MENU
Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?
Suggested Answer: A
Get Premium CRISC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
13 comments · newest first
MI
Michael
11 months ago
Totally agree, A should be top priority!
CA
Catarina
12 months ago
B seems fine if done right, but A is crucial.
RU
Rutha
12 months ago
Surprised that D is even an option! Once every two years?
AL
Alyssa
12 months ago
I think C is more concerning, honestly.
LA
Lawana
1 year ago
A is definitely a big red flag!
SH
Sheridan
1 year ago
Management reviewing policies every two years seems a bit infrequent. I wonder if option D could lead to outdated security measures?
AN
Annamaria
1 year ago
I feel like the cost-benefit analysis is really important for selecting controls, so option C might be the most concerning.
FR
Frank
1 year ago
I'm not entirely sure, but I think self-assessments by operational staff could lead to biased results. Maybe option B is a red flag?
CA
Carol
1 year ago
I remember studying that change control is crucial for maintaining IT security, so option A seems like a big concern.
LI
Lisbeth
1 year ago
This looks like a tricky one. I'll need to carefully read through the scenario and think about the best approach to ensure the managers receive the access reviews for their respective departments.
AB
Abraham
1 year ago
Okay, I've got a strategy here. I know stakeholder engagement is crucial throughout the project, so I'll eliminate any options that don't mention that. Then I'll look for the one that best describes the proper timing and approach.
AR
Arleen
1 year ago
Awk is a text processing tool, so I'm pretty confident it's not a calculator or an operating system. I'm leaning towards option B, but I'll double-check the description just to be sure.
CA
Cassi
1 year ago
Okay, I think I've got it. The key is to use a combination of design patterns and principles to create a more robust and flexible architecture for Service A. The Service Abstraction, Service Facade, and Contract Centralization patterns all seem like they could be effective here.