BONUS！！！ MogiExam CRISCダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1hQ0cvTktpEDHCLj9j53RsphN_s04Pztf
ペースの速い社会生活を維持するため、CRISC試験問題では最速の配信サービスを提供しています。ほとんどの人は時間を節約するために速達を使用する傾向があるため、CRISC準備試験は購入後5〜10分以内に送信されます。プラットフォームで料金を支払う限り、指定された時間内に関連するCRISC試験資料をメールボックスに配信します。当社では、サービス全体を重視しています。CRISC試験資料の配信に問題がある場合は、お知らせください。メッセージまたはメールをご利用いただけます。
| Certification Vendor: | ISACA |
|---|---|
| Exam Name: | ISACA Certified in Risk and Information Systems Control (CRISC) Exam |
| Exam Number: | CRISC |
| Real Exam Qty: | 150 multiple-choice questions |
| Exam Duration: | 240 minutes |
| Passing Score: | 450 (scaled score out of 800) |
| Related Certifications: | CISA CISM CGEIT |
| Exam Price: | USD 575 (ISACA member), USD 760 (non-member) |
| Certificate Validity Period: | 3 years (renewable via CPE credits) |
| Available Languages: | Japanese, Spanish, Simplified Chinese, English |
| Exam Format: | Multiple-choice questions, Computer-based exam (proctored) |
| Recommended Training: | ISACA CRISC Review Courses ISACA Training & Resources |
| Exam Registration: | ISACA CRISC Exam Registration PSI Online Testing Platform |
| Sample Questions: | ISACA CRISC Sample Questions |
| Exam Way: | Computer-based testing (online proctored or at authorized test centers via PSI) |
| Pre Condition: | No mandatory prerequisites. ISACA recommends 3–5 years of experience in risk management and information systems control. |
| Official Syllabus URL: | https://www.isaca.org/credentialing/crisc |
他の人はあちこちでISACA CRISC試験資料を探しているとき、あなたはすでに勉強中で、準備階段でライバルに先立ちます。また、我々MogiExamは量豊かのISACA CRISC試験資料を提供しますし、ソフト版であなたにISACA CRISC試験の最も現実的な環境をシミュレートさせます。勉強中で、何の質問があると、メールで我々はあなたのためにすぐ解決します。心配はありませんし、一心不乱に試験復習に取り組んでいます。
ISACA CRISC（Certified in Risk and Information Systems Control）は、情報システムリスク管理分野の専門家にとってグローバルに認められた認定資格です。CRISC認定は、個人の情報システムリスク管理と情報システムコントロールの知識と専門知識を検証します。CRISC認定は、情報技術ガバナンスに焦点を当てた国際的なプロフェッショナル協会である情報システム監査および制御協会（ISACA）によって提供されています。
質問 # 1852
A company has located its computer center on a moderate earthquake fault. Which of the following is the MOST important consideration when establishing a contingency plan and an alternate processing site?
正解：B
解説：
A contingency plan is a set of actions and procedures that aim to ensure the continuity of critical business functions in the event of a disruption or disaster. An alternate processing site is a location where the organization can resume its information systems operations in case the primary site is unavailable or damaged. The most important consideration when establishing a contingency plan and an alternate processing site for a company located on a moderate earthquake fault is to ensure that the alternative site does not reside on the same fault, no matter how far apart they are. This is because an earthquake can affect a large area along the fault line, and potentially damage both the primary and the alternative site, rendering them unusable. By choosing an alternative site that is not on the same fault, the company can reduce the risk of losing both sites, and increase the likelihood of restoring its operations quickly and effectively. The other options are not as important as the alternative site location, because they do not address the main threat of an earthquake, but rather focus on specific or partial aspects of the contingency plan, as explained below:
* A. The alternative site is a hot site with equipment ready to resume processing immediately is a consideration that relates to the availability and readiness of the alternative site, but it does not ensure that the site is safe and secure from an earthquake. A hot site is a type of alternative site that has the necessary hardware, software, and network components to resume the information systems operations with minimal or no downtime. However, if the hot site is on the same fault as the primary site, it may not be accessible or functional after an earthquake, and the company may lose both sites and the data stored on them.
