CRISC Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. Based on the control test results, which of the following is the most immediate risk?

Accepted Answer

Fraud due to lack of segregation of duties. The control test results show that the same individual can both create purchase orders and approve invoices, which violates segregation of duties. This lack of segregation creates an immediate risk of fraud because the employee could create fictitious orders and approve payments to themselves or accomplices without detection.

Answer

Material misstatement in financial statements

Answer

Non-compliance with credit policy

Answer

Inefficient order processing

Question 2

A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options:

A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive.
B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).
C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
D. Avoid the risk by discontinuing the use of email for business communications.

Which course of action is most appropriate given the organization's risk appetite and the current situation?

Accepted Answer

Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.. Option C is correct because implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.

Answer

Avoid the risk by discontinuing the use of email for business communications.

Answer

Accept the risk because the training has reduced the likelihood, and further controls are too expensive.

Answer

Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).

Question 3

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 4

During a qualitative risk assessment, the risk owner rates the likelihood of a threat as 'high' and the impact as 'medium'. According to standard risk matrices, what is the resulting risk level?

Accepted Answer

High. In a standard 3x3 or 5x5 risk matrix, a 'high' likelihood combined with a 'medium' impact typically maps to a 'high' risk level. This is because the risk level is determined by the intersection of likelihood and impact, and the product or matrix cell for these two ratings falls into the high category, indicating a significant risk that requires management attention.

Answer

Low

Answer

Medium

Answer

Critical

Question 5

After a risk assessment, the risk owner determines that the residual risk is still above the risk appetite. Which of the following is the MOST appropriate next step?

Accepted Answer

Implement additional controls. When residual risk remains above the risk appetite after initial risk assessment, the most appropriate next step is to implement additional controls to further reduce the risk to an acceptable level. This aligns with the risk treatment process where controls are selected and applied to lower the likelihood or impact of the risk event. Simply transferring, ignoring, or accepting the risk without further action would not address the gap between residual risk and risk appetite.

Answer

Transfer the risk

Answer

Ignore the risk

Answer

Accept the risk

Question 6

Which risk assessment method uses a matrix to plot likelihood and impact to determine risk level?

Accepted Answer

Qualitative. The qualitative risk assessment method uses a matrix to plot likelihood and impact, typically with ordinal scales (e.g., high, medium, low) to derive a risk level. This approach is subjective and relies on expert judgment rather than numerical values, making it distinct from quantitative methods.

Answer

Delphi technique

Answer

Annual loss expectancy

Answer

Quantitative

Question 7

A risk assessment that assigns monetary values to assets and calculates expected loss is called:

Accepted Answer

Quantitative. A quantitative risk assessment assigns specific monetary values to assets and calculates expected loss using formulas such as Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF), and Annualized Loss Expectancy (ALE) = SLE × Annualized Rate of Occurrence (ARO). This approach provides objective, numeric risk metrics that support cost-benefit analysis for risk mitigation decisions.

Answer

Qualitative

Answer

Semi-quantitative

Answer

Comprehensive

Question 8

During a risk assessment of a web application, the risk owner identifies that the application uses outdated encryption algorithms. What is the most appropriate next step?

Accepted Answer

Document the finding in the risk register and assign a remediation timeline.. Option C is correct because the risk owner has identified a specific vulnerability (outdated encryption algorithms) that must be formally recorded in the risk register. The next step is to document the finding and assign a remediation timeline, which aligns with the risk assessment process of treating identified risks. This ensures the issue is tracked, prioritized, and addressed within the organization's risk management framework, rather than being escalated, ignored, or patched without analysis.

Answer

Escalate the issue to senior management for approval to accept the risk.

Answer

Accept the risk without action because encryption is not critical.

Answer

Immediately patch the application to use modern encryption without further analysis.

Question 9

During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?

