CRISC Practice Test 15 — 15 Questions

Question 1

Order the steps for change management in an IT environment.

Accepted Answer

Step 1: Request, Step 2: Approval, Step 3: Testing, Step 4: Implementation, Step 5: Review. Change management includes request, approval, testing, implementation, and review.

Answer

Step 1: Request, Step 2: Testing, Step 3: Approval, Step 4: Implementation, Step 5: Review

Answer

Step 1: Request, Step 2: Approval, Step 3: Implementation, Step 4: Testing, Step 5: Review

Answer

Step 1: Request, Step 2: Approval, Step 3: Testing, Step 4: Review, Step 5: Implementation

Question 2

A financial institution monitors the number of unauthorized access attempts to its core banking system. The risk owner recommends increasing the monitoring frequency from daily to hourly because a recent attack exploited a delayed detection. Which of the following is the PRIMARY benefit of this change?

Accepted Answer

Faster detection of anomalies. Increasing monitoring frequency from daily to hourly reduces the time between an unauthorized access attempt and its detection. This faster detection enables the security team to respond more quickly to anomalies, minimizing the potential impact of an attack that exploits delayed detection, such as a brute-force or credential-stuffing campaign.

Answer

Lower cost of monitoring

Answer

Increased system performance

Answer

Reduced false positive rate

Question 3

A mid-sized retail company processes over 1 million credit card transactions daily. It uses an automated monitoring system with static thresholds to flag potential fraud. Recently, the fraud detection team has been overwhelmed by a 40% increase in false positive alerts, causing legitimate transactions to be delayed and customer service complaints to rise. The risk manager is tasked with improving the situation. After reviewing the alert logs, it is clear that the thresholds have not been updated in 18 months, and transaction patterns have shifted due to seasonal promotions and new payment methods. The team has limited resources and cannot handle the current alert volume. What should the risk manager recommend as the most effective course of action?

Accepted Answer

Perform a root cause analysis on the false positives to refine the detection rules and thresholds.. Performing a root cause analysis to refine detection rules and thresholds (Option A) directly addresses the outdated thresholds that caused the increase in false positives. This approach is systematic and can be tailored to the current transaction patterns without requiring additional resources or tools. Option B (deploying a machine learning tool) introduces new complexity and costs without fixing the underlying threshold issue, and the team's limited resources may hinder implementation. Option C (hiring an external consultant) is costly and slow, and may not be sustainable. Option D (increasing thresholds immediately) could reduce alert volume but risks missing true positives, making it a temporary fix rather than a long-term solution.

Answer

Deploy an additional monitoring tool with machine learning capabilities.

Answer

Engage an external fraud detection consultant to review the system.

Answer

Immediately increase the alert thresholds to reduce the volume of alerts.

Question 4

During a quarterly control review, the risk team discovers that a key manual approval control was bypassed in 15% of transactions due to a recent process change. What is the FIRST action the risk practitioner should take?

Accepted Answer

Conduct a root cause analysis to determine why the bypass occurred.. The first action is to conduct a root cause analysis (B) to understand why the control was bypassed, as required by the CRISC process of identifying the underlying cause before taking corrective or compensating actions. This aligns with the risk monitoring and reporting domain, where a control deficiency must be analyzed to determine if it is a systemic process failure, a training gap, or a deliberate override. Without this analysis, any subsequent action—such as restoring the original control or updating the risk register—may be premature or misdirected.

Answer

Restore the original control process immediately.

Answer

Update the risk register to reflect the increased residual risk.

Answer

Escalate to senior management with a recommendation for disciplinary action.

Question 5

A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?

Accepted Answer

Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.. Root cause analysis (RCA) on the firewall misconfigurations directly investigates why the misconfigurations occurred, uncovering underlying process weaknesses such as inadequate change management, lack of configuration standards, or insufficient training. This addresses the root cause rather than symptoms, which is exactly what the risk manager needs to prevent recurrence across regional offices.

Answer

Implement additional logging on all firewall devices to capture configuration changes.

Answer

Conduct a penetration test targeting all regional office networks to identify vulnerabilities.

Answer

Update the risk register to include the incidents and assign risk owners.

Question 6

An organization is migrating on-premises applications to a public cloud. Which THREE of the following should be considered as key risk identification activities?

Accepted Answer

Mapping network security group rules to existing firewall policies.. Option A is correct because mapping existing firewall policies to cloud network security group (NSG) rules is a risk identification activity: it exposes gaps, overly permissive rules, or missing controls that could leave migrated workloads exposed after the move. Option D is correct because identifying data residency and compliance requirements (e.g., GDPR, HIPAA, PCI DSS, or sovereign data-location mandates) surfaces legal and regulatory risks that can block or reshape a migration. Option E is correct because assessing shared responsibility model gaps clarifies which security controls the provider handles versus which remain the customer's duty, revealing misconfigurations or unowned risks in IaaS, PaaS, and SaaS layers. Options B and C are not risk identification activities; a cost-benefit analysis and total cost of ownership calculation are financial justification and planning exercises that address economic feasibility rather than identifying security, compliance, or operational risks.

Answer

Performing a cost-benefit analysis of the migration.

Answer

Calculating the total cost of ownership.

Question 7

A critical vendor is being onboarded. The vendor risk appetite policy requires SOC 2 Type II reports for critical vendors. The vendor has provided a SOC 2 Type I report. What should the risk manager do?

