CRISC Practice Test 13 — 15 Questions

Question 1

During a risk assessment, the risk manager finds that a critical application has a single point of failure in its network path. The application's availability requirement is 99.99%. The current design achieves only 99.9% uptime. Which risk metric should be calculated first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk gap between required and current service level.. The risk manager must first quantify the risk gap between the required 99.99% availability (approximately 52.56 minutes of downtime per year) and the current 99.9% availability (approximately 525.6 minutes per year). This gap of 473.04 minutes per year establishes the magnitude of the risk exposure before any financial calculations (ALE, SLE, EF) can be performed, as those metrics depend on knowing the actual downtime that needs to be costed.

Answer

Annualized Loss Expectancy (ALE) based on potential downtime cost.

Answer

Exposure factor (EF) representing the percentage of loss.

Answer

Single loss expectancy (SLE) for a single outage event.

Question 2

A risk assessment for a healthcare organization reveals a high likelihood of data breaches due to weak encryption on portable devices. The organization decides to deploy full-disk encryption and enforce multi-factor authentication. Which risk response strategy is being applied?

Accepted Answer

Mitigation. Deploying full-disk encryption and multi-factor authentication directly reduces the likelihood and/or impact of data breaches from weak encryption on portable devices. This is the definition of risk mitigation — applying controls to lower risk to an acceptable level. The organization is actively reducing the vulnerability, not transferring, accepting, or avoiding the risk.

Answer

Transfer

Answer

Acceptance

Answer

Avoidance

Question 3

A bank is identifying IT risks and categorizes a potential data breach as both a compliance risk (due to GDPR) and a reputational risk. This is an example of:

Accepted Answer

Multiple risk categories for a single risk. A single risk can belong to multiple categories; this is normal in risk categorization.

Answer

Risk aggregation

Answer

Improper risk classification

Answer

Risk scenario overlap

Question 4

During a quarterly risk review, it is discovered that a previously accepted risk has materialized due to a change in the external environment. What is the MOST appropriate response?

Accepted Answer

Re-evaluate the risk treatment plan.. When a previously accepted risk materializes due to a change in the external environment, the risk treatment plan is no longer valid. The most appropriate response is to re-evaluate the risk treatment plan (Option D) because the original acceptance decision was based on assumptions that have now changed. This ensures that new controls or alternative treatments are considered to address the realized risk effectively.

Answer

Report to regulators.

Answer

Increase insurance coverage.

Answer

Accept the impact.

Question 5

Which TWO of the following are primary factors that determine how often a risk assessment should be performed?

Accepted Answer

Rate of change in the IT environment. Option B is correct because the rate of change in the IT environment directly drives how quickly risk exposure can shift — new systems, cloud migrations, software updates, and architecture changes can invalidate a prior assessment, so faster change demands more frequent reassessment. Option D is correct because the inherent risk level of critical assets determines the potential impact and likelihood of loss; high-inherent-risk assets (e.g., those processing sensitive data or supporting critical services) warrant more frequent risk assessments than low-risk assets. Option A is not a primary factor — budget is a constraint on how assessments are executed, not a driver of the required frequency. Option C is not a primary factor — headcount does not by itself change the risk landscape or the need for reassessment. Option E is not a primary factor — past incidents may inform risk ratings, but the frequency of assessment is driven by change and inherent risk, not by a historical incident count.

Answer

Available risk assessment budget

Answer

Number of IT employees

Answer

Number of past security incidents

Question 6

Which of the following is the BEST practice for determining the frequency of control monitoring activities?

Accepted Answer

Align monitoring frequency with risk level and control effectiveness assessment. Control monitoring frequency should be driven by the assessed risk level and the effectiveness of existing controls. High-risk areas or controls with lower effectiveness require more frequent monitoring to ensure timely detection of failures, while low-risk or highly effective controls can be monitored less often, optimizing resource allocation.

Answer

Standardize all controls to quarterly monitoring

Answer

Monitor only after a control failure is detected

Answer

Set frequency based solely on regulatory minimum requirements

Question 7

A risk manager notices that a key risk indicator (KRI) for failed login attempts has exceeded the threshold for three consecutive weeks. Which of the following should be the FIRST action?

