CRISC Practice Test 16 — 15 Questions

Question 1

In the context of IT risk reporting to the board, which THREE elements should be included to effectively communicate risk?

Accepted Answer

Top risks and status. A risk heat map, top risks and status, and risk trend analysis help the board understand the current and evolving risk landscape.

Answer

Detailed technical logs

Answer

Employee performance reviews

Question 2

An organization is conducting a threat identification exercise using the STRIDE model. Which threat type would be MOST relevant when analyzing a banking application that allows fund transfers between accounts?

Accepted Answer

Tampering. STRIDE includes: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Tampering is the unauthorized modification of data, directly relevant to fund transfers where transaction amounts or destinations could be altered.

Answer

Repudiation

Answer

Spoofing

Answer

Information Disclosure

Question 3

A risk scenario is being developed for a phishing attack leading to credential theft. Using ISACA's risk scenario template, which component would describe the 'threat event'?

Accepted Answer

A user clicks a malicious link in a phishing email. The threat event is the action that triggers the risk scenario. In this case, 'A user clicks a malicious link in a phishing email' is the event that leads to the compromise.

Answer

The organization's email security filter fails to block the phishing email

Answer

The attacker is an organized crime group based overseas

Answer

The compromised credentials are used to access a financial system

Question 4

A company calculates the annualized loss expectancy (ALE) for a server failure as $150,000. After implementing a backup solution costing $20,000 per year, the ALE drops to $30,000. What is the annualized benefit of the control?

Accepted Answer

$100,000. Annualized benefit = reduction in ALE - annual control cost. Reduction in ALE = $150k - $30k = $120k. Benefit = $120k - $20k = $100k.

Answer

$130,000

Answer

$120,000

Answer

$20,000

Question 5

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Accepted Answer

A new cloud service may inadvertently expose customer PII due to misconfiguration. Given the low tolerance for compliance risk, any potential compliance violation (like PII exposure) must be escalated immediately, even if operational risk is moderate.

Answer

A planned system upgrade may cause two hours of downtime during maintenance window

Answer

A vendor is late in delivering a software patch for a low-severity bug

Answer

An employee mistakenly deletes a non-critical test database

Question 6

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. Compliance risk involves violations of laws, regulations, or contractual obligations.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 7

An organization has a risk register that includes risks related to regulatory compliance, such as GDPR and SOX. The risk practitioner is now categorizing these risks. Which risk category would BEST fit these compliance-related risks?

Accepted Answer

Compliance risk. Compliance risks refer to risks associated with violations of laws, regulations, or contractual obligations. GDPR and SOX are regulatory requirements, so they fall under compliance risk.

Answer

Financial risk

Answer

Operational risk

Answer

Strategic risk

Question 8

An organization is assessing control effectiveness for a firewall. Which THREE factors should be evaluated to determine control effectiveness? (Select THREE)

Accepted Answer

Design adequacy of the firewall rules. Control effectiveness is a combination of design adequacy and operating effectiveness. Additionally, the control's ability to address the specific risk (relevance) is important. Frequency alone does not determine effectiveness.

Answer

Cost of the firewall

Answer

Frequency of rule updates

Question 9

A financial services firm uses SAST and DAST tools in its application security testing. However, they are struggling to prioritize vulnerabilities from the large number of findings. Which additional technique would BEST help identify the most critical vulnerabilities in the context of business risk?

Accepted Answer

IAST (Interactive Application Security Testing). IAST combines SAST and DAST with runtime analysis to pinpoint vulnerabilities that are actually exploitable in the running application, reducing false positives and focusing on business-critical issues.

Answer

OWASP ZAP automated scanner

Answer

Manual penetration testing

Answer

CVE database search

Question 10

An organization is performing a quantitative risk analysis using the FAIR framework. Which THREE of the following are direct components of the FAIR model?

Accepted Answer

Loss Event Frequency. FAIR components include Loss Event Frequency (LEF), Threat Event Frequency (TEF), Vulnerability, and Loss Magnitude. Annualized Loss Expectancy (ALE) is a derived metric, not a direct component. Single Loss Expectancy is a component of ALE but not a separate FAIR component.

Answer

Single Loss Expectancy

Answer

Annualized Loss Expectancy

Question 11

An organization's board has set a risk appetite statement that says: 'We accept moderate levels of operational risk but will not tolerate any compliance violations.' During risk identification, which type of risk should be given the HIGHEST priority?

Accepted Answer

Compliance risks. Given the zero-tolerance for compliance violations, compliance risks must be prioritized to ensure they are identified and managed accordingly.

Answer

Reputational risks

Answer

Operational risks

Answer

Strategic risks

Question 12

Which of the following BEST describes the difference between a threat actor who is a 'hacktivist' and one who is an 'organized crime' actor?

Accepted Answer

Hacktivists are motivated by ideology; organized crime actors are motivated by financial gain. Hacktivists are typically motivated by political or social causes, while organized crime groups are primarily financially motivated.

Answer

Hacktivists target only government entities; organized crime targets only businesses

Answer

Hacktivists are always insiders; organized crime actors are external

Answer

Hacktivists use advanced persistent threats (APTs); organized crime uses commodity malware

Question 13

During a vulnerability assessment, a risk practitioner identifies that a web application is vulnerable to SQL injection, which is listed in the OWASP Top 10. Which type of vulnerability identification technique MOST likely discovered this issue?

Accepted Answer

DAST (Dynamic Application Security Testing). DAST (Dynamic Application Security Testing) tests the running application for vulnerabilities like SQL injection by simulating attacks. SAST is static code analysis, IAST is interactive testing.

Answer

SAST (Static Application Security Testing)

Answer

CIS Benchmarks comparison

Answer

DISA STIG scanning

Question 14

A company is considering risk transfer for a new IT project. Which TWO options represent valid risk transfer mechanisms? (Select TWO)

Accepted Answer

Purchasing cyber insurance. Cyber insurance and outsourcing with contractual liability transfer are classic examples of risk transfer. Accepting, avoiding, and mitigating are not transfer.

Answer

Accepting the risk with sign-off

Answer

Implementing access controls

Answer

Discontinuing the project

Question 15

An organization is assessing control effectiveness for a key process. Which TWO aspects should be evaluated to determine if a control is effective?

Accepted Answer

Operating effectiveness. Control effectiveness is assessed based on design adequacy (whether the control is properly designed) and operating effectiveness (whether it works as intended).

Answer

Compliance with industry standards

Answer

Number of control owners

Answer

Cost of implementation