CRISC 無料問題集「ISACA Certified in Risk and Information Systems Control」

（A）Report the ineffective control for inclusion in the next audit report.

（B）Request a formal acceptance of risk from senior management.

（C）Deploy a compensating control to address the identified deficiencies.

（D）Determine whether the impact is outside the risk appetite.

（A）Ensure the language in the contract explicitly states who is accountable for each step of the data transfer process

（B）Meet with the business leaders to ensure the classification of their transferred data is in place

（C）Collect requirements for the environment to ensure the infrastructure as a service (IaaS) is configured appropriately.

（D）Work closely with the information security officer to ensure the company has the proper security controls in place.

（A）Benchmark against what peer organizations are doing with POC testing environments.

（B）Accept the risk of using the production data to ensure accurate results.

（C）Assess the risk of using production data for testing before making a decision.

（D）Deny the request, as production data should not be used for testing purposes.

（A）Database manager

（B）Business manager

（C）Public relations manager

（D）Data privacy manager

（A）Risk appetite

（B）Mitigation cost

（C）Inherent risk

（D）Residual risk

（A）maximum tolerable downtime.

（B）maximum tolerable loss of data

（C）minimum tolerable loss of data.

（D）minimum tolerable downtime

（A）The risk associated with multiple control gaps was accepted.

（B）The control owners disagreed with the auditor's recommendations.

（C）The report was provided directly from the vendor.

（D）The controls had recurring noncompliance.

（A）Risk owner

（B）Internal auditor

（C）System owner

（D）Process owner

（A）Analyzing intrusion detection system (IDS) logs

（B）Coordinating events with appropriate agencies

（C）Using a third-party monitoring provider

（D）Analyzing server logs

（A）Changes in owners for identified IT risk scenarios

（B）Changes in methods used to calculate probability

（C）Frequent use of risk acceptance as a treatment option

（D）Qualitative measures for potential loss events

（A）Risk impact

（B）Control self-assessments (CSAs)

（C）Risk likelihood

（D）Risk appropriate

（A）The network that loT devices can access

（B）The loT threat landscape

（C）The business case for the use of loT

（D）Policy development for loT

（A）An increase in the number of change events pending management review

（B）A decrease in the number of key performance indicators (KPIs)

（C）A decrease in the number of critical assets covered by risk thresholds

（D）An increase in the number of risk threshold exceptions