ISACA CRISC (Certified in Risk and Information Systems Control) Practice Test
Gana confianza para ISACA CRISC (Certified in Risk and Information Systems Control). Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
The ISACA Certified in Risk and Information Systems Control (CRISC) certification is the premier credential for IT and business professionals who identify, assess, and manage IT risk through the implementation of enterprise-wide information systems controls. It validates a professional's expertise in designing, implementing, monitoring, and maintaining a robust risk management framework aligned with organizational objectives. CRISC holders demonstrate a unique ability to bridge the gap between technical IT teams and business leadership, translating complex risk scenarios into actionable business insights. The certification is built on four core domains: Governance, IT Risk Assessment, Risk Response and Reporting, and Information Technology and Security. Earning the CRISC designation signifies a commitment to advancing enterprise resilience, protecting stakeholder value, and ensuring that IT risk management is integrated into strategic decision-making. It is globally recognized as a benchmark for professionals responsible for managing IT risk and ensuring the effectiveness of information systems controls.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
During external reporting for IT-dependent controls, a listed software company finds that the CIO wants to call a repeat issue a technical defect. The CRISC practitioner is asked to address issue aging escalation; internal audit has not retested the control. Which action BEST supports risk-based response and reporting?
During identity federation with research partners, a university finds that grant-funded projects request exceptions. The CRISC practitioner is asked to address DLP tuning for regulated data; some users handle export-controlled data. Which action BEST addresses the technology and security risk?
During replacement of a legacy case-management system, a public-sector agency finds that procurement, security, and program teams use different risk taxonomies. The CRISC practitioner is asked to address zero trust access design; citizen-service targets are politically visible. Which action BEST addresses the technology and security risk?
During external reporting for IT-dependent controls, a listed software company finds that the CIO wants to call a repeat issue a technical defect. The CRISC practitioner is asked to address KCI refinement; internal audit has not retested the control. Which action BEST supports risk-based response and reporting?
During PCI DSS v4.0.1 transition planning, a payments processor finds that scope assumptions differ between architecture and compliance. The CRISC practitioner is asked to address incident response role separation; the acquirer expects evidence before the next ROC. Which action BEST addresses the technology and security risk?
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
Usa las ponderaciones publicadas de los dominios para planificar tu estudio. Los resultados de práctica no predicen tu puntuación en el examen de certificación.
01Risk Response and Reporting
Deals with informing key decision makers and supporting effective risk responses by selecting appropriate mitigation strategies, designing action plans, and communicating vital risk assessment information across all levels of the organization.
02Governance
Covers baseline organizational governance principles, management activities, enterprise architecture, and the funding of information security programs to align sound risk management strategies directly with overarching business objectives and corporate goals.
03Information Technology and Security
Examines important information technology and security controls, security categorization processes, control implementation methodologies, and operational safeguards designed specifically to protect enterprise systems, networks, and sensitive data from threats.
04IT Risk Assessment
Focuses heavily on identifying, estimating, and prioritizing risk to organizational operations, essential assets, individual stakeholders, and the wider community resulting directly from the use, deployment, and operation of modern information systems.