Resource Management CRISC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A hospital's BIA identifies that the electronic health record (EHR) system has an RTO of 2 hours and an RPO of 15 minutes. The current backup solution can restore the EHR to a 30-minute-old state in 3 hours. Management is considering two options: (1) upgrade the backup solution to meet the targets, or (2) accept the current capabilities and adjust the BIA. Which consideration is most important in this decision?

   • AThe age of the current backup hardware
   • BThe clinical impact of losing 30 minutes of patient data versus the cost of the upgrade
   • CThe preference of the IT department for a particular backup vendor
   • DThe ease of testing the backup solution
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company wants to improve its asset management. The IT manager is tasked with identifying all assets that process or store sensitive data, assigning an owner to each, and labeling them according to their importance to the business. Which sequence of steps should the IT manager follow?

   • AAssign ownership first, then identify assets, and finally classify them
   • BClassify assets, then identify them, and finally assign ownership
   • CMaintain an inventory first, then identify assets, and finally classify them
   • DIdentify assets, classify them by criticality, assign ownership, and maintain an inventory
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key output of a Business Impact Analysis (BIA)?

   • AA detailed network diagram of the IT infrastructure
   • BA schedule for testing the BCP
   • CA list of all employees and their roles
   • DA list of recovery priorities for business processes
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's BCP includes a dependency on a third-party cloud provider for critical applications. The risk manager is reviewing the plan and notices that the provider's service level agreement (SLA) guarantees 99.9% availability, but the company's BCP assumes the provider will be available during a disaster. Which action is most appropriate?

   • ADocument the dependency and develop contingency plans for provider failure
   • BAccept the risk without any action
   • CAssume the provider will be available because the SLA is high
   • DRemove the cloud provider dependency from the BCP
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational corporation has assets located in multiple regions, including some in countries with strict data residency laws. The risk team is building an asset inventory to ensure compliance. Which approach best addresses the compliance requirements?

   • AIncluding data residency and sovereignty requirements as classification attributes in the inventory
   • BClassifying all assets as 'critical' to ensure maximum protection
   • CRecording only the asset owner and location for each asset
   • DStoring the asset inventory in a single centralized database
   Reveal Solution Discussion Select an answer first