You are the project manager of a HGT project that has recently finished the final compilation process. The project customer has signed off on the project completion and you have to do few administrative closure activities. In the project, there were several large risks that could have wrecked the project but you and your project team found some new methods to resolve the risks without affecting the project costs or project completion date. What should you do with the risk responses that you have identified during the project's monitoring and controlling process?
Correct Answer: C
is incorrect. If the new responses that were identified is only included in the project's risk register then it may not be shared with project managers working on some other project. Answer: A is incorrect. The responses are not in the project management plan, but in the risk response plan during the project and they'll be entered into the organization's lessons learned database. Answer: B is incorrect. The risk responses are included in the risk response plan, but after completing the project, they should be entered into the organization's lessons learned database.
CRISC Exam Question 252
From a business perspective, which of the following is the MOST important objective of a disaster recovery test?
Correct Answer: D
A disaster recovery test is a simulation of a disaster scenario that evaluates the effectiveness and readiness of the disaster recovery plan. The main purpose of a disaster recovery test is to ensure that the organization can resume its normal operations as quickly as possible after a disaster, with minimal or no data loss. Therefore, the most important objective of a disaster recovery test from a business perspective is to verify that all critical data can be recovered within the RTOs, which are the maximum acceptable time frames for restoring the data and systems after a disaster. If the RTOs are not met, the organization may face significant financial, operational, and reputational losses. The other options are not the most important objectives of a disaster recovery test, although they may be beneficial outcomes. Gaining assurance that the organization can recover from a disaster is a subjective and qualitative goal, while recovering data within RTOs is a measurable and quantitative goal. Discovering errors in the disaster recovery process is a valuable result of a disaster recovery test, but it is not the primary objective. The objective is to correct the errors and improve the process, not just to find them. Testing all business critical systems is a necessary step in a disaster recovery test, but it is not the ultimate goal. The goal is to ensure that the systems can be restored and function properly within the RTOs. References = CRISC Review Manual, pages 197-1981; CRISC Review Questions, Answers & Explanations Manual, page 572
CRISC Exam Question 253
An organization wants to launch a campaign to advertise a new product Using data analytics, the campaign can be targeted to reach potential customers. Which of the following should be of GREATEST concern to the risk practitioner?
Correct Answer: D
The greatest concern for the risk practitioner when an organization wants to launch a campaign to advertise a new product using data analytics is the purpose limitation. Purpose limitation is a principle that states that personal data should be collected for specified, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes. By using data analytics to target potential customers, the organization may violate the purpose limitation principle if the data was collected for a different purpose and the customers did not consent to the new use of their data. Data minimization, accountability, and accuracy are other principles that should be followed, but they are not as concerning as the purpose limitation. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.
CRISC Exam Question 254
Which of the following is the BEST key performance indicator (KPI) to measure the maturity of an organization's security incident handling process?
Correct Answer: D
Section: Volume D
CRISC Exam Question 255
Which of the following will BEST quantify the risk associated with malicious users in an organization?
