CRISC Practice Test 17 — 15 Questions

Question 1

Which of the following is the PRIMARY source for identifying known software vulnerabilities in a systematic manner?

Accepted Answer

National Vulnerability Database (NVD). The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, built upon the CVE (Common Vulnerabilities and Exposures) list. It provides a systematic, structured, and continuously updated source of known software vulnerabilities, including CVSS scores, CWE classifications, and affected product configurations. For CRISC, it is the authoritative primary source for identifying vulnerabilities in a repeatable, comprehensive manner, unlike the other options which are either not vulnerability databases or not systematic.

Answer

OSINT feeds from social media

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 2

Which TWO of the following are key functions of an Architecture Review Board (ARB) in managing risk?

Accepted Answer

Reviewing solution architectures for security risks before implementation. A primary function of an Architecture Review Board (ARB) is to evaluate solution architectures for security risks prior to implementation. This proactive review ensures that security controls are embedded in the design phase, reducing the likelihood of vulnerabilities being introduced into production systems.

Answer

Managing user access controls

Answer

Performing daily vulnerability scans

Answer

Responding to security incidents

Question 3

A manufacturing company uses an industrial control system (ICS) that is connected to the corporate network for monitoring. The risk manager is identifying risks related to this connectivity. Which of the following is the MOST significant risk?

Accepted Answer

Compromise of ICS causing physical damage to manufacturing equipment.. The most significant risk is that a compromise of the ICS could lead to physical damage, such as equipment destruction, safety hazards, or environmental release. Unlike IT systems where data loss is the primary concern, ICS failures directly impact the physical world, making safety and operational integrity the top priority in risk identification.

Answer

Malware infection spreading from corporate to ICS network.

Answer

Network congestion due to ICS traffic affecting corporate users.

Answer

Unauthorized access to corporate data through the ICS connection.

Question 4

Which type of control is designed to operate before an event to prevent an undesirable outcome?

Accepted Answer

Preventive control. A preventive control is designed to operate before an event to stop an undesirable outcome from occurring. In risk management, this includes measures such as firewalls blocking unauthorized traffic before it reaches the internal network, or access control lists (ACLs) preventing unauthorized users from reading sensitive files. These controls proactively enforce security policies to reduce the likelihood of a risk event.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 5

Match each risk management term to its definition.

Accepted Answer

Risk: The effect of uncertainty on objectives.. The correct matches are Risk with 'effect of uncertainty on objectives', Threat with 'circumstance/event that can adversely impact', and Vulnerability with 'weakness that can be exploited'. Common confusions include swapping definitions between these terms.

Answer

Risk: A weakness that could be exploited.

Answer

Threat: The effect of uncertainty on objectives.

Answer

Vulnerability: Any circumstance or event with potential to adversely impact.

Question 6

Which TWO of the following are examples of continuous monitoring activities? (Select TWO.)

Accepted Answer

Continuous vulnerability scanning. Continuous vulnerability scanning (A) is correct because it runs on an ongoing, automated schedule to detect new weaknesses as they emerge, which is the defining characteristic of a continuous monitoring activity. Automated SIEM rule-based alerts for suspicious activity (D) is also correct because SIEM correlation rules evaluate event streams in real time and generate alerts continuously, providing ongoing detection rather than point-in-time assessment. By contrast, annual penetration testing (B) and quarterly user access reviews (C) are periodic, scheduled point-in-time activities, and monthly review of audit logs (E) is a recurring but interval-based manual review, so none of these qualify as continuous monitoring.

Answer

Annual penetration testing

Answer

Quarterly user access reviews

Answer

Monthly review of audit logs

Question 7

During a risk assessment, a risk manager is evaluating the effectiveness of a firewall rule set. The manager notes that the firewall logs show a high number of dropped packets from a specific IP range, but no policy changes have been made. The manager suspects the firewall rule set may be misconfigured. Which of the following should the manager do FIRST?

Accepted Answer

Review the change management records for the firewall.. The first step when a misconfiguration is suspected without any known policy changes is to verify the change management records. This ensures that any recent modifications to the firewall rule set are accounted for, ruling out unauthorized or undocumented changes before proceeding with more invasive actions like penetration testing or blocking IP ranges.

Answer

Conduct a penetration test on the firewall.

Answer

Immediately block the IP range.

Answer

Update the risk register with a new risk.

Question 8

An organization is implementing a quantitative risk assessment for its customer database. Which TWO elements are essential for calculating the annualized loss expectancy (ALE)?

Accepted Answer

Annualized rate of occurrence (ARO). The ALE formula is ALE = SLE × ARO, where SLE (single loss expectancy) = AV × EF (exposure factor). Option A, annualized rate of occurrence (ARO), is essential because it estimates how many times per year a threat is expected to materialize, directly multiplying the per-incident loss. Option C, asset value (AV), is essential because it feeds into the SLE calculation (AV × EF), representing the monetary worth of the customer database being protected. Control effectiveness rating (B) is not part of the ALE formula; it may inform residual risk but is not a required input. Inherent risk score (D) is a qualitative/derived measure, not a component of ALE. Risk appetite threshold (E) is a governance tolerance used to compare against risk, not a calculation input for ALE.

