CRISC Practice Test

CRISC Practice Test practice questions, page 53 of 76, with answer review and explanations.

Question 261

Which of the following is the BEST way to ensure that outsourced service providers comply with the enterprise's information security policy?

  1. Penetration testing
  2. Service level monitoring
  3. Security awareness training
  4. Periodic audits

Question 262

You are the project manager of RFT project. You have identified a risk that the enterprise's IT system and application landscape is so complex that, within a few years, extending capacity will become difficult and maintaining software will become very expensive. To overcome this risk, the response adopted is re- architecture of the existing system and purchase of new integrated system. In which of the following risk prioritization options would this case be categorized?

  1. Deferrals
  2. Quick win
  3. Business case to be made
  4. Contagious risk

Question 263

Which of the following BEST ensures that a firewall is configured in compliance with an enterprise's security policy?

  1. Interview the firewall administrator.
  2. Review the actual procedures.
  3. Review the device's log file for recent attacks.
  4. Review the parameter settings.

Question 264

You work as the project manager for Company Inc. The project on which you are working has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?

  1. Resource Management Plan
  2. Communications Management Plan
  3. Risk Management Plan
  4. Stakeholder management strategy

Question 265

Which of the following statements is NOT true regarding the risk management plan?

  1. The risk management plan is an output of the Plan Risk Management process.
  2. The risk management plan is an input to all the remaining risk-planning processes.
  3. The risk management plan includes a description of the risk responses and triggers.
  4. The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.