Risk Monitoring and Reporting CRISC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which risk reporting format is best suited for providing a comprehensive, periodic summary of risk and control performance metrics to management?

   • AVendor risk assessment report
   • BRisk scorecard
   • CAd-hoc email alert
   • DSingle risk register entry
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a Key Risk Indicator (KRI)?

   • AAverage time to process a financial transaction
   • BNumber of customer support tickets resolved per day
   • CPercentage of employees who completed mandatory compliance training
   • DPercentage of systems with critical security patches applied within 48 hours
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cybersecurity team wants to provide executives with a live view of the organization's security posture, including the number of active threats, the status of critical patches, and the results of recent vulnerability scans. The data is updated continuously from multiple sources. Which reporting approach is most appropriate?

   • ADeploy a dashboard that aggregates data from threat intelligence, patch management, and vulnerability scanning tools in near real-time.
   • BCreate a scorecard that is updated annually with control effectiveness ratings.
   • CPublish a monthly heatmap showing the likelihood and impact of the top security risks.
   • DSend a weekly email with a summary of security incidents.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is most effective for validating the reliability of risk data collected from a manual data entry process?

   • AChecking that all fields are populated
   • BComparing a sample of entered data against source documents
   • CEnsuring the data is stored in a secure database
   • DReviewing the data entry screen design
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A risk practitioner needs to gather data on recent cybersecurity incidents, audit findings, and changes in the external threat landscape to support ongoing risk monitoring. Which combination of sources would provide the most relevant data for this purpose?

   • AFinancial statements, budget reports, and expense claims
   • BIncident reports, internal audit reports, and threat intelligence feeds
   • CHuman resource policies, employee handbooks, and training schedules
   • DMarketing materials, sales forecasts, and customer satisfaction surveys
   Reveal Solution Discussion Select an answer first