CRISC Practice Test 10 — 10 Questions

Question 1

During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the threat landscape and existing compensating controls to determine residual risk. The best approach to assess risk for a legacy application using a deprecated encryption protocol (e.g., SSL 3.0 or TLS 1.0) is to analyze the threat landscape and existing compensating controls. This allows the risk practitioner to determine the residual risk by considering factors such as whether the application is only accessible on an isolated network segment, whether network-level encryption (e.g., IPsec or a VPN tunnel) is in place, and whether the protocol is vulnerable to specific attacks like POODLE or BEAST. Simply assigning a high inherent risk score without further analysis (Option C) ignores compensating controls, while immediate escalation (Option D) or replacement (Option A) are risk treatment decisions, not risk assessment activities.

Answer

Replace the application with a modern alternative

Answer

Assign a high inherent risk score without further analysis

Answer

Immediately escalate to senior management for an exception

Question 2

A retail company monitors its key risk indicator (KRI) for credit card transaction fraud. The KRI has exceeded the established threshold for three consecutive days, but the weekly control performance report shows all fraud detection controls operating effectively. What should the risk practitioner do FIRST?

Accepted Answer

Investigate the data source of the KRI to ensure accuracy and timeliness.. The KRI breach may be caused by data inaccuracies or delays in the data feed, not by an actual increase in fraud. Investigating the data source ensures the KRI is reliable before taking any further action, aligning with the principle of validating monitoring data before making control decisions.

Answer

Immediately enhance the fraud detection controls.

Answer

Report the KRI breach to the board and recommend risk acceptance.

Answer

Adjust the KRI threshold to align with current control performance.

Question 3

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Accepted Answer

The application exposes sensitive customer data through APIs without proper authentication. The primary risk an Architecture Review Board should consider is the exposure of sensitive customer data through unauthenticated APIs, because this represents a direct, high-impact security and compliance risk (data breach, regulatory penalties, reputational damage). ARBs focus on risks that threaten confidentiality, integrity, and availability of critical assets, and unauthenticated API access to sensitive data is a classic OWASP API Security Top 10 issue.

Answer

The application does not support mobile devices

Answer

The application development timeline is aggressive

Answer

The application uses the latest JavaScript framework

Question 4

An organization's IT risk team is promoting a risk-aware culture. Which initiative is most likely to encourage employees to report security incidents without fear?

Accepted Answer

Establishing a no-blame incident reporting policy. A no-blame incident reporting policy directly addresses the psychological barrier of fear of reprisal, which is the primary reason employees hesitate to report security incidents. By explicitly stating that reporters will not face disciplinary action for unintentional errors or omissions, the organization fosters psychological safety and encourages timely reporting, which is critical for effective risk response.

Answer

Publishing quarterly incident statistics

Answer

Increasing the frequency of security awareness training

Answer

Implementing automated incident detection

Question 5

Which THREE of the following are common challenges when implementing a risk monitoring dashboard? (Select exactly three.)

Accepted Answer

Data quality and consistency issues. Data quality and consistency issues (A) are a common challenge because risk monitoring dashboards aggregate data from multiple sources, each with its own format, timeliness, and accuracy. Inconsistent data leads to unreliable metrics and false alarms, undermining the dashboard's purpose of providing a single source of truth for risk posture.

Answer

Reduced need for manual controls

Answer

Improved decision-making

Question 6

A company has implemented a new control to detect unauthorized access attempts. What is the PRIMARY purpose of monitoring this control?

Accepted Answer

To confirm the control is working effectively.. The primary purpose of monitoring a detective control, such as one that detects unauthorized access attempts, is to confirm that the control is operating effectively as designed. Monitoring provides ongoing assurance that the control is correctly identifying and logging unauthorized access events, which is essential for maintaining the security posture and for timely incident response.

Answer

To provide evidence for regulatory audits.

Answer

To reduce the number of unauthorized access attempts.

Answer

To calculate the residual risk level.

Question 7

A control monitoring system generates an alert when transaction volumes exceed 10,000 per hour. Recently, the system has been generating false positives during peak business hours due to legitimate seasonal spikes. Which of the following is the BEST approach to reduce false positives while maintaining effective monitoring?

Accepted Answer

Apply dynamic thresholding that adjusts based on historical baseline. Dynamic thresholding uses historical baselines to automatically adjust alerting thresholds in response to predictable patterns, such as seasonal spikes. This approach reduces false positives during peak hours while preserving the system's ability to detect anomalous transaction volumes that deviate from the learned baseline, ensuring effective monitoring without manual intervention.

Answer

Disable the alerting during peak hours

Answer

Implement manual review of all alerts during peak hours

Answer

Increase the alert threshold to 15,000 transactions per hour

Question 8

An organization defines its risk appetite as 'no more than one major security incident per year.' During the year, a major incident occurs. The monitoring team reports this to the risk committee. What should be the NEXT step?

Accepted Answer

Review the incident to determine if risk appetite needs adjustment.. The next step should be to review the incident to determine if the risk appetite needs adjustment. Risk appetite is a high-level statement of how much risk an organization is willing to accept. When an incident exceeds the stated appetite, it indicates that either the appetite was unrealistic or controls are inadequate. A review helps determine whether to adjust the appetite or improve controls. This is a proactive governance step.

Answer

Immediately change the risk appetite to tolerate two incidents per year.

Answer

Report the breach to the board of directors.

Answer

Accept the incident and continue with current controls.

Question 9

A company has identified a critical vulnerability in a legacy application that cannot be patched immediately. The application is used by a small number of users and supports a non-critical business process. Which of the following is the MOST appropriate risk response strategy?

Accepted Answer

Acceptance. Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation

Question 10

Which TWO of the following are primary purposes of risk and control monitoring? (Choose two.)

Accepted Answer

To verify that controls are operating as intended.. The primary purpose of risk and control monitoring is to verify that controls are operating as intended. This involves ongoing testing and observation to ensure that control activities are effectively mitigating risks to the desired level. Without this verification, an organization cannot confirm that its risk responses are actually working.

Answer

To identify opportunities for implementing new controls.

Answer

To ensure compliance with all regulatory requirements.

Answer

To eliminate all residual risk.