CRISC Practice Test 12 — 15 Questions

Question 1

A medium-sized e-commerce company has a risk monitoring program that tracks key risk indicators (KRIs) monthly. One KRI is the percentage of orders with failed payment transactions. The threshold is 2%, but for the past three months, the KRI has been 2.5%, 3.1%, and 2.8%. The risk owner says this is due to a seasonal increase in fraudulent transactions and expects it to return to normal next month. The company has a compensating control that manually reviews flagged transactions. The internal audit team recently tested the compensating control and found it to be 100% effective. The risk committee wants to know if the KRI breach requires action. What should the risk practitioner recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Acknowledge the breach but note that the compensating control is effective, so no immediate action is required; continue to monitor.. The compensating control (manual review of flagged transactions) has been tested as 100% effective, meaning the residual risk is within acceptable tolerance despite the KRI breach. The risk owner attributes the breach to a seasonal spike, and the risk monitoring program should continue to track the KRI monthly to confirm a return to normal. Immediate action is not warranted when the compensating control fully mitigates the risk, and the risk committee should be informed that the control is effective.

Answer

Immediately implement additional automated controls to reduce the KRI.

Answer

Escalate the issue to the board and recommend a risk acceptance.

Answer

Lower the KRI threshold to 3% to accommodate seasonal variations.

Question 2

A risk practitioner notices that a key control is tested only once a year, but the associated risk has a high velocity of change. What is the BEST recommendation?

Accepted Answer

Increase testing frequency to quarterly or monthly. A high velocity of change means the risk profile can shift rapidly between annual tests, leaving the organization exposed for months. Increasing testing frequency to quarterly or monthly ensures that control effectiveness is validated in near real-time, aligning monitoring cadence with risk dynamics. This is a core principle of risk-based monitoring: the testing interval must match the speed at which the risk can materialize.

Answer

Remove the control if it cannot be tested more often

Answer

Wait for a control failure before increasing frequency

Answer

Continue annual testing because it meets regulatory requirements

Question 3

A board member asks for a summary of the top five risks. The risk practitioner has 10 risks with current residual risk levels. Which approach BEST supports board-level reporting?

Accepted Answer

Present the top five by residual risk level, including a trend indicator. Board-level reporting requires concise, actionable insights. Presenting the top five risks by residual risk level, with a trend indicator (e.g., increasing, stable, decreasing), allows the board to quickly understand the most critical exposures and whether risk posture is improving or deteriorating. This aligns with the CRISC focus on risk communication that supports strategic decision-making, not operational detail.

Answer

Only highlight risks that have increased since last quarter

Answer

List risks alphabetically with current control status

Answer

Provide a detailed risk register with all 10 risks and full risk analysis

Question 4

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. When the cost of a control exceeds the ALE and the risk is already within the organization's risk appetite, accepting the risk is the economically justified response. Spending $500k to mitigate a $300k annualized loss is not cost-effective, and the risk is tolerable by definition.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 5

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000

Question 6

A company has multiple business units each using different risk assessment methodologies. The risk committee wants consistent monitoring reports. What is the BEST approach to achieve consistency?

Accepted Answer

Develop and mandate a standardized risk assessment methodology.. Mandating a standardized risk assessment methodology ensures that all business units apply the same criteria, scales, and processes for identifying, analyzing, and evaluating risks. This eliminates methodological inconsistencies at the source, enabling the risk committee to produce truly comparable and reliable monitoring reports across the enterprise.

Answer

Aggregate risks at the enterprise level using a common taxonomy.

Answer

Require each business unit to adopt the same risk scoring scale.

Answer

Create a centralized reporting template with predefined fields.

Question 7

A risk practitioner is categorizing IT risks for a manufacturing company. Which of the following risks would be classified as an 'operational' IT risk?

Accepted Answer

Risk of production line downtime due to a server failure. Operational IT risks relate to the day-to-day functioning of IT systems and processes. Production line downtime due to a system failure directly impacts operations.

Answer

Risk of financial loss from a ransomware payment

Answer

Risk of non-compliance with GDPR for customer data stored in the EU

Answer

Risk of reputational damage from a data breach

Question 8

A risk practitioner notices that the number of failed authentication attempts has spiked by 300% over the past week. Which of the following actions should be taken FIRST?

Accepted Answer

Analyze the logs to identify the source and nature of the attempts. The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.