Accepted Answer

Perform an on-site technical assessment and interview key IT staff. Option D is correct because an on-site technical assessment and interviews allow the risk manager to observe actual controls, uncover undocumented systems, and assess security culture. Option A is incorrect because reviewing only high-level policies may miss operational gaps. Option B is incorrect because a vulnerability scan does not cover process or governance risks. Option C is incorrect because the target's own risk register may be incomplete or biased.

Answer

Analyze the target's existing risk register

Answer

Review the target's IT policies and procedures

Answer

Conduct a network vulnerability scan

Question 10

A retail company is identifying risks in its supply chain. Which approach is most effective for identifying previously unknown risks?

Accepted Answer

Scenario analysis with supply chain partners. Scenario analysis with supply chain partners is most effective for identifying previously unknown risks because it leverages collaborative brainstorming and 'what-if' thinking to uncover emergent threats that are not captured by historical data or static checklists. This approach is particularly valuable in supply chain contexts where interdependencies, third-party vulnerabilities, and novel disruptions (e.g., a new cyberattack vector targeting a logistics provider) can surface only through joint exploration of hypothetical events. It aligns with the CRISC emphasis on proactive risk identification beyond known patterns.

Answer

Employee surveys

Answer

Financial audit reports

Answer

Review of standard risk checklists

Question 11

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

Accepted Answer

Risk mitigation. Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 12

During a risk assessment, a risk manager is evaluating the effectiveness of a firewall rule set. The manager notes that the firewall logs show a high number of dropped packets from a specific IP range, but no policy changes have been made. The manager suspects the firewall rule set may be misconfigured. Which of the following should the manager do FIRST?

Accepted Answer

Review the change management records for the firewall.. Option C is correct because the first step when a misconfiguration is suspected without any known policy changes is to verify the change management records. This ensures that any recent modifications to the firewall rule set are accounted for, ruling out unauthorized or undocumented changes before proceeding with more invasive actions like penetration testing or blocking IP ranges.

Answer

Conduct a penetration test on the firewall.

Answer

Immediately block the IP range.

Answer

Update the risk register with a new risk.

Question 13

Based on the exhibit, which of the following risks is MOST indicated by the policy configuration?

Accepted Answer

Exposure of web server to untrusted networks without encryption. The policy configuration shows a rule allowing inbound HTTP/HTTPS traffic from the internet to a web server without any associated encryption requirement (e.g., no TLS enforcement or VPN). This directly exposes the web server to untrusted networks, making it vulnerable to man-in-the-middle attacks and data interception, which is the most significant risk indicated.

Answer

Data exfiltration via MySQL from the internet

Answer

Unauthorized SSH access to the internal network

Answer

Policy misconfiguration causing low hits on rule 3

Question 14

What is the primary risk if the WAF is misconfigured?

Accepted Answer

SQL injection attacks. A WAF protects against web application attacks such as SQL injection. If misconfigured, the web application is exposed. Option B is correct. Network segmentation failure (A) is not directly related. Denial of service (C) is a possibility but not the primary risk. Unauthorized database access (D) could result from SQL injection but is a consequence.

Answer

Unauthorized database access

Answer

Denial of service

Answer

Network segmentation failure

Question 15

An IT risk manager is performing a risk assessment for a new cloud service. Which TWO of the following are key inputs to the risk identification process? (Select TWO.)

Accepted Answer

Threat intelligence feeds. Threat intelligence feeds (B) provide current information about emerging threats, attack vectors, and adversary tactics, which are essential for identifying relevant risks to the cloud service. An asset inventory (E) is a foundational input because it lists all assets (e.g., data, VMs, APIs) that could be affected, enabling the risk manager to map threats to specific resources. Both are direct inputs to the risk identification phase, as defined by the CRISC framework.

Answer

Risk appetite statement

Answer

Control testing results

Answer

Residual risk levels

CRISC Practice Test 13 — 15 Questions

Exhibit

CRISC Practice Test 13 — 15 Questions

Exhibit