{"id":20055,"date":"2026-09-23T10:40:01","date_gmt":"2026-09-23T10:40:01","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=20055"},"modified":"2026-09-23T10:40:01","modified_gmt":"2026-09-23T10:40:01","slug":"isaca-crisc-practice-test-questions-and-exam-dumps-part6-q101-120","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/isaca-crisc-practice-test-questions-and-exam-dumps-part6-q101-120\/","title":{"rendered":"Isaca CRISC Practice Test Questions and Exam Dumps Part6 Q101-120"},"content":{"rendered":"

View Full <\/b>Isaca CRISC Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 101<\/b><\/h3>\n

Which activity should be performed FIRST when conducting a risk assessment for a critical business process?<\/b><\/p>\n

    \n
  1. Select security controls<\/span><\/li>\n
  2. Identify the business process objectives and scope<\/span><\/li>\n
  3. Purchase monitoring tools<\/span><\/li>\n
  4. Develop an incident response plan<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Before assessing risks, the organization should establish the business process objectives and scope. Understanding what the process is intended to accomplish and what activities, assets, people, systems, and dependencies are included provides the necessary context for identifying relevant risks. Selecting controls or developing response procedures before understanding the process can result in ineffective or unnecessary measures. The scope should also identify important boundaries and stakeholders involved in the process. Once the objectives and scope are established, assessors can identify threats, vulnerabilities, potential impacts, and existing controls. This creates a structured foundation for evaluating risk and determining appropriate treatment options.<\/span><\/p>\n

    Question 102<\/b><\/h3>\n

    What is the PRIMARY purpose of identifying critical assets during risk assessment?<\/b><\/p>\n

      \n
    1. To determine which assets require greater risk management attention<\/span><\/li>\n
    2. To eliminate the need for asset owners<\/span><\/li>\n
    3. To reduce the number of business processes<\/span><\/li>\n
    4. To ensure every asset receives identical protection<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Identifying critical assets allows an organization to determine which resources require greater attention because their compromise, loss, or unavailability could significantly affect business objectives. Critical assets may include information, applications, infrastructure, personnel, or services that support important operations. Not every asset has the same business value or risk exposure, so applying identical protection to everything may not be efficient. Asset owners remain important because they provide knowledge about business value, dependencies, and operational requirements. Identifying critical assets helps prioritize assessments, controls, monitoring, and resources according to business impact and risk appetite. This supports a more focused and effective risk management approach.<\/span><\/p>\n

      Question 103<\/b><\/h3>\n

      Which factor is MOST important when determining the likelihood of a risk event?<\/b><\/p>\n

        \n
      1. Number of security policies<\/span><\/li>\n
      2. Size of the organization<\/span><\/li>\n
      3. Number of employees<\/span><\/li>\n
      4. Relevant threat and vulnerability conditions<\/span><\/li>\n<\/ol>\n

        Correct Answer: 4<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Threat and vulnerability conditions are important factors when determining the likelihood that a risk event could occur. Assessors should consider the presence and capability of relevant threats, existing vulnerabilities, control effectiveness, exposure, historical information, and environmental conditions. Organizational size or employee count may provide context but does not independently determine likelihood. Similarly, simply counting security policies does not demonstrate how likely an event is to occur. A structured likelihood assessment should use defined criteria and reliable evidence where available. The resulting estimate should be documented so that risk prioritization remains consistent and can be reviewed when threat or vulnerability conditions change.<\/span><\/p>\n

        Question 104<\/b><\/h3>\n

        Which approach BEST supports objective risk scoring across different business units?<\/b><\/p>\n

          \n
        1. Allowing each department to use its own scoring method<\/span><\/li>\n
        2. Using standardized and documented risk criteria<\/span><\/li>\n
        3. Relying only on management intuition<\/span><\/li>\n
        4. Assigning the same score to every identified risk<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Standardized and documented risk criteria support objective and consistent risk scoring across business units. A common methodology defines how likelihood, impact, and other factors should be evaluated and ensures that similar risks are assessed using comparable standards. Allowing every department to use a different scoring approach can make enterprise-wide comparisons difficult and may produce inconsistent priorities. Management judgment remains important, but it should be supported by established criteria and relevant evidence. Assigning the same score to every risk eliminates meaningful prioritization. Standardization therefore helps management aggregate risk information, identify significant exposures, compare treatment needs, and make decisions that are aligned with organizational risk appetite and governance requirements.<\/span><\/p>\n

