CRISC Practice Test 14 — 15 Questions

Question 1

A multinational corporation is assessing the risk of a new cloud-based customer relationship management (CRM) system. The risk manager conducts a qualitative risk assessment using a risk matrix that plots likelihood vs. impact. Which of the following is the PRIMARY benefit of using a qualitative approach over a quantitative approach in this context?

Accepted Answer

It reduces the time required for data collection and analysis.. In a qualitative risk assessment, the risk manager uses subjective ratings (e.g., high, medium, low) for likelihood and impact rather than gathering hard financial data. This approach significantly reduces the time and effort needed for data collection and analysis because it avoids the complex calculations, historical loss data gathering, and monetary valuation required by quantitative methods. For a new cloud-based CRM system, where historical incident data may be scarce, qualitative assessment enables a faster initial risk evaluation.

Answer

It provides precise monetary values for risk exposure.

Answer

It allows for easy comparison of risks across different business units.

Answer

It eliminates the need for expert judgment.

Question 2

An organization uses a third-party SaaS provider for payroll processing. Which of the following is the BEST technique to identify risks associated with this vendor?

Accepted Answer

Review the vendor's SOC 2 Type II report and conduct an on-site assessment. The SOC 2 Type II report provides an independent auditor's assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time, which is critical for identifying risks in a payroll SaaS processing sensitive employee data. An on-site assessment allows the organization to verify physical and logical controls, observe operations, and discuss specific risk scenarios directly with vendor personnel, offering a deeper risk identification than any single document or review.

Answer

Request a penetration test report from the vendor

Answer

Check online user reviews and ratings

Answer

Read the vendor's marketing materials and case studies

Question 3

A SOC analyst observes repeated failed login attempts from an external IP address targeting a user account. What is the best next step in the IT risk identification process?

Accepted Answer

Investigate if the IP address is associated with known malicious activity. Option C is correct because the first step in the IT risk identification process is to validate whether the observed event represents a genuine threat. Investigating the external IP address against threat intelligence feeds (e.g., VirusTotal, AlienVault OTX) confirms if it is associated with known malicious activity, such as a botnet or brute-force campaign, before taking any action. This aligns with the CRISC risk identification phase, where the goal is to characterize the risk event, not immediately respond or escalate.

Answer

Block the IP address immediately

Answer

Conduct a vulnerability scan of the target system

Answer

Escalate to the incident response team

Question 4

An organization is implementing a new data loss prevention (DLP) solution. The risk manager is identifying potential risks related to the DLP solution itself. Which of the following is a risk that should be considered?

Accepted Answer

The DLP solution may generate a high volume of false positives, causing alert fatigue and missed real incidents.. Option A is correct because a DLP solution may generate false positives, leading to alert fatigue and missed detections. Option B is a benefit, not a risk. Option C is a control. Option D is a desired outcome.

Answer

The DLP solution will reduce the risk of data exfiltration.

Answer

The DLP solution will block all unauthorized data transfers.

Answer

The DLP solution will automatically encrypt sensitive data in transit.

Question 5

Which TWO outcomes indicate that a risk assessment process is effective?

Accepted Answer

Risk treatment decisions are based on clear, prioritized findings.. Option B is correct because an effective risk assessment must produce prioritized findings that directly inform risk treatment decisions. Without clear prioritization (e.g., based on inherent risk scores or likelihood/impact ratings), the organization cannot allocate resources efficiently or select appropriate controls. The CRISC framework emphasizes that the output of risk assessment is actionable intelligence, not just a list of risks.

Answer

All potential risks have been identified.

Answer

No negative risk events occur after the assessment.

Answer

The organization achieves full compliance with security standards.

Question 6

During a risk assessment, the risk practitioner discovers that a critical database does not have an active failover solution. The database is used by multiple business applications. Which of the following factors should be given the HIGHEST weight when determining the inherent risk level?

Accepted Answer

The criticality of the database to business operations. The inherent risk level is determined by the potential impact and likelihood of a threat exploiting a vulnerability, without considering controls. The criticality of the database to business operations directly drives the impact severity—if the database fails, multiple business applications could be disrupted, leading to significant operational and financial damage. This makes option A the highest-weighted factor because it defines the worst-case consequence, which is the foundation of inherent risk.

Answer

The number of existing compensating controls

Answer

The frequency of vulnerability scans

Answer

The cost to restore the database from backup

Question 7

An organization is performing a business impact analysis (BIA) for its critical applications. Which TWO of the following are primary objectives of a BIA?

Accepted Answer

Prioritize recovery of business processes based on criticality.. Option A is correct because a primary objective of a BIA is to prioritize the recovery of business processes based on their criticality to the organization. This prioritization directly informs the recovery time objectives (RTOs) and resource allocation for each process, ensuring that the most critical functions are restored first during a disruption.

Answer

Determine the likelihood of each threat event.

Answer

Calculate the annualized loss expectancy (ALE).

Answer

Select appropriate risk response strategies.

Question 8

An organization is conducting a risk assessment of its remote access infrastructure. Which THREE of the following are typical components of a risk assessment report? (Select THREE.)