Answer

Report the spike to the board

Answer

Implement multi-factor authentication

Answer

Increase the frequency of password changes

Question 9

Which of the following is a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Answer

Data encryption

Answer

Backup and restore

Answer

Firewall

Question 10

Which of the following threat actors is MOST likely to be motivated by ideology rather than financial gain?

Accepted Answer

Hacktivist. Hacktivists are defined by their ideological, political, or social motivations, using cyberattacks to promote a cause, protest, or draw attention to perceived injustices. Their primary goal is message amplification or disruption, not monetary profit. This distinguishes them from financially driven actors such as organized crime.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 11

Put the steps for performing a control self-assessment (CSA) in order.

Accepted Answer

Define scope, then identify controls, then assess effectiveness, then identify gaps, then report results. CSA involves defining scope, identifying controls, assessing effectiveness, gap identification, and reporting.

Answer

Define scope, then assess effectiveness, then identify controls, then identify gaps, then report results

Answer

Identify controls, then define scope, then assess effectiveness, then identify gaps, then report results

Answer

Define scope, then identify controls, then identify gaps, then assess effectiveness, then report results

Question 12

An organization is planning to deploy an IoT solution in a manufacturing plant. The risk manager is asked to identify risks associated with the integration of IoT devices into the plant network. Which of the following techniques would be MOST effective for identifying both technical and operational risks?

Accepted Answer

Facilitate a brainstorming session with IT, operational technology (OT), and safety teams. A brainstorming session that includes IT, operational technology (OT), and safety teams is the most effective technique because IoT integration creates a convergence of traditional IT risks (e.g., network segmentation, patch management) with OT-specific risks (e.g., real-time control system integrity, safety interlocks) and physical safety hazards. This cross-functional approach surfaces technical risks like unpatched firmware vulnerabilities in programmable logic controllers (PLCs) and operational risks such as unplanned downtime due to misconfigured device-to-controller communication protocols (e.g., Modbus/TCP without authentication).

Answer

Conduct a SWOT analysis of the IoT project

Answer

Interview the plant manager about operational challenges

Answer

Send a risk questionnaire to employees

Question 13

A healthcare organization operates a legacy electronic health record (EHR) system that is manually monitored for access anomalies by a small IT team. The organization is planning to migrate to a new cloud-based EHR with integrated logging and monitoring. However, due to budget constraints, the migration will take two years. In the interim, the risk manager wants to improve monitoring for unauthorized access to patient data. The current manual process involves weekly log reviews, but recent audits have identified instances of delayed detection (up to two weeks) and missed incidents. The IT team can dedicate only 10 additional hours per week for monitoring. What is the best approach to enhance monitoring during the transition period?

Accepted Answer

Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data.. Given budget and staffing constraints, a phased risk-based approach that prioritizes high-risk areas (privileged accounts, sensitive patient data) is the most practical way to improve monitoring during the two-year transition. It focuses limited resources where risk is highest and can be implemented incrementally without a large upfront investment.

Answer

Outsource the monitoring to a third-party managed security service provider.

Answer

Implement a full automation suite for access monitoring immediately.

Answer

Accept the current monitoring state as adequate given the upcoming migration.

Question 14

An organization uses a third-party SaaS provider for payroll processing. Which of the following is the BEST technique to identify risks associated with this vendor?

Accepted Answer

Review the vendor's SOC 2 Type II report and conduct an on-site assessment. The SOC 2 Type II report provides an independent auditor's assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time, which is critical for identifying risks in a payroll SaaS processing sensitive employee data. An on-site assessment allows the organization to verify physical and logical controls, observe operations, and discuss specific risk scenarios directly with vendor personnel, offering a deeper risk identification than any single document or review.

Answer

Request a penetration test report from the vendor

Answer

Check online user reviews and ratings

Answer

Read the vendor's marketing materials and case studies

Question 15

A manufacturing company is integrating its industrial control systems (ICS) with the corporate IT network to enable real-time production monitoring. Which risk is most directly introduced by this convergence?

Accepted Answer

Expanded attack path from IT to OT systems. The convergence of IT and OT networks creates a bridge between two environments that were traditionally air-gapped. This bridge allows threats that compromise the corporate IT network to pivot into the industrial control systems (ICS), expanding the attack surface and providing adversaries with a direct path to operational technology (OT). Unlike licensing costs or analytics complexity, this is a direct security risk that can lead to physical consequences, making it the most critical risk introduced by such integration.

Answer

Higher licensing costs for industrial software

Answer

Increased complexity of data analytics

Answer

Reduced operational efficiency due to network latency