Book Image

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

By : Shobhit Mehta
5 (1)
Book Image

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

5 (1)
By: Shobhit Mehta

Overview of this book

For beginners and experienced IT risk professionals alike, acing the ISACA CRISC exam is no mean feat, and the application of this advanced skillset in your daily work poses a challenge. The ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is a comprehensive guide to CRISC certification and beyond that’ll help you to approach these daunting challenges with its step-by-step coverage of all aspects of the exam content and develop a highly sought-after skillset in the process. This book is divided into six sections, with each section equipped with everything you need to get to grips with the domains covered in the exam. There’ll be no surprises on exam day – from GRC to ethical risk management, third-party security concerns to the ins and outs of control design, and IDS/IPS to the SDLC, no stone is left unturned in this book’s systematic design covering all the topics so that you can sit for the exam with confidence. What’s more, there are chapter-end self-assessment questions for you to test all that you’ve learned, as well as two book-end practice quizzes to really give you a leg up. By the end of this CRISC exam study guide, you’ll not just have what it takes to breeze through the certification process, but will also be equipped with an invaluable resource to accompany you on your career path.
Table of Contents (28 chapters)
1
Part 1: Governance, Risk, and Compliance and CRISC
4
Part 2: Organizational Governance, Three Lines of Defense, and Ethical Risk Management
8
Part 3: IT Risk Assessment, Threat Management, and Risk Analysis
13
Part 4: Risk Response, Reporting, Monitoring, and Ownership
18
Part 5: Information Technology, Security, and Privacy
23
Part 6: Practice Quizzes
24
Chapter 18: Practice Quiz – Part 1
25
Chapter 19: Practice Quiz – Part 2

Review questions

  1. In the 3LoD model, which LoD is responsible for risk monitoring and oversight?
    1. The first LoD
    2. The second LoD
    3. The third LoD
    4. All of the above
  2. What is the primary responsibility of the third LoD?
    1. Policy and procedure development
    2. Provide independent assurance of controls
    3. Perform periodic user reviews
    4. Restrict least privileged roles
  3. The amount of risk an organization is willing to accept is known as ____::
    1. Risk tolerance
    2. Risk capacity
    3. Risk profile
    4. Risk appetite
  4. The information security manager has performed a risk assessment and provided recommendations for enhancing the controls of the Business Process Owner (BPO). After much deliberation, the BPO has decided to accept the risk. The BEST reason for the BPO to accept the risk is ____:
    1. Difficulty to implement the suggested controls
    2. Unavailability of resources to implement the controls
    3. Cost of control implementation outweighs the cost of assets
    4. Budgetary constraints
  5. Which of the following statements is correct?
    1. Breaching...