CRISC Controls Practice Questions

A failed IT system upgrade project has resulted in the corruption of an organization's asset inventory database. Which of the following controls BEST mitigates the impact of this incident?

• AA. Encryption
• BB. Authentication
• CC. Configuration
• DD. Backups

Which of the following would provide the MOST reliable evidence of the effectiveness of security controls implemented for a web application?

• AA. Penetration testing
• BB. IT general controls audit
• CC. Vulnerability assessment
• DD. Fault tree analysis

An organization is considering outsourcing user administration controls tor a critical system. The potential vendor has offered to perform quarterly sett-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to me risk practitioner?

• AA. The controls may not be properly tested
• BB. The vendor will not ensure against control failure
• CC. The vendor will not achieve best practices
• DD. Lack of a risk-based approach to access control