          Question 105<\/b><\/h3>\n

          What is the PRIMARY purpose of a risk appetite statement?<\/b><\/p>\n

            \n
          1. To define the types and amount of risk the organization is willing to accept<\/span><\/li>\n
          2. To list every technical vulnerability<\/span><\/li>\n
          3. To identify all employees responsible for security<\/span><\/li>\n
          4. To document every previous security incident<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            A risk appetite statement defines the types and amount of risk an organization is willing to accept while pursuing its objectives. It provides management with a high-level basis for making consistent risk decisions and evaluating whether exposures are within acceptable boundaries. A risk appetite statement is not a vulnerability inventory, employee responsibility list, or incident history. It should align with organizational strategy and provide guidance for establishing more specific risk tolerances and thresholds. Risk appetite helps management balance opportunities and potential adverse consequences. It also provides context for deciding whether risks should be accepted, mitigated, transferred, or avoided based on their relationship to business objectives.<\/span><\/p>\n

            Question 106<\/b><\/h3>\n

            Which activity BEST helps determine whether existing controls adequately address an identified risk?<\/b><\/p>\n

              \n
            1. Increasing the number of policies<\/span><\/li>\n
            2. Reviewing employee job descriptions<\/span><\/li>\n
            3. Evaluating control design and operating effectiveness<\/span><\/li>\n
            4. Changing the risk scoring scale<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Evaluating control design and operating effectiveness helps determine whether existing controls adequately address an identified risk. A control may be appropriately designed but fail to operate consistently, or it may operate correctly but not adequately address the underlying risk. Both dimensions therefore need consideration. Increasing policies or changing scoring methods does not establish whether controls are actually effective. Employee job descriptions may provide information about responsibilities but do not directly demonstrate control effectiveness. Control evaluation should consider the control objective, implementation, operating performance, evidence, and relationship to the identified risk. The results can then be used to determine residual risk and whether additional treatment is necessary.<\/span><\/p>\n

              Question 107<\/b><\/h3>\n

              Which situation MOST clearly indicates a need to reassess risk?<\/b><\/p>\n

                \n
              1. A routine team meeting occurs<\/span><\/li>\n
              2. A significant change is made to a critical business process<\/span><\/li>\n
              3. Office supplies are reordered<\/span><\/li>\n
              4. An existing policy is printed again<\/span><\/li>\n<\/ol>\n

                Correct Answer: 2<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                A significant change to a critical business process can alter assets, dependencies, threats, vulnerabilities, controls, and potential business impacts. Therefore, it is an important trigger for reassessing related risks. Risk assessments should be updated when material changes occur rather than being treated as permanent documents. Routine meetings, office supply orders, and reprinting an unchanged policy generally do not materially affect risk exposure. Organizations should define reassessment triggers based on changes such as new technology, major process modifications, security incidents, regulatory changes, acquisitions, or significant changes in business strategy. Trigger-based reassessment helps ensure that risk information remains relevant and reflects the organization’s current operating environment.<\/span><\/p>\n

                Question 108<\/b><\/h3>\n

                Which risk treatment option involves discontinuing an activity that creates unacceptable exposure?<\/b><\/p>\n

                  \n
                1. Risk transfer<\/span><\/li>\n
                2. Risk acceptance<\/span><\/li>\n
                3. Risk mitigation<\/span><\/li>\n
                4. Risk avoidance<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Risk avoidance involves discontinuing or changing an activity so that the associated risk is no longer incurred or is significantly removed from the organization’s exposure. For example, an organization may decide not to implement a particular technology if the associated risks cannot be managed within acceptable boundaries. Risk mitigation reduces likelihood or impact through controls, while transfer shifts certain consequences to another party. Acceptance means knowingly retaining the risk within approved boundaries. Avoidance should be considered when the potential exposure is unacceptable and alternative approaches can achieve business objectives without introducing the same risk. Management should evaluate business consequences before choosing avoidance.<\/span><\/p>\n