Answer

Control effectiveness rating

Answer

Inherent risk score

Answer

Risk appetite threshold

Question 9

A risk manager is identifying risks for a new mobile payment application. The application will use end-to-end encryption. Which of the following is the BEST source of risk information for identifying potential threats?

Accepted Answer

Threat intelligence feeds specific to the financial services sector. Threat intelligence feeds specific to the financial services sector provide real-time, contextualized information about emerging threats, attack patterns, and vulnerabilities targeting mobile payment systems. Since the application uses end-to-end encryption, the risk manager needs to identify threats that could bypass or undermine encryption (e.g., side-channel attacks, key interception, or man-in-the-middle attacks on the handshake), which generic or historical sources would not capture. This source is the best because it is current, sector-specific, and directly relevant to the technology stack.

Answer

Industry benchmark risk assessments from similar organizations

Answer

Previous internal audit reports on legacy applications

Answer

Vendor-provided security white papers for the encryption product

Question 10

An organization is implementing a third-party risk management program. Which TWO are essential components of the initial vendor risk assessment process?

Accepted Answer

Security questionnaires. Security questionnaires (A) are essential because they elicit the vendor's self-reported controls, data handling practices, and security posture directly from the vendor, forming the foundational data-gathering step of an initial risk assessment. Reviewing a SOC 2 Type II report (C) is also essential because it provides independent auditor attestation that the vendor's controls operated effectively over a period (typically 6–12 months), validating the claims made in questionnaires. Contract compliance review (B) is a legal/procurement activity that occurs around contracting rather than being a core initial risk-assessment component. Quarterly vulnerability scans of vendor networks (D) are not feasible or appropriate at the initial assessment stage and typically cannot be performed against third-party infrastructure without authorization. Annual reassessment (E) is a recurring post-onboarding activity, not part of the initial vendor risk assessment.

Answer

Contract compliance review

Answer

Quarterly vulnerability scans of vendor networks

Answer

Annual reassessment

Question 11

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Accepted Answer

The sensitivity and volume of data the vendor will access.. The sensitivity and volume of data directly determine the potential impact of a breach, which is a core component of inherent risk. Even with strong controls like ISO 27001, the risk level is primarily driven by the value and quantity of the asset at risk (customer data). In IT risk assessment, the asset's criticality and exposure outweigh historical or certification-based indicators when calculating residual risk.

Answer

The vendor's years in operation.

Answer

The vendor's ISO 27001 certification.

Answer

The contractual terms for data protection.

Question 12

Which risk assessment method uses a matrix to plot likelihood and impact to determine risk level?

Accepted Answer

Qualitative. The qualitative risk assessment method uses a matrix to plot likelihood and impact, typically with ordinal scales (e.g., high, medium, low) to derive a risk level. This approach is subjective and relies on expert judgment rather than numerical values, making it distinct from quantitative methods.

Answer

Delphi technique

Answer

Annual loss expectancy

Answer

Quantitative

Question 13

A risk assessment for a cloud migration project identifies that the cloud provider does not support encryption keys managed by the customer. Which of the following risk scenarios is MOST directly related to this finding?

Accepted Answer

Unauthorized access by cloud provider employees. When the cloud provider does not support customer-managed encryption keys, the provider retains control over the key material. This means that provider employees with administrative access to the key management system could potentially decrypt and access customer data, leading to unauthorized access. This directly creates a risk scenario of unauthorized access by cloud provider employees, as the customer loses the ability to enforce separation of duties and key sovereignty.

Answer

Service availability disruption

Answer

Data loss due to misconfiguration

Answer

Non-compliance with data residency requirements

Question 14

During a review, a risk practitioner discovers that a key control for a high-risk process is not operating effectively. The risk owner is reluctant to invest in additional controls due to budget constraints. What should the risk practitioner do FIRST?

Accepted Answer

Communicate the risk exposure to senior management. The risk practitioner's primary duty is to ensure that senior management is aware of material risk exposures that could impact business objectives. When a key control for a high-risk process is ineffective and the risk owner refuses to remediate due to budget constraints, the practitioner must communicate the residual risk exposure to senior management, who have the authority to allocate resources and make strategic risk acceptance decisions. This aligns with the CRISC framework's emphasis on escalating risk information to the appropriate decision-making level when the risk owner's response is inadequate.

Answer

Accept the risk owner's decision

Answer

Document the deficiency and move on

Answer

Escalate directly to the board

Question 15

An organization is implementing a control to prevent unauthorized access to its critical database. The control must be designed to block access attempts in real time. Which type of control should be selected?

Accepted Answer

Preventive control. A preventive control is designed to block unauthorized access attempts in real time before they reach the critical database. Technologies such as a database firewall or network access control list (ACL) evaluate each request against a policy and drop the packet or terminate the session immediately, preventing the access from occurring. This aligns with the requirement for real-time blocking, which is the defining characteristic of a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Compensating control