Accepted Answer

Request a SOC 2 Type II report from the vendor. The vendor risk appetite policy explicitly requires SOC 2 Type II reports for critical vendors, and the vendor only provided a Type I report. The risk manager must enforce the policy as written, so the correct action is to request the Type II report from the vendor. Accepting a Type I or exempting the vendor would violate the stated policy and undermine the control.

Answer

Downgrade the vendor to a lower tier

Answer

Exempt the vendor from the requirement

Answer

Accept the Type I report as sufficient

Question 8

During a vendor risk assessment, a prospective vendor for critical services cannot provide a SOC 2 Type II report. According to the organization's vendor risk appetite, which action should be taken?

Accepted Answer

Reject the vendor or request a formal risk acceptance. A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Answer

Lower the vendor's tier to reduce requirements

Answer

Accept the vendor's self-assessment instead

Answer

Onboard the vendor with additional monitoring

Question 9

Which of the following is a Key Control Indicator (KCI) that measures the effectiveness of a firewall?

Accepted Answer

Number of blocked intrusion attempts. A KCI measures the performance or effectiveness of a control. The number of blocked intrusion attempts is a direct measure of the firewall's preventive effectiveness.

Answer

Number of security incidents reported

Answer

Average time to patch vulnerabilities

Answer

Percentage of employees who completed security training

Question 10

A risk assessment of a critical financial application identifies a high inherent risk due to outdated software. The risk manager is considering mitigation options. Which TWO of the following would be considered preventive controls?

Accepted Answer

Configuring access controls. Configuring access controls is a preventive control because it proactively restricts unauthorized users from accessing the financial application, reducing the likelihood of a security incident. By enforcing least privilege and authentication mechanisms, it directly mitigates the risk of exploitation of the outdated software by limiting who can interact with it.

Answer

Deploying an intrusion detection system

Answer

Establishing a backup and recovery plan

Answer

Conducting regular security audits

Question 11

A SIEM generates alerts for the following events. Which TWO events should be considered potential emerging risks? (Select exactly 2.)

Accepted Answer

High number of failed authentication attempts from a single IP. Option C is correct because a high volume of failed authentication attempts from a single IP is a classic indicator of a brute-force or password-spraying attack, representing an emerging risk that could lead to unauthorized access. Option E is correct because an unusual increase in outbound traffic from a database server may indicate data exfiltration, command-and-control communication, or a compromised host, all of which are emerging threats. Option A does not belong because a successful scheduled backup is a normal, expected operational event with no risk implication. Option B does not belong because a routine software update installation is a planned maintenance activity, not an emerging risk. Option D does not belong because low disk space on a file server is a capacity or availability issue, not an emerging security risk.

Answer

Scheduled backup completed successfully

Answer

Software update installed on server

Answer

Low disk space alert on a file server

Question 12

An organization recently experienced a data breach due to a misconfigured cloud storage bucket. As part of the IT risk assessment, which control should be prioritized to prevent recurrence?

Accepted Answer

Deploy automated cloud configuration scanning and remediation tools.. Automated cloud configuration scanning and remediation tools directly address the root cause of a misconfigured cloud storage bucket by continuously monitoring cloud infrastructure against security baselines (e.g., CIS benchmarks) and automatically correcting deviations. This prevents recurrence by catching misconfigurations in real time, rather than relying on manual approval processes or periodic testing that may miss transient changes.

Answer

Require management approval for all cloud storage changes.

Answer

Implement mandatory annual security awareness training for all employees.

Answer

Increase the frequency of third-party penetration testing.

Question 13

In a quantitative risk analysis using FAIR, which of the following best represents Loss Magnitude (LM)?

Accepted Answer

Primary Loss + Secondary Loss. In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

Answer

Single Loss Expectancy (SLE)

Answer

Threat Event Frequency × Vulnerability

Answer

Annualized Loss Expectancy (ALE)

Question 14

Which TWO of the following are primary sources of risk identification for IT projects? (Select exactly 2.)

Accepted Answer

Project documentation. Option B (Project documentation) is a primary source of risk identification because artifacts such as the project charter, scope statement, WBS, schedule, assumptions log, and stakeholder register expose uncertainties, dependencies, and constraints that can become risks. Option E (Lessons learned from previous projects) is also a primary source, since historical records from comparable projects reveal recurring threats, failure patterns, and effective mitigations that should inform the current risk register. Option A (Security baseline) is a control configuration reference, not a risk identification input; it defines required settings rather than surfacing project risks. Option C (Risk treatment plan) is an output of the risk management process that documents responses to already-identified risks, so it cannot be a primary source of identification. Option D (Firewall logs) are operational security monitoring data used for detection and incident response, not a standard project risk identification source.

Answer

Security baseline

Answer

Risk treatment plan

Answer

Firewall logs

Question 15

Which TWO of the following are valid triggers for initiating a risk assessment outside the regular cycle? (Select 2)

Accepted Answer

A significant change in the IT infrastructure. A significant change in IT infrastructure (Option B) is a classic trigger for ad-hoc risk assessment because it introduces new vulnerabilities, alters the attack surface, or changes the effectiveness of existing controls. For example, migrating from on-premises servers to a cloud environment (e.g., AWS, Azure) changes network segmentation, identity management, and data residency, requiring a fresh risk evaluation to identify and treat new threats before they are exploited.

Answer

An employee completing annual security awareness training

Answer

The annual internal audit of financial controls

Answer

Completion of a routine security patch cycle