                  Question 109<\/b><\/h3>\n

                  Which information is MOST useful when prioritizing risks for executive attention?<\/b><\/p>\n

                    \n
                  1. Business impact, likelihood, and relationship to risk appetite<\/span><\/li>\n
                  2. Number of pages in the risk report<\/span><\/li>\n
                  3. Number of security administrators<\/span><\/li>\n
                  4. Age of the organization’s oldest system<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Business impact, likelihood, and relationship to organizational risk appetite provide useful information for prioritizing risks for executive attention. Executives need to understand which exposures could materially affect business objectives and whether those exposures fall within approved boundaries. Additional factors such as regulatory obligations, strategic importance, and treatment status may also influence prioritization. Report length and staffing levels do not directly indicate risk significance. The age of a system may contribute to vulnerability but does not independently determine enterprise risk. Executive reporting should focus on material exposure, potential consequences, trends, and decisions requiring management attention. This ensures that leadership receives information that supports effective governance and resource allocation.<\/span><\/p>\n

                    Question 110<\/b><\/h3>\n

                    What is the PRIMARY purpose of control monitoring?<\/b><\/p>\n

                      \n
                    1. To increase the number of controls<\/span><\/li>\n
                    2. To determine whether controls continue to operate effectively<\/span><\/li>\n
                    3. To eliminate all business risks<\/span><\/li>\n
                    4. To replace risk assessments<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Control monitoring helps determine whether controls continue to operate effectively over time. Controls can become ineffective because of changes in technology, business processes, personnel, configurations, threats, or operating conditions. Ongoing monitoring can identify weaknesses, exceptions, or changes that require corrective action. Monitoring does not necessarily increase the number of controls, eliminate all risks, or replace risk assessments. Instead, it provides evidence about the ongoing performance of existing controls and helps determine whether they continue to support risk treatment objectives. Effective monitoring should use appropriate measures and reporting mechanisms and should be aligned with the significance of the risks being managed.<\/span><\/p>\n

                      Question 111<\/b><\/h3>\n

                      Which factor should MOST influence the level of management approval required for risk acceptance?<\/b><\/p>\n

                        \n
                      1. The formatting of the risk report<\/span><\/li>\n
                      2. The number of pages in the assessment<\/span><\/li>\n
                      3. The significance of the risk and its potential impact<\/span><\/li>\n
                      4. The number of employees in the department<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        The significance of the risk and its potential impact should strongly influence the level of management approval required for risk acceptance. Organizations commonly establish authority levels so that higher-risk decisions require approval from individuals with greater responsibility. This ensures that significant exposures are knowingly accepted by appropriate management rather than being accepted at an unauthorized level. Report formatting and employee counts do not determine risk significance. Approval requirements should be documented within the organization’s governance framework and aligned with risk appetite and tolerance. When residual risk exceeds established thresholds or has significant strategic, financial, regulatory, or operational consequences, escalation to an appropriate management authority may be necessary.<\/span><\/p>\n

                        Question 112<\/b><\/h3>\n

                        Which activity BEST supports identification of risks caused by organizational change?<\/b><\/p>\n

                          \n
                        1. Reviewing only historical financial statements<\/span><\/li>\n
                        2. Increasing the number of security policies<\/span><\/li>\n
                        3. Monitoring changes in processes, technology, personnel, and business objectives<\/span><\/li>\n
                        4. Removing closed risks from the risk register<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 3<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Monitoring changes in processes, technology, personnel, and business objectives is an effective way to identify risks introduced by organizational change. Changes can create new dependencies, vulnerabilities, responsibilities, or operational conditions that alter existing risk exposure. Organizations should therefore establish mechanisms for identifying significant changes and determining whether related risk assessments need to be updated. Historical financial information may provide useful context but is insufficient by itself. Increasing policies does not necessarily identify new exposure, and removing closed risks does not support change analysis. A structured change-management process combined with risk review helps ensure that significant organizational changes are evaluated before they create unacceptable exposure.<\/span><\/p>\n

