CRISC Practice Test 12 — 15 Questions

Question 1

Based on the exhibit, which risk should be treated first according to the risk rating?

Accepted Answer

R001, because it has the highest risk level. Option D is correct because risk treatment priority is determined by the risk level, which is a function of both likelihood and impact. In the exhibit, R001 has the highest risk level (e.g., 16), calculated as likelihood × impact, making it the most critical to address first. This aligns with the CRISC principle of prioritizing risks with the highest residual risk rating.

Answer

R003, because the likelihood is highest

Answer

R002, because the impact is highest

Answer

All three should be treated simultaneously

Question 2

Refer to the exhibit. The SIEM alert triggered, but the security team did not respond because they were investigating another incident. What is the BEST way to prevent such monitoring gaps in the future?

Accepted Answer

Configure automatic escalation to a secondary response team if the alert is not acknowledged within a set time.. Option D is correct because it directly addresses the monitoring gap caused by analyst unavailability. By configuring automatic escalation to a secondary response team if an alert is not acknowledged within a set time, the organization ensures that no alert is left unattended even when the primary team is occupied. This is a standard operational resilience control in SIEM workflows, often implemented via playbook automation or SOAR integration.

Answer

Implement a ticketing system to track alert handling.

Answer

Hire additional security analysts to handle peak loads.

Answer

Increase the threshold to reduce false positives.

Question 3

A financial institution is integrating a new cloud-based analytics platform that will process sensitive customer data. The project team is conducting risk identification. Which technique would be MOST effective for identifying risks related to the integration of this platform with existing on-premises systems?

Accepted Answer

Threat modeling of the integration architecture.. Threat modeling of the integration architecture is the most effective technique because it systematically identifies potential security threats, attack vectors, and vulnerabilities specific to the data flows, trust boundaries, and API interactions between the cloud-based analytics platform and existing on-premises systems. Unlike generic methods, threat modeling (e.g., STRIDE or PASTA) focuses on the unique integration points, such as authentication handshakes, data-in-transit encryption (TLS 1.2/1.3), and session management, which are critical for protecting sensitive customer data during integration.

Answer

Vulnerability scanning of the cloud platform's API endpoints.

Answer

Brainstorming sessions with the project team.

Answer

SWOT analysis to assess strengths, weaknesses, opportunities, and threats.

Question 4

Based on the exhibit, what is the MOST likely risk scenario?

Accepted Answer

Brute force attack resulting in account compromise. The exhibit shows a high number of failed authentication attempts from a single IP address over a short time window, followed by a successful login. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations until one succeeds, leading to account compromise.

Answer

Phishing attack that captured user credentials

Answer

Insider threat from a legitimate user

Answer

Denial of service attack on the authentication server

Question 5

Based on the exhibit, which control is most critical to address first to reduce the risk of unauthorized access?

Accepted Answer

Segregation of duties conflict resolution timeliness.. Option A is correct because segregation of duties (SoD) conflict resolution timeliness directly addresses the risk that unresolved conflicts could allow a single user to execute unauthorized actions across multiple systems. If SoD conflicts are not resolved promptly, a user might retain incompatible roles (e.g., both creating and approving purchase orders), enabling fraud or unauthorized access without detection. This control is foundational because it prevents the accumulation of excessive privileges that bypass other access controls.

Answer

Privileged access review frequency.

Answer

User access recertification completion rate.

Answer

Terminated employee account disabling timeliness.

Question 6

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

Accepted Answer

Accept the risk with compensating controls such as network segmentation.. Option D is correct because the system processes non-critical data and cannot be patched, making risk acceptance with compensating controls the most appropriate strategy. Network segmentation reduces the likelihood of exploitation by isolating the legacy system from critical assets, while the low likelihood and non-critical data make decommissioning or insurance less suitable. This aligns with CRISC best practices for legacy systems where patching is impossible and the risk is within the organization's risk appetite.

Answer

Mitigate the risk by applying vendor patches.

Answer

Avoid the risk by decommissioning the system immediately.

Answer

Transfer the risk by purchasing cyber insurance.

Question 7

Refer to the exhibit. Given the organization's risk appetite is Low, which risk response is most appropriate?

Accepted Answer

Implement additional monitoring to reduce residual risk to Low.. With a Low risk appetite, the organization requires residual risk to be Low. Option D proposes implementing additional monitoring to reduce the Medium residual risk to Low, which aligns with the risk appetite. This is a corrective response that mitigates the risk without unnecessary business disruption.

Answer

Accept the current residual risk because it is Medium.

Answer

Avoid the risk by discontinuing operations.

Answer

Transfer the risk via insurance.

Question 8

Based on the firewall log exhibit, which of the following conclusions is MOST appropriate for risk identification?

Accepted Answer

There is evidence of a potential reverse shell or malware beaconing from host 10.0.1.15. Option D is correct because the firewall log shows an outbound connection from internal host 10.0.1.15 to external server 203.0.113.50 on a high ephemeral port (e.g., 4444), which is commonly associated with reverse shell payloads or malware command-and-control (C2) beaconing. This pattern indicates that the internal host may have been compromised and is establishing an outbound channel to an external attacker, bypassing typical inbound firewall rules. Such behavior is a critical risk indicator for IT risk identification, as it suggests active malicious activity within the network.

