conditions of the service level agreement (SLA).

References:

•ISACA, Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, 2009, p. 141

•ISACA, Data Classification: What It Is, Why You Should Care and How to Perform It2

 The best way to validate whether controls to reduce user device vulnerabilities have been implemented according to management’s action plan is to rescan the user environment, as it provides an objective and reliable way to measure and verify the effectiveness and adequacy of the controls, and to detect any remaining or new vulnerabilities. Surveying device owners, requiring annual end user policy acceptance, and reviewing awareness training assessment results are not the best ways, as they may not provide sufficient assurance, evidence, or timeliness of the control validation, respectively. References = CRISC Review Manual, 7th Edition, page 154.

The operational risk associated with attacks on a web application should be owned by the individual in charge of the business function, because they are the primary stakeholder and beneficiary of the web application, and they are responsible for defining and achieving the business objectives and requirements that the web application supports or enables. An operational risk is a risk of loss or damage resulting from inadequate or failed internal processes, people, or systems, or from external events. An attack on a web application is a type of operational risk that involves a malicious or unauthorized attempt to compromise the confidentiality, integrity, or availability of the web application, such as a denial-of-service attack, a SQL injection attack, or a cross-site scripting attack. A web application is an application that runs on a web server and can be accessed or used through a web browser, such as an online shopping site, a social media platform, or a web-based email service. A business function is a set of activities or tasks that support or enable the organization’s vision, mission, and strategy, such as marketing, sales, or customer service. A risk owner is a person or role that has the authority and accountability to manage a specific risk, and to implement and monitor the risk response and controls. The individual in charge of the business function should be the risk owner, as they have the best understanding and interest of the web application and its business value and impact, and they have the ability and responsibility to manage the operational risk associated with the attacks on the web application. The individual in charge of network operations, the cybersecurity function, or application development are all possible candidates for the risk owner, but they are not the best choice, as they may not have the same level of stake and influence in the web application and its business objectives and requirements, and they may have different or conflicting priorities or perspectives on the operational risk and its management. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, page 101

A key risk indicator (KRI) is a metric that measures the exposure to a given risk at a particular time. A threshold is a level or point that triggers an action or a warning when a KRI reaches or exceeds it. Therefore, the most likely cause of a KRI exceeding a threshold is the occurrence of specific events that increase the likelihood or impact of the risk. For example, a KRI for cyber risk could be the number of phishing attempts per month, and a threshold could be 10. If more than 10 phishing attempts occur in a month, the KRI would exceed the threshold and indicate a higher level of cyber risk.

References

•Key Risk Indicators: A Practical Guide | SafetyCulture

•KRI Framework for Operational Risk Management | Workiva

•Key risk indicators (KRIs) definition - Risk.net