                          Question 113<\/b><\/h3>\n

                          What is the PRIMARY purpose of risk treatment prioritization?<\/b><\/p>\n

                            \n
                          1. To allocate resources to risks requiring the greatest attention<\/span><\/li>\n
                          2. To ensure all risks receive identical resources<\/span><\/li>\n
                          3. To eliminate the need for risk monitoring<\/span><\/li>\n
                          4. To reduce the number of risk owners<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Risk treatment prioritization helps organizations allocate limited resources to risks requiring the greatest attention. Risks differ in likelihood, impact, urgency, regulatory significance, and relationship to business objectives. Treating every risk identically may result in resources being spent on low-impact issues while significant exposures remain insufficiently addressed. Prioritization should use documented risk criteria and consider organizational risk appetite and available resources. It does not eliminate monitoring or reduce the need for risk ownership. Instead, prioritization provides a structured basis for determining which risks should be treated first, which can be monitored, and which may be accepted with appropriate authorization.<\/span><\/p>\n

                            Question 114<\/b><\/h3>\n

                            Which statement BEST describes inherent risk?<\/b><\/p>\n

                              \n
                            1. Risk remaining after controls are implemented<\/span><\/li>\n
                            2. Risk before considering the effect of controls<\/span><\/li>\n
                            3. Risk formally accepted by management<\/span><\/li>\n
                            4. Risk transferred to a third party<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Inherent risk represents the level of risk before considering the effect of controls or other risk treatments. It provides a baseline for understanding the exposure associated with a process, asset, activity, or situation. Residual risk, in contrast, is the exposure remaining after controls and treatments have been considered. Risk acceptance describes a management decision to retain exposure, while risk transfer involves shifting certain consequences to another party. Understanding inherent risk helps organizations evaluate how much risk reduction existing controls provide and whether additional treatment is necessary. It also supports comparison of risk exposure across processes and helps management understand the underlying significance of particular threats.<\/span><\/p>\n

                              Question 115<\/b><\/h3>\n

                              Which approach BEST supports effective communication of risk to nontechnical executives?<\/b><\/p>\n

                                \n
                              1. Use business-oriented language and explain potential business consequences<\/span><\/li>\n
                              2. Provide only technical vulnerability identifiers<\/span><\/li>\n
                              3. Include every system configuration detail<\/span><\/li>\n
                              4. Avoid discussing financial and operational impacts<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Risk communication to executives should use business-oriented language and explain how the risk could affect organizational objectives. Executives typically need to understand potential financial, operational, legal, regulatory, customer, or strategic consequences and what decisions may be required. Technical details can be included when they help explain the risk, but excessive configuration information may obscure the main message. Avoiding business impacts makes it difficult for management to understand the significance of the exposure. Effective communication should be concise, accurate, and focused on decision-relevant information. It should also explain current exposure, treatment status, trends, and recommended management actions where appropriate.<\/span><\/p>\n

                                Question 116<\/b><\/h3>\n

                                What should a risk owner do when a control designed to reduce a significant risk is found to be ineffective?<\/b><\/p>\n

                                  \n
                                1. Remove the risk from the register<\/span><\/li>\n
                                2. Accept the risk automatically<\/span><\/li>\n
                                3. Assess the resulting exposure and initiate appropriate corrective action<\/span><\/li>\n
                                4. Wait until the next annual assessment<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  When an important control is found to be ineffective, the risk owner should assess the resulting exposure and initiate appropriate corrective action. Control failure may increase residual risk and could cause exposure to exceed approved tolerance. The risk owner should determine the cause of the weakness, evaluate its impact, consider compensating controls, and implement remediation or escalate the issue when necessary. Removing the risk from the register does not reduce exposure, while automatic acceptance may exceed management authority. Waiting until an annual review could unnecessarily prolong unacceptable exposure. Timely assessment and corrective action help ensure that control weaknesses are addressed according to the significance of the associated risk.<\/span><\/p>\n

