CRISC Practice Test 1 — 10 Questions

Question 1

Which TWO are characteristics of inherent risk?

Accepted Answer

Risk level before controls. Option C is correct because inherent risk is defined as the level of risk that exists before any controls are applied, representing the raw exposure of an asset or process to a threat. Option E is correct because inherent risk is assessed under the assumption that no controls exist, which establishes a baseline against which control effectiveness can later be measured. Together, these two characteristics distinguish inherent risk from residual risk, which is the risk remaining after controls are implemented. Option A is incorrect because basing risk on the effectiveness of current controls describes residual risk, not inherent risk. Option B is incorrect because determining the control gap is a derived analysis activity that compares inherent and residual risk, not a defining characteristic of inherent risk itself. Option D is incorrect because the risk level after controls is the definition of residual risk.

Answer

Based on the effectiveness of current controls

Answer

Used to determine control gap

Answer

Risk level after controls

Question 2

An organization is implementing a new access control system to prevent unauthorized access to sensitive data. Which type of control is being implemented?

Accepted Answer

Preventive control. An access control system that prevents unauthorized access to sensitive data is a preventive control because it enforces security policies before access is granted. Technologies like mandatory access control (MAC) or role-based access control (RBAC) with Access Control Lists (ACLs) block unauthorized users at the point of entry, reducing the risk of data exposure.

Answer

Detective control

Answer

Compensating control

Answer

Corrective control

Question 3

A Key Risk Indicator (KRI) for vulnerability management is the "average patch lag time" (number of days between patch release and deployment). In the last month, this metric increased from 15 days to 45 days. How should the risk practitioner interpret this change?

Accepted Answer

The risk level has increased because exposure to known vulnerabilities has grown.. An increase in average patch lag from 15 to 45 days means critical vulnerabilities remain exploitable for a longer window, directly increasing exposure to known threats. Since KRIs are designed to signal changes in risk levels, a rising KRI indicates the risk level has increased and warrants attention. The correct interpretation is that the organization's exposure to known vulnerabilities has grown.

Answer

The KRI is not relevant because patch lag is a control indicator, not a risk indicator.

Answer

The risk level has decreased because patches are being evaluated more thoroughly.

Answer

The risk level remains unchanged because patch lag is a lagging indicator.

Question 4

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 5

A company's control monitoring dashboard shows that a key control has been operating effectively for six months. However, a recent audit revealed a material weakness. Which of the following is the MOST likely reason?

Accepted Answer

The KRI thresholds were set incorrectly.. The dashboard shows the control operating effectively for six months, yet a material weakness was found. This discrepancy most likely arises because the Key Risk Indicator (KRI) thresholds were set incorrectly, meaning the monitoring system was calibrated to report acceptable risk levels even when the control was actually failing. Incorrect thresholds cause false positives in the dashboard, masking the true control deficiency.

Answer

The control was not tested during the period.

Answer

The monitoring frequency was too low.

Answer

The control owner was not trained.

Question 6

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 7

A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?

Accepted Answer

Reduce the risk by disabling the feature globally through a script or administrative override before launch.. The most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.

Answer

Transfer the risk by requiring students to sign a consent form allowing email disclosure.

Answer

Avoid the risk by selecting a different LMS vendor that does not have this issue.

Answer

Accept the risk because the exposure is limited to email addresses and not grades.

Question 8

Your organization is undergoing a merger and acquisition. The IT risk assessment team is tasked with evaluating the target company's IT environment. During the assessment, you discover that the target company uses a legacy ERP system that is no longer supported by the vendor. They have no disaster recovery plan for this system, and it contains financial data critical to the merged entity. The integration timeline is aggressive, and replacing the system would delay the merger by 18 months. The executive team is reluctant to delay. What is the BEST risk treatment option?

Accepted Answer

Mitigate by developing a disaster recovery plan and implementing compensating controls such as regular backups and manual procedures.. The legacy ERP system contains critical financial data and cannot be replaced without an 18-month delay, making risk mitigation the most practical approach. Developing a disaster recovery plan and implementing compensating controls (e.g., regular backups, manual procedures) reduces the likelihood and impact of a system failure while allowing the merger to proceed on schedule. This aligns with the CRISC principle of treating risk by reducing residual risk to an acceptable level without blocking business objectives.

Answer

Avoid the risk by excluding the legacy system from the merger and migrating data to a new system.

Answer

Accept the risk because the system has been running for years without issue.

Answer

Transfer the risk to the target company's previous owners.

Question 9

During a risk assessment, an organization identifies that its remote workforce uses personal devices for work. The risk manager is concerned about data leakage. The organization has a risk appetite that is 'moderate' and wants to treat the risk. Which of the following is the MOST effective risk treatment option?

Accepted Answer

Implement a Mobile Device Management (MDM) policy with containerization. The most effective because MDM with containerization creates a separate, encrypted work profile on the personal device, isolating corporate data from personal apps and data. This directly addresses data leakage by enforcing security policies (e.g., remote wipe of the work container only) without requiring full control over the entire device, aligning with a 'moderate' risk appetite that seeks a balance between security and usability.

Answer

Implement a VPN for remote access

Answer

Require full disk encryption on all personal devices

Answer

Ban the use of personal devices for work

Question 10

An organization is updating its asset inventory to improve IT risk identification. Which of the following asset attributes is MOST critical for assessing cybersecurity risk?

Accepted Answer

Criticality rating based on business impact. For assessing cybersecurity risk, the most critical attribute is the criticality rating based on business impact because it directly quantifies the potential harm from a security incident. Without knowing which assets are most vital to business operations, risk prioritization becomes arbitrary, leading to misallocated security controls. This aligns with the CRISC focus on risk-based decision-making, where impact drives the urgency of mitigation.

Answer

IP address and location

Answer

Asset owner contact information

Answer

Software vendor name