Answer

External server 198.51.100.20 is attempting to exploit host 10.0.1.10

Answer

Host 10.0.1.15 is successfully communicating with external server 203.0.113.50

Answer

The firewall is functioning correctly with no security incidents

Question 9

A risk manager is designing a monitoring and reporting framework. Which THREE of the following are essential components of an effective risk and control monitoring program?

Accepted Answer

Control self-assessments (CSAs). Control self-assessments (CSAs) are essential because they empower process owners to evaluate the design and operating effectiveness of internal controls, providing firsthand evidence for the monitoring program. This bottom-up approach complements top-down testing by identifying control gaps and remediation needs directly from those who execute the controls, which is critical for a comprehensive risk and control monitoring framework.

Answer

Key performance indicators (KPIs)

Answer

Risk response plans

Question 10

During a risk assessment, the risk manager identifies that the likelihood of a cyber-attack is high due to recent industry trends. However, the existing controls are deemed effective in reducing impact. Which of the following is the MOST appropriate risk response?

Accepted Answer

Mitigate. Mitigate is the most appropriate risk response because the likelihood of a cyber-attack is high, but existing controls are effective in reducing the impact. Mitigation involves implementing additional controls or enhancing existing ones to reduce the likelihood or impact further, which aligns with the scenario where controls are already effective but need to be strengthened to address the high likelihood.

Answer

Avoid

Answer

Accept

Answer

Transfer

Question 11

Based on the exhibit, which of the following poses the HIGHEST risk to the environment?

Accepted Answer

The database has a direct SSH connection from the internet. Option D is correct because a direct SSH connection from the internet to the database server bypasses all network segmentation and firewall controls, exposing the database to brute-force attacks, credential theft, and unauthorized remote access. SSH is a management protocol, not an application protocol, and its exposure on the internet creates a direct attack surface on the most sensitive data tier, which is the highest risk to the environment.

Answer

The web servers are in a public subnet

Answer

The communication between web and application servers is encrypted via HTTPS

Answer

The application servers use embedded credentials to access the database

Question 12

A company's IT risk team is conducting a risk identification exercise for a new blockchain-based supply chain solution. Which THREE risks are MOST specific to this technology?

Accepted Answer

51% attack on the underlying consensus mechanism.. A 51% attack is a specific risk to blockchain consensus mechanisms where a single entity or group gains majority hashing power, allowing them to reverse transactions or prevent new blocks from being confirmed. This directly undermines the integrity and immutability that blockchain promises for the supply chain solution.

Answer

Incompatibility with legacy database systems.

Answer

High electricity consumption of mining nodes.

Question 13

Which TWO of the following are appropriate criteria for selecting key risk indicators (KRIs)?

Accepted Answer

Indicators that are quantifiable and reliable. Option A is correct because key risk indicators (KRIs) must be quantifiable and reliable to provide objective, measurable data that can be consistently tracked over time. Quantifiable indicators allow for trend analysis and threshold setting, while reliability ensures the data source is accurate and repeatable, which is essential for effective risk monitoring in IT environments such as network security or system availability.

Answer

Indicators that only cover financial risks

Answer

Indicators that measure historical losses

Answer

Indicators that are easy to collect regardless of relevance

Question 14

A smart manufacturing company has deployed hundreds of IoT sensors and actuators across its production line. These devices are connected directly to the corporate network without any segmentation and communicate using unencrypted protocols. A third-party vendor manages all IoT devices and has administrative access from their own network. Recently, the IT team detected unusual outbound traffic from the IoT segment to unknown IP addresses on the internet. The risk manager is leading a risk identification workshop. Based on this scenario, what is the most critical risk to the organization that should be identified and documented?

Accepted Answer

Unauthorized remote access to the corporate network via the IoT devices. The most critical risk is unauthorized remote access to the corporate network via the IoT devices. The IoT devices are directly connected to the corporate network without segmentation and communicate using unencrypted protocols, while a third-party vendor has administrative access from their own network. The unusual outbound traffic to unknown IP addresses strongly suggests that an attacker has compromised the vendor's network or the devices themselves, using the unencrypted protocols (e.g., MQTT without TLS, Modbus/TCP) to pivot into the corporate network, bypassing perimeter defenses.

Answer

Compliance violation with industry regulations

Answer

Loss of data integrity due to tampering with sensor measurements

Answer

Physical damage to equipment due to unsafe actuator commands

Question 15

What is the most significant risk identified by this configuration?

Accepted Answer

Unauthorized access to sensitive data from the internet. The configuration exposes the S3 bucket to the internet without proper access controls, such as a bucket policy that restricts access to specific IP addresses or requires authentication. This means anyone on the internet can read or write objects in the bucket, leading to unauthorized access to sensitive data. The most significant risk is the direct exposure of confidential information to untrusted external actors.

Answer

Denial of service attack on the S3 bucket

Answer

Loss of encryption keys

Answer

Data exfiltration by internal users

CRISC Practice Test 12 — 15 Questions

Exhibit

CRISC Practice Test 12 — 15 Questions

Exhibit