MENU
Which of the following provides the BEST evidence that risk mitigation plans have been implemented effectively?
Suggested Answer: D
Get Premium CRISC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
14 comments · newest first
EL
Eloisa
11 months ago
B is solid too, but D really tells the story.
SH
Shasta
12 months ago
Wait, how can we trust risk owner attestations?
KA
Karl
12 months ago
A self-assessment can be biased, though.
PA
Pamela
12 months ago
Totally agree with D! It’s all about the numbers.
CR
Craig
1 year ago
I think D is the best choice. Residual risk shows real impact.
TR
Truman
1 year ago
I’m a bit confused about which one is best. I remember discussing how all these options could be useful in different contexts.
RO
Ronald
1 year ago
I practiced a question similar to this, and I think risk owner attestation might not provide enough evidence on its own.
TY
Tyra
1 year ago
I feel like self-assessments by process owners could be biased, so I'm leaning towards mitigation plan progress reports as a better option.
GL
Gladys
1 year ago
I think I remember that change in the level of residual risk is often seen as a strong indicator of effective risk mitigation, but I'm not entirely sure.
DO
Dong
1 year ago
Okay, I've got this. The most secure option is to use Workload Identity to federate the GitHub Actions identity with Google Cloud. That way, I don't have to manage any sensitive credentials in the pipeline or repo. Definitely going with option D!
IV
Ivan
1 year ago
This looks like a straightforward question about Palo Alto Networks products. I'll review the options carefully and choose the one that best fits the description.
FR
Francene
1 year ago
I'm a little confused by the different options presented. I'll need to review the requirements closely and make sure I understand the pros and cons of each approach before deciding.
DA
Darnell
1 year ago
Hmm, this is a tricky one. I'm not entirely sure, but I think the DPO's main task might be to conduct Privacy Impact Assessments, so I'll select option B.
CA
Carline
1 year ago
Hmm, I'm not sure about using Cloud Dataprep. The changing schema every third month might make that a bit tricky. I'm thinking a more programmatic approach like Cloud Dataflow or Spark on Dataproc could be more flexible.