Accepted Answer

Investigate the root cause of the increase.. When a KRI exceeds its threshold for multiple consecutive periods, the first action is to investigate the root cause to determine whether the increase indicates a genuine security issue (e.g., brute-force attack, credential stuffing) or a false positive. Jumping to reporting or threshold adjustment without understanding the underlying cause could lead to misallocation of resources or missed detection of an actual threat. This aligns with the CRISC principle that risk indicators must be validated before escalation or remediation.

Answer

Adjust the threshold to reduce false positives.

Answer

Report the breach to the senior management immediately.

Answer

Ignore the trend as a statistical anomaly.

Question 8

A risk analyst is assessing the impact of a potential ransomware attack. Which THREE categories of business impact should be considered?

Accepted Answer

Operational downtime. Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Answer

Geographic diversity

Answer

Technical complexity

Question 9

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 10

A retail company uses a manual control to verify that all credit card transactions are processed by authorized payment terminals. The control requires a store manager to compare a daily transaction log against a list of approved terminal IDs. The company processes an average of 10,000 transactions per day across 200 stores. During a recent internal audit, it was found that 15% of stores had not completed the reconciliation for the past month. The audit also revealed that several unauthorized terminals had been used to process transactions, resulting in a data breach of customer payment information. The company's risk appetite for payment card data security is very low. The current monitoring approach includes a quarterly review of control performance by the internal audit team. The risk manager needs to recommend improvements to the monitoring of this control. Which of the following is the BEST recommendation?

Accepted Answer

Automate the reconciliation by integrating the transaction log with the approved terminal list.. The control failure is systemic: 15% of stores skipped manual reconciliation, and unauthorized terminals processed transactions, indicating the manual control is not reliably performed at scale (10,000 transactions/day, 200 stores). Automating the reconciliation by integrating the transaction log with the approved terminal list removes human error, enforces consistency, and provides timely detection aligned with the very low risk appetite for payment card data. This is the best recommendation because it addresses the root cause (manual, error-prone process) rather than treating symptoms.

Answer

Increase internal audit reviews of the control to monthly.

Answer

Implement disciplinary actions for store managers who skip reconciliations.

Answer

Provide refresher training to all store managers on the procedure.

Question 11

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Accepted Answer

Risk assessment methodology. A risk assessment methodology provides a standardized approach for identifying, analyzing, and evaluating risks. It ensures that all business units use consistent criteria, scales, and processes, which is essential for comparing and aggregating risks across the enterprise. Without a common methodology, risk assessments become subjective and inconsistent, undermining the risk management program.

Answer

Risk treatment process

Answer

Risk management policy

Answer

Risk register

Question 12

An organization's security team recommends implementing a web application firewall (WAF) to protect against SQL injection attacks. The risk manager evaluates the cost of the WAF and the likelihood of a successful attack. This evaluation is BEST described as:

Accepted Answer

Cost-benefit analysis. The risk manager is comparing the cost of implementing the WAF against the likelihood and potential impact of a SQL injection attack. This direct comparison of mitigation cost to risk reduction benefit is the essence of a cost-benefit analysis, which determines whether the control is economically justified. It is not a calculation of residual or inherent risk, nor is it an acceptance decision.

Answer

Residual risk calculation

Answer

Inherent risk assessment

Answer

Risk acceptance

Question 13

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Accepted Answer

Data sovereignty and compliance with local regulations. The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Answer

Multi-tenancy isolation risks

Question 14

During an IT risk assessment, a risk owner identifies a risk that is within the organization's risk appetite. The recommended risk treatment option is to:

Accepted Answer

Accept the risk with formal sign-off.. When a risk is within appetite, the appropriate response is to accept it, with formal documentation and sign-off by the risk owner.

Answer

Avoid the risk by eliminating the activity.

Answer

Transfer the risk through cyber insurance.

Answer

Mitigate the risk by implementing additional controls.

Question 15

Which of the following is a key component of an IT risk management programme design?

Accepted Answer

Risk assessment methodology. A risk assessment methodology defines the process for identifying, analyzing, and evaluating risks, which is a core component of any risk management programme.

Answer

Incident response playbooks

Answer

Vendor security assessment reports

Answer

Network topology diagrams