CRISC 無料問題集「ISACA Certified in Risk and Information Systems Control」

（A）The IT strategic plan is reviewed by the chief information security officer (CISO) and enterprise risk management (ERM).

（B）Key performance indicators (KPIs) are established to track IT strategic initiatives.

（C）Risk scenarios associated with IT strategic initiatives are identified and assessed.

（D）The IT strategic plan is developed from the organization-wide risk management plan.

（A）Risk appetite and tolerance

（B）Insurance coverage

（C）Policies and standards

（D）Security awareness training

（A）To determine the likelihood and impact of threats to business operations

（B）To estimate resource requirements for related business processes

（C）To identify important business processes in the organization

（D）To evaluate the priority of business operations in case of disruption

（A）Risk profile

（B）Change control documentation

（C）Audit engagement letter

（D）IT risk register

（A）Website activity monitoring

（B）Scalable infrastructure

（C）A hot backup site

（D）Transaction limits

（A）Conducting security awareness training

（B）Updating the information security policy

（C）Requiring two-factor authentication

（D）Implementing mock phishing exercises

（A）The ability to trace the source of the attack

（B）The timeliness of attack recognition

（C）Blocking the attack route immediately

（D）The quantity of data logged by the attack control tools

（A）Performing periodic audits

（B）Executing a risk response plan

（C）Conducting awareness training

（D）Establishing an organization's risk tolerance

（A）IT risk manager

（B）Senior management

（C）Project manager

（D）Project sponsor

（A）Review change control board documentation.

（B）Conduct penetration testing.

（C）Conduct vulnerability scans.

（D）Interview IT operations personnel.

（A）Hire experienced and knowledgeable resources.

（B）Schedule internal audits across the business.

（C）Develop a detailed risk profile.

（D）Conduct risk assessments across the business.

（A）Business impact analysis (BIA)

（B）Fault tree analysis

（C）Historical trend analysis

（D）Root cause analysis

（A）alignment with risk appetite.

（B）key performance indicators (KPIs).

（C）investment portfolio.

（D）cost-benefit analysis.

（A）Advise the employee to forward the email to the phishing team.

（B）Report it to the chief risk officer.

（C）follow incident reporting procedures.

（D）Advise the employee to permanently delete the email.

（A）process maps.

（B）security policies

（C）risk appetite.

（D）risk tolerance level