* B. The contingency plan provides for backup media to be taken to the alternative site is a consideration that relates to the integrity and recoverability of the data, but it does not ensure that the site is safe and secure from an earthquake. Backup media are devices or systems that store copies of the data and information that are essential for the organization's operations. Taking backup media to the alternative site can help the company to restore its data and resume its operations in case the primary site is damaged or destroyed. However, if the alternative site is on the same fault as the primary site, it may not be accessible or functional after an earthquake, and the company may lose both sites and the backup media.
* C. The contingency plan for high priority applications does not involve a shared cold site is a consideration that relates to the performance and reliability of the alternative site, but it does not ensure that the site is safe and secure from an earthquake. A shared cold site is a type of alternative site that has the necessary space and infrastructure to accommodate the information systems operations, but does not have the hardware, software, or network components installed. A shared cold site is shared by multiple organizations, and may not be available or suitable for the company's high priority applications, which require more resources and customization. However, if the alternative site is on the same fault as the primary site, it may not be accessible or functional after an earthquake, and the company may lose both sites and the ability to resume its high priority applications. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 115. How to conduct a contingency planning process - IFRC, CP-4(2): Alternate Processing Site - CSF Tools - Identity Digital, Information System Contingency Planning Guidance - ISACA
質問 # 1853
When changes occur in organizational structure, which action should be taken first to align risk management practices?
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Changes in organizational structure often affect risk appetite, which defines the amount and type of risk an organization is willing to accept. Revalidating the corporate risk appetite ensures that the organization's risk- taking aligns with its new structure, strategic goals, and culture. While reviewing KRIs and communicating the risk profile are important, they follow after confirming risk appetite alignment. Implementing a new assessment process is not always necessary unless structural changes fundamentally affect risk assessment scope#5:83, 5:104 CRISC_SentenceinNOTE30.pptx#.
質問 # 1854
Several network user accounts were recently created without the required management approvals. Which of the following would be the risk practitioner's BEST recommendation to address this situation?
正解：B
解説：
Several network user accounts were recently created without the required management approvals. This indicates that there is a risk of unauthorized access, use, disclosure, modification, or destruction of the network resources or data, which may affect the confidentiality, integrity, and availability of the network.
The best recommendation to address this situation is to investigate the root cause of noncompliance. This means that the risk practitioner should analyze the factors or reasons that led to the creation of the network user accounts without the required management approvals, such as human error, negligence, malice, system failure, process flaw, etc.
Investigating the root cause of noncompliance helps to identify and correct the source of the problem, prevent or reduce the recurrence of the problem, and improve the compliance and security of the network user accounts.
The other options are not the best recommendations to address this situation. They are either secondary or not effective for noncompliance.
The references for this answer are:
Risk IT Framework, page 31
Information Technology & Security, page 25
Risk Scenarios Starter Pack, page 23
質問 # 1855
A department has been granted an exception to bypass the existing approval process for purchase orders. The risk practitioner should verify the exception has been approved by which of the following?
正解：D
質問 # 1856
Which of the following BEST enables effective IT control implementation?
正解：A
解説：
Documented procedures are the best way to enable effective IT control implementation. Documented
procedures are the specific actions or steps that are performed to achieve the IT control objectives and
mitigate the IT risks. Documented procedures provide clear guidance, consistency, and accountability for the
IT control activities. Documented procedures also help to monitor and evaluate the effectiveness and
efficiency of the IT controls, and to identify and address any gaps or weaknesses. The other options are not as
effective as documented procedures, although they may support or complement the IT control
implementation. Key risk indicators (KRIs) are metrics that measure the likelihood and impact of IT risks, but
they do not specify how to implement the IT controls. Information security policies and standards are high-
level statements that define the IT security goals and requirements, but they do not detail how to implement
the IT controls. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.2,
page 1-15.
質問 # 1857
......
CRISC日本語参考: https://www.mogiexam.com/CRISC-exam.html
無料でクラウドストレージから最新のMogiExam CRISC PDFダンプをダウンロードする：https://drive.google.com/open?id=1hQ0cvTktpEDHCLj9j53RsphN_s04Pztf