CRISC Practice Test 15 — 15 Questions

Question 1

A third-party vendor has been assessed as high risk due to its access to sensitive data. Which TWO ongoing monitoring activities are most appropriate for this vendor? (Select two.)

Accepted Answer

Monthly conference calls with vendor management. For high-risk vendors, ongoing monitoring must include regular communication and continuous threat intelligence. Monthly conference calls (B) ensure management engagement and oversight, while continuous monitoring via threat intelligence sharing platforms (D) provides real-time risk detection. Annual reassessment (C) is too infrequent for high-risk vendors.

Answer

Daily manual review of vendor logs

Answer

Annual reassessment of security controls

Answer

Single initial onboarding assessment

Question 2

An organization is designing a vendor risk assessment process for critical vendors. Which THREE of the following should be included in the initial onboarding assessment?

Accepted Answer

Security questionnaires. Security questionnaires are a foundational tool in initial vendor onboarding because they systematically gather detailed information about the vendor's security controls, policies, and practices. This allows the organization to assess the vendor's baseline security posture against its own requirements before any business relationship begins.

Answer

Continuous monitoring via shared intelligence platforms

Answer

Annual reassessment

Question 3

Which TWO methods are commonly used for continuous monitoring of IT controls?

Accepted Answer

SIEM rules for automated testing. Automated SIEM rules and vulnerability scanning are typical continuous monitoring techniques.

Answer

Board risk review

Answer

Annual control self-assessment

Answer

Quarterly internal audit

Question 4

A medium-sized e-commerce company recently experienced a denial-of-service (DoS) attack that took down its website for two hours. The incident response team quickly mitigated the attack by blocking the source IPs. In the aftermath, the risk manager is tasked with identifying risks to prevent recurrence. The company relies heavily on a single internet service provider (ISP) and has no DDoS protection service. The IT director suggests purchasing additional server capacity to absorb future attacks. The CEO is concerned about the cost. The risk team has identified that the likelihood of a similar attack is high based on recent industry trends, and the impact includes lost revenue and customer trust. What is the MOST effective risk identification action the risk team should take next?

Accepted Answer

Document the risk and evaluate alternative mitigation options, including diversifying ISPs.. The risk team's primary role during risk identification is to document the risk and evaluate alternative mitigation options before committing to a specific solution. Diversifying ISPs addresses the single point of failure in the network architecture, which is a root cause of the DoS vulnerability, and aligns with the principle of defense in depth. Simply blocking source IPs is reactive, and the IT director's suggestion of adding server capacity is a costly and potentially ineffective absorption strategy against volumetric attacks.

Answer

Implement a web application firewall (WAF) to filter malicious traffic.

Answer

Recommend purchasing DDoS protection from a cloud-based provider.

Answer

Accept the risk because the cost of mitigation exceeds expected loss.

Question 5

A risk assessment identifies a critical vulnerability in a web application. Which control type would be most effective in preventing exploitation of this vulnerability?

Accepted Answer

Preventive control such as patching the vulnerability. Preventive controls aim to stop the risk event from occurring; patching is a classic preventive control.

Answer

Compensating control such as additional monitoring

Answer

Corrective control such as backup restoration

Answer

Detective control such as log monitoring

Question 6

A financial institution is identifying IT risks associated with a new mobile banking application. Which TWO threat modeling techniques are best suited for this scenario? (Select two.)

Accepted Answer

STRIDE. STRIDE is ideal for application threat modeling, and PASTA provides a risk-centric approach for critical applications.

Answer

VAST

Answer

TRIKE

Answer

OWASP Top 10

Question 7

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 8

When developing realistic risk scenarios, which THREE components are essential according to the ISACA risk scenario template?

Accepted Answer

Threat actor. The ISACA risk scenario template includes threat actor, threat event, and asset/resource as essential components. Timing, detection, and response are also included but are not always considered essential for the basic scenario.

Answer

Mitigation cost

Answer

Detection speed

Question 9

An organization is designing an IT risk management programme. Which of the following is the most critical component to ensure consistent identification and assessment of risks across the enterprise?

Accepted Answer

Risk assessment methodology. A standardized risk assessment methodology is essential for consistent identification and assessment of risks across the enterprise.

Answer

Risk treatment process

Answer

Risk management policy

Answer

Risk register

Question 10

A Key Risk Indicator (KRI) that shows a rising trend in the average time to apply critical security patches suggests:

Accepted Answer

Increasing risk of exploitation. Patch lag is a leading indicator that vulnerability risk is increasing because unpatched systems are more exposed to exploits.

Answer

Decreasing risk of exploitation

Answer

Stable risk level

Answer

Improved control effectiveness

Question 11

In IT risk reporting, which level of management typically receives operational risk reporting on a weekly or monthly basis?

Accepted Answer

IT management. Operational risk reporting is detailed and frequent, intended for IT management who oversee day-to-day operations.

Answer

External auditors

Answer

Board of directors

Answer

CISO/CIO

Question 12

A company is evaluating control types for a new system. The security team proposes implementing an intrusion detection system (IDS) and a backup restoration process. Which TWO control types do these represent, respectively?

Accepted Answer

Detective. IDS detects ongoing attacks (detective), backup restoration helps recover after an incident (corrective).

Answer

Deterrent

Answer

Preventive

Answer

Compensating

Question 13

An organization's risk report shows a risk heat map with several risks in the high-likelihood, high-impact quadrant. What is the most appropriate action for the risk owner?

Accepted Answer

Evaluate current controls and consider additional treatment. Controls should be evaluated for effectiveness, and if inadequate, additional risk treatment options should be considered to reduce risk to an acceptable level.

Answer

Report to the board without any analysis

Answer

Ignore the risks as they are inherent

Answer

Accept the risk without further action

Question 14

A company is considering using a qualitative risk assessment approach to evaluate IT risks. Which TWO of the following are advantages of qualitative risk analysis over quantitative risk analysis?

Accepted Answer

Quick to perform. Qualitative analysis is quicker and easier to communicate because it uses ordinal scales (e.g., high/medium/low) rather than numerical data.

Answer

Easily comparable across organizations

Answer

Provides financially meaningful results

Answer

Objective and repeatable

Question 15

When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?

Accepted Answer

Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption. The correct approach is to map the technical scenario to specific business outcomes such as financial loss, regulatory penalties, or reputational damage, allowing management to understand the significance.

Answer

Assign a likelihood rating and an inherent risk score

Answer

Describe the technical steps of the attack in detail

Answer

Reference industry benchmarks for similar scenarios