Control Design and Implementation CRISC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is implementing a new access control system and wants to ensure it aligns with industry best practices. The risk manager suggests using a specific control standard to guide the implementation. Which standard is most relevant for information security controls?

   • ACOBIT 2019
   • BISO/IEC 27001
   • CTOGAF
   • DITIL 4
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When selecting a control, why is cost an important consideration?

   • AThe cost of the control should be proportionate to the risk it mitigates
   • BThe cost should be maximized to ensure quality
   • CThe cost should be minimized regardless of effectiveness
   • DThe cost is irrelevant if the control is effective
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which control testing method involves asking questions of personnel to understand how a control is performed?

   • ARe-performance
   • BInquiry
   • CInspection
   • DObservation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing a new control environment and wants to use a framework that provides a structured approach to managing cybersecurity risk, including identifying, protecting, detecting, responding, and recovering. Which framework is most appropriate?

   • AITIL
   • BISO 27001
   • CNIST Cybersecurity Framework
   • DCOBIT
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key characteristic of good testing evidence?

   • AIt is based on the tester's opinion
   • BIt is sufficient and appropriate to support the conclusion
   • CIt is documented only after the testing is complete
   • DIt is collected only from the control owner
   Reveal Solution Discussion Select an answer first