Resource Management CRISC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main purpose of a Business Impact Analysis (BIA)?

   • ATo determine the root cause of past incidents
   • BTo assign ownership of IT assets
   • CTo test the effectiveness of the disaster recovery plan
   • DTo identify critical business processes and their recovery priorities
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does the Recovery Time Objective (RTO) define?

   • AThe maximum acceptable amount of data loss measured in time
   • BThe maximum time allowed to restore a system or process after a disruption
   • CThe total cost of recovery operations
   • DThe minimum time required to test a recovery plan
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is planning to replace its fleet of employee laptops. The old laptops contain sensitive data, and some are still in use by employees. The risk manager must ensure that data is protected throughout the replacement process. Which approach is most effective?

   • AMigrate data to the new laptops, then securely erase the old laptops before disposal
   • BAllow employees to keep the old laptops without erasure
   • CSecurely erase the old laptops before migrating data
   • DDispose of the old laptops without any data handling
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large organization is creating an asset inventory. The risk manager wants to ensure that all assets are accounted for, including those that are not connected to the network. Which approach is most effective?

   • ARelying solely on automated network discovery tools
   • BUsing only the asset tags from the finance department
   • CAsking each department to submit a list of their assets
   • DUsing a combination of automated discovery tools and physical audits
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A healthcare organization is creating an asset inventory. The compliance officer insists that every asset that stores protected health information (PHI) must have a designated person responsible for its security. Which practice directly addresses this requirement?

   • AStoring the asset inventory in a secure database
   • BAssigning an asset owner for each PHI-containing asset
   • CLabeling each asset with a barcode for tracking
   • DConducting quarterly physical audits of all assets
   Reveal Solution Discussion Select an answer first