CRISC Practice Test 14 — 15 Questions

Question 1

An organization uses control self-assessments (CSAs) as part of its monitoring program. The results from the latest CSA show that the majority of controls are rated as effective, but an internal audit reveals several control failures in those same areas. What is the MOST likely reason for this discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CSA respondents may have a bias toward reporting favorable results. Control self-assessments (CSAs) rely on the subjective judgment of process owners and operators, who may have a natural tendency to report favorable results to avoid scrutiny or additional work. This self-reporting bias is a well-known limitation of CSAs, leading to an overstatement of control effectiveness. The internal audit, being independent and objective, is more likely to uncover actual control failures, explaining the discrepancy.

Answer

The CSA scope was narrower than the audit scope

Answer

The CSA questionnaire contained documentation errors

Answer

The inherent risk level of the processes decreased after the CSA

Question 2

An organization uses a third-party vendor for payment processing. The vendor's latest SOC 2 report shows a significant control exception in logical access. What is the BEST way to monitor the effectiveness of the compensating controls the vendor has implemented?

Accepted Answer

Obtain the vendor's remediation plan and schedule a follow-up assessment to verify the compensating controls.. The most effective way to monitor compensating controls is to obtain the vendor's remediation plan and schedule a follow-up assessment. This allows the organization to verify that the compensating controls are operating effectively, which is a key activity in the Risk and Control Monitoring and Reporting domain. Simply accepting risk or adding contractual clauses does not provide ongoing assurance that the controls are working as intended.

Answer

Accept the risk and apply a monetary penalty to the vendor.

Answer

Immediately terminate the vendor contract and switch to a new payment processor.

Answer

Request the vendor to include a clause in the contract that holds them liable for any breaches.

Question 3

Refer to the exhibit. During a risk identification review, the risk manager sees this IDS alert. What risk does this alert MOST directly indicate?

Accepted Answer

An internal SQL server is exposed to the internet and may be probed for vulnerabilities.. The IDS alert indicates an inbound connection attempt to TCP port 1433 (Microsoft SQL Server) from an external IP address. This directly suggests that an internal SQL server is exposed to the internet, which is a security misconfiguration that allows external entities to probe for vulnerabilities, such as weak credentials or unpatched flaws. While data exfiltration or malware could be subsequent outcomes, the alert itself most immediately signals the exposure and probing risk.

Answer

Sensitive data is being exfiltrated from the SQL server.

Answer

A malware infection is spreading across the network.

Answer

The organization is under a distributed denial-of-service (DDoS) attack.

Question 4

After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?

Accepted Answer

Implement additional controls to reduce probability to 2%. The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.

Answer

Accept the residual risk

Answer

Purchase cybersecurity insurance

Answer

Discontinue the process

Question 5

Which THREE of the following are best practices for reporting risk and control monitoring results to stakeholders?

Accepted Answer

Tailor the report to the audience's level of understanding.. Risk and control monitoring reports must be tailored to the audience's level of understanding to ensure that stakeholders can effectively interpret the information. For example, an executive summary should focus on high-level risk exposure and strategic impacts, while detailed reports for control owners may include operational metrics. This practice aligns with the principle of communicating risk information in a manner that supports informed decision-making.

Answer

Include detailed technical logs for each control.

Answer

Provide reports only when issues occur.

Question 6

An organization has a policy requiring all sensitive data to be encrypted at rest. During an audit, it is found that encryption keys are stored in plaintext on the same server. Which risk response is MOST appropriate?

Accepted Answer

Mitigate by encrypting the key file. Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Answer

Avoid by removing the data

Answer

Accept the risk because encryption is still applied

Answer

Transfer the risk to a cloud provider

Question 7

A risk manager is using a 5×5 likelihood-impact matrix to assess a set of identified risks. What is the PRIMARY advantage of using this qualitative method?

Accepted Answer

It is quick and easy to communicate to stakeholders.. Qualitative risk analysis using heat maps is quick and easy to communicate to stakeholders, making it a common initial assessment tool.

Answer

It provides objective and comparable risk scores across organizations.

Answer

It produces financially meaningful results for cost-benefit analysis.

Answer

It requires less data but is time-consuming to complete.

Question 8

A company has implemented an automated control monitoring system that generates alerts when transactions exceed predefined thresholds. The system has been in production for six months. The risk team notices that the number of alerts has been decreasing, while actual control failures have remained constant. Which of the following is the MOST likely cause?

Accepted Answer

The data feed from transaction systems has degraded, causing missing data. A decreasing alert volume with constant control failures strongly suggests the monitoring system is no longer receiving complete transaction data, so fewer transactions are evaluated and fewer threshold breaches are detected. A degraded data feed (missing or delayed records) would suppress alerts without any real improvement in control effectiveness. This is a classic monitoring integrity issue: the control may still be failing at the same rate, but the detection mechanism is blind to it.

