Operations and Lifecycle Management CRISC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security operations center (SOC) receives an alert about a potential malware infection on a user's workstation. The SOC analyst is unsure if the alert is a true positive or a false positive. The user is a senior executive who is currently in an important meeting. What is the MOST appropriate action for the analyst?

   • AIgnore the alert until the executive's meeting is over to avoid disruption.
   • BPerform a quick triage to gather more information about the alert before taking action.
   • CEscalate the alert to the incident response team immediately without further investigation.
   • DImmediately isolate the workstation from the network to contain the potential threat.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key risk implication of poor project planning?

   • AIncreased likelihood of scope creep and cost overruns
   • BGuaranteed project success
   • CReduced stakeholder communication
   • DDecreased need for monitoring
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A development team is building a new customer portal using an Agile methodology. The team wants to release a minimum viable product (MVP) quickly to gain market share. The risk team is concerned about security vulnerabilities in the initial release. Which approach BEST balances the need for speed with the need for security?

   • AAsk the development team to switch to a waterfall methodology to ensure security is fully integrated.
   • BRelease the MVP without any security testing to meet the deadline, as security can be added later.
   • CRelease the MVP with only the most critical security controls in place and plan to address other vulnerabilities in future sprints.
   • DDelay the MVP release until all security testing is complete and all identified vulnerabilities are fixed.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a limited IT budget. The portfolio management office (PMO) is evaluating two projects: Project A is a mandatory regulatory compliance project with a low return on investment (ROI), and Project B is an innovative project with a high potential ROI but a higher risk profile. The company's risk appetite is 'conservative'. Which project should the PMO prioritize?

   • AProject A, because it is mandatory and failure to comply could result in fines and reputational damage.
   • BNeither project, because the budget is too limited to take on any risk.
   • CBoth projects, by allocating the budget equally between them.
   • DProject B, because the high potential ROI will provide more value to the company.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key component of IT asset management?

   • ADeveloping incident response plans
   • BMaintaining an inventory of all hardware and software assets
   • CPerforming vulnerability scans on all systems
   • DConducting user awareness training
   Reveal Solution Discussion Select an answer first