                                  Question 117<\/b><\/h3>\n

                                  Which activity is MOST useful for identifying concentration risk?<\/b><\/p>\n

                                    \n
                                  1. Reviewing how multiple risks depend on the same asset, provider, or process<\/span><\/li>\n
                                  2. Counting the number of security policies<\/span><\/li>\n
                                  3. Reviewing employee attendance records<\/span><\/li>\n
                                  4. Measuring the size of the IT department<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Concentration risk occurs when multiple exposures depend on the same asset, provider, technology, process, location, or other common dependency. Reviewing these relationships helps management identify situations where a single failure could affect multiple business activities simultaneously. For example, several critical services may depend on the same third-party provider or infrastructure component. Counting policies, reviewing attendance, or measuring department size does not directly identify such dependencies. Concentration analysis should be part of broader enterprise risk management because individual risk assessments may not reveal cumulative exposure. Identifying shared dependencies allows management to consider diversification, redundancy, contingency planning, or additional controls where appropriate.<\/span><\/p>\n

                                    Question 118<\/b><\/h3>\n

                                    Which metric is MOST useful for monitoring whether risk treatment remains effective?<\/b><\/p>\n

                                      \n
                                    1. Number of employees attending security training<\/span><\/li>\n
                                    2. Risk exposure compared with the defined target or threshold<\/span><\/li>\n
                                    3. Number of pages in the treatment plan<\/span><\/li>\n
                                    4. Number of meetings held by the risk committee<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Comparing current risk exposure with the defined treatment target or threshold provides meaningful evidence about whether risk treatment remains effective. The objective of treatment is to reduce or manage exposure according to established risk criteria. Monitoring this metric over time helps determine whether the treatment continues to achieve its intended outcome or whether changing conditions have increased exposure again. Training attendance, meeting counts, and document length may be useful administrative measures but do not directly demonstrate risk reduction. Effective monitoring should use relevant indicators tied to the risk and treatment objectives. When exposure moves beyond acceptable boundaries, the risk owner should investigate and determine whether additional action is required.<\/span><\/p>\n

                                      Question 119<\/b><\/h3>\n

                                      Which activity BEST demonstrates management oversight of enterprise risk?<\/b><\/p>\n

                                        \n
                                      1. Management reviews significant risk reports and makes decisions on treatment or acceptance<\/span><\/li>\n
                                      2. Technical staff maintain system configurations<\/span><\/li>\n
                                      3. Employees complete routine training<\/span><\/li>\n
                                      4. Administrators perform daily backups<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Management oversight is demonstrated when appropriate leaders review significant risk information and make decisions regarding treatment, acceptance, escalation, or resource allocation. These decisions show that risk is being governed at the appropriate organizational level. Technical configuration, employee training, and backups are important operational activities, but they do not by themselves demonstrate enterprise-level oversight. Management should receive relevant information about significant exposures, trends, treatment progress, and exceptions and should ensure that decisions remain aligned with risk appetite and business objectives. Effective oversight also requires accountability and follow-up so that approved actions are implemented and significant changes in exposure are communicated appropriately.<\/span><\/p>\n

                                        Question 120<\/b><\/h3>\n

                                        What is the PRIMARY objective of integrating risk management with enterprise governance?<\/b><\/p>\n

                                          \n
                                        1. To ensure risk considerations support organizational objectives and decision-making<\/span><\/li>\n
                                        2. To transfer all risk ownership to the board<\/span><\/li>\n
                                        3. To eliminate the need for operational controls<\/span><\/li>\n
                                        4. To make every business decision risk-free<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Integrating risk management with enterprise governance ensures that risk considerations are incorporated into organizational objectives, strategy, decision-making, and accountability structures. This helps management balance business opportunities with potential adverse consequences and allocate resources according to established priorities. Integration does not mean transferring every risk to the board or eliminating operational controls. It is also unrealistic to make every business decision completely risk-free. Effective governance establishes responsibilities, risk appetite, escalation mechanisms, reporting requirements, and oversight processes so that significant risks receive appropriate attention. When risk management is embedded into governance, risk information becomes part of normal business decision-making rather than a separate technical activity.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Isaca CRISC Exam Dumps and Practice Test Dumps.   Question 101 Which activity should be performed FIRST when conducting a risk assessment for a critical business process? Select security controls Identify the business process objectives and scope Purchase monitoring tools Develop an incident response plan Correct Answer: 2 Explanation Before assessing risks, the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20055"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=20055"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20055\/revisions"}],"predecessor-version":[{"id":20056,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20055\/revisions\/20056"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=20055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=20055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=20055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}