Answer

Employees have learned to bypass the monitoring system

Answer

The control effectiveness has improved significantly

Answer

The thresholds were automatically adjusted to be more restrictive

Question 9

A risk manager is evaluating the cost-effectiveness of a proposed control. The control costs $50,000 annually to implement and maintain. The current annual loss expectancy (ALE) for the risk is $200,000, and the control is expected to reduce the ALE by 70%. What is the net benefit (or loss) of implementing the control?

Accepted Answer

Net benefit of $90,000. The control reduces the ALE by 70%, so the mitigated ALE is $200,000 × 0.30 = $60,000, meaning the control saves $140,000 in expected annual loss. Subtracting the $50,000 annual control cost gives a net benefit of $140,000 − $50,000 = $90,000. This is the standard ALE-based cost-benefit calculation used in CRISC risk treatment decisions.

Answer

Net loss of $10,000

Answer

Net benefit of $140,000

Answer

Net loss of $50,000

Question 10

An organization wants to promote a risk-aware culture. Which initiative best supports this goal?

Accepted Answer

Encouraging incident reporting without blame. Encouraging incident reporting without blame directly supports a risk-aware culture by removing the fear of punishment, which motivates employees to report issues promptly. This allows the organization to identify and respond to risks early, rather than hiding them, and aligns with the risk response principle of learning from incidents to improve controls.

Answer

Focusing only on technical controls

Answer

Limiting risk awareness training to IT staff

Answer

Punishing employees who cause security incidents

Question 11

An organization uses Key Control Indicators (KCIs) to measure the effectiveness of its firewall change management process. Which KCI would best indicate a process deficiency?

Accepted Answer

Exception rate for changes not following the standard process. A Key Control Indicator (KCI) measures whether a control is operating effectively. An exception rate for changes not following the standard process directly indicates how often the firewall change management process is bypassed or failing, which is a clear sign of process deficiency. The other options measure activity or volume, not control effectiveness.

Answer

Percentage of changes approved by the change advisory board

Answer

Average time to implement a change

Answer

Number of firewall rules added per month

Question 12

In assessing control effectiveness, an IS auditor evaluates both design adequacy and operating effectiveness. Which of the following indicates that a control is operating effectively?

Accepted Answer

The control has been tested and works as designed. Operating effectiveness means the control has been tested and consistently produces the intended result in practice. Even if a control is well-designed, it may fail during actual operation due to misconfiguration, human error, or environmental changes. Testing confirms that the control functions as designed under real conditions, which is the definitive indicator of operating effectiveness.

Answer

The control is approved by management

Answer

The control is inexpensive to implement

Answer

The control is documented in policy

Question 13

A risk manager is evaluating the application of IEC 62443 for industrial control systems. Which THREE of the following are key security requirements addressed by this standard?

Accepted Answer

Identification and authentication control. IEC 62443 is a series of standards specifically designed for the security of Industrial Automation and Control Systems (IACS). It addresses cybersecurity requirements to protect these systems from cyber threats. Identification and authentication control (B) is a foundational requirement, ensuring that only authorized users and devices can access the system, which is critical for preventing unauthorized access to industrial processes.

Answer

Environmental monitoring (temperature, humidity)

Answer

Physical security of data centers

Question 14

Which of the following is the BEST example of promoting a risk-aware culture within an organization?

Accepted Answer

Encouraging incident reporting without blame. A blame-free incident reporting culture is the foundation of a risk-aware environment. When employees feel safe to report errors or near-misses without fear of punishment, the organization can collect accurate data on control weaknesses and emerging threats, enabling proactive risk response. This aligns with the COBIT 5 principle of fostering a culture of openness and learning, which is essential for effective risk management.

Answer

Implementing strict penalties for security violations

Answer

Assigning risk ownership to IT only

Answer

Conducting annual security training

Question 15

An organization uses a Key Risk Indicator (KRI) that tracks the average number of days to patch critical vulnerabilities. The KRI has been trending upward over the last three months, from 15 days to 30 days, while the risk appetite threshold is 20 days. Which conclusion is most appropriate?

Accepted Answer

The vulnerability risk is increasing and requires management attention. The KRI has risen from 15 to 30 days, exceeding the 20-day risk appetite threshold. When a KRI breaches its threshold, it signals that the risk is outside acceptable limits and requires management attention. The correct conclusion is that vulnerability risk is increasing and must be addressed.

Answer

The patching process is effective because the KRI is still below 60 days

Answer

The KRI should be replaced with a lagging indicator

Answer

The risk is within appetite because the increase is gradual