Accepted Answer

Risk register with identified risks and ratings. A risk register is a core component of a risk assessment report because it formally documents each identified risk, its likelihood, impact, and risk rating (e.g., using a 5x5 matrix). This provides a structured, auditable record that supports decision-making and compliance with frameworks like ISO 31000 or NIST SP 800-30.

Answer

Detailed network architecture diagrams

Answer

Logs of all remote access sessions

Question 9

An organization is conducting a business impact analysis (BIA) for its core banking system. Which of the following is the PRIMARY metric used to determine the urgency of recovery?

Accepted Answer

Maximum Tolerable Downtime (MTD). The Maximum Tolerable Downtime (MTD) is the primary metric for determining the urgency of recovery because it defines the total duration a business process can be unavailable before causing irreparable harm. For a core banking system, MTD directly reflects the maximum acceptable outage period from the business perspective, driving all recovery planning priorities.

Answer

Service Level Agreement (SLA)

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Question 10

An organization recently experienced a data breach due to a misconfigured cloud storage bucket. As part of the IT risk assessment, which control should be prioritized to prevent recurrence?

Accepted Answer

Deploy automated cloud configuration scanning and remediation tools.. Option D is correct because automated cloud configuration scanning and remediation tools directly address the root cause of a misconfigured cloud storage bucket by continuously monitoring cloud infrastructure against security baselines (e.g., CIS benchmarks) and automatically correcting deviations. This prevents recurrence by catching misconfigurations in real time, rather than relying on manual approval processes or periodic testing that may miss transient changes.

Answer

Require management approval for all cloud storage changes.

Answer

Implement mandatory annual security awareness training for all employees.

Answer

Increase the frequency of third-party penetration testing.

Question 11

Which risk identification technique relies on analyzing past incidents to predict future risks?

Accepted Answer

Loss event data analysis. Loss event data analysis (B) is the correct risk identification technique because it systematically examines historical incident records, such as security logs, breach reports, and audit findings, to identify patterns and trends that can predict future risks. This empirical approach leverages past loss events to quantify likelihood and impact, making it distinct from generative or qualitative methods.

Answer

Brainstorming

Answer

SWOT analysis

Answer

Delphi technique

Question 12

A large enterprise uses a risk matrix with impact categories (very low, low, medium, high, very high) and likelihood (rare, unlikely, possible, likely, almost certain). A risk identified has a 'likely' likelihood and 'high' impact. According to the matrix, risks with this combination are classified as 'high' risk. The risk appetite statement requires that all high risks have a response plan within 30 days. However, the risk owner argues that due to effective compensating controls, the residual risk is only 'medium'. Which of the following is the BEST course of action?

Accepted Answer

Formalize the risk treatment plan and include the compensating controls in the risk register.. Option B is correct because the organization should formally document the compensating controls and update the risk register to reflect residual risk. This ensures that the risk management process captures the true risk position. Option A is wrong because extending the deadline does not address the residual risk. Option C is unnecessary if residual risk is within appetite. Option D lacks formality and may not satisfy the requirement.

Answer

Implement additional controls to ensure the residual risk becomes low.

Answer

Accept the risk as is, since controls reduce it to acceptable level.

Answer

Document the residual risk as medium and extend the response deadline beyond 30 days.

Question 13

During an IT risk assessment, a risk analyst discovers that a server contains sensitive customer data but is not included in the organization's vulnerability scanning program. What should the analyst do first?

Accepted Answer

Notify the vulnerability scan administrator to include the server in the next scan.. The analyst should report the missing server to the scan administrator to ensure it is included (Option B), as the immediate need is to close the scanning gap.

Answer

Add the server to the high-risk register immediately.

Answer

Perform a manual vulnerability assessment on the server.

Answer

Request an exception from management for the server to be exempt from scanning.

Question 14

A multinational organization is assessing the risk of a new cloud service that stores data across multiple geographic regions. The service provider offers standard contractual terms and does not commit to specific data residency requirements. What is the primary risk that should be evaluated?

Accepted Answer

Non-compliance with data protection regulations due to data location uncertainty.. Compliance with data protection regulations (Option D) is the primary risk because data residency impacts legal obligations, especially under GDPR and similar laws.

Answer

Service availability and uptime commitments.

Answer

Unauthorized access to data by cloud provider employees.

Answer

Inadequate encryption of data at rest and in transit.

Question 15

During a risk assessment, the risk manager finds that a critical application has a single point of failure in its network path. The application's availability requirement is 99.99%. The current design achieves only 99.9% uptime. Which risk metric should be calculated first?

Accepted Answer

Risk gap between required and current service level.. The risk manager must first quantify the risk gap between the required 99.99% availability (approximately 52.56 minutes of downtime per year) and the current 99.9% availability (approximately 525.6 minutes per year). This gap of 473.04 minutes per year establishes the magnitude of the risk exposure before any financial calculations (ALE, SLE, EF) can be performed, as those metrics depend on knowing the actual downtime that needs to be costed.

Answer

Annualized Loss Expectancy (ALE) based on potential downtime cost.

Answer

Exposure factor (EF) representing the percentage of loss.

Answer

Single loss expectancy (SLE) for a single outage event.