CRISC Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. What risk is introduced by this IAM policy?

Accepted Answer

Excessive permissions. The IAM policy grants `s3:*` actions on all S3 resources (`"Resource": "*"`), which allows any user or service assuming this role to perform any S3 operation, including deleting buckets, modifying permissions, or accessing all objects. This violates the principle of least privilege and introduces the risk of excessive permissions, as the policy does not restrict actions or resources to only what is necessary for the intended function.

Answer

Misconfigured encryption

Answer

Lack of logging

Answer

Weak authentication

Question 2

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Option B is correct because interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 3

A company plans to deploy an AI-based customer service chatbot that processes personal data. What risk should be identified as the highest priority?

Accepted Answer

Data privacy risk. Processing personal data through an AI chatbot directly introduces data privacy risk as the highest priority because the system will collect, store, and potentially expose sensitive information (e.g., names, contact details, payment data). Under regulations like GDPR or CCPA, any breach or unauthorized access to this data can result in severe fines and reputational damage. While other risks exist, privacy risk is immediate and fundamental to the chatbot's operation.

Answer

Vendor lock-in risk

Answer

Model accuracy risk

Answer

Regulatory compliance risk

Question 4

Which TWO of the following are primary sources of risk identification for IT projects?

Accepted Answer

Project documentation (e.g., scope, schedule, budget). Project documentation such as scope, schedule, and budget is a primary source of risk identification because it defines the project's boundaries, constraints, and deliverables. Analyzing these documents helps identify risks related to scope creep, unrealistic timelines, or insufficient funding that could impact IT project success.

Answer

Social media monitoring

Answer

Vendor marketing materials

Answer

Industry benchmark reports

Question 5

A security operations center (SOC) analyst notices multiple failed login attempts from an internal IP address followed by a successful login from an unusual geographic location. Which risk identification technique should the risk manager use to assess this as a potential risk?

Accepted Answer

Perform user and entity behavior analytics (UEBA) on the user account. Option A is correct because analyzing user behavior analytics (UBA) can identify anomalous patterns indicative of account compromise, turning an event into a risk. Option B is incorrect because a vulnerability scan does not detect behavioral anomalies. Option C is incorrect because a phishing simulation tests user awareness, not specific events. Option D is incorrect because log review alone may not contextualize the event as a risk without behavioral analysis.

Answer

Run a phishing simulation for the user

Answer

Review the logs manually for other indicators

Answer

Conduct a vulnerability scan on the workstation

Question 6

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Accepted Answer

An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.. Option C is the most appropriate risk scenario because it follows the standard risk scenario structure: threat (attacker), vulnerability (weak authentication), impact (unauthorized access, data exfiltration, regulatory fines, reputational damage). It directly ties the technical weakness to a business consequence, which is essential for communicating risk to stakeholders. The scenario is specific to the application's internet-facing nature and sensitive data processing, making it actionable for risk treatment.

Answer

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Answer

The application will implement multi-factor authentication to prevent unauthorized access.

Answer

The application must comply with PCI DSS requirements for data protection.

Question 7

Which THREE of the following are commonly used techniques for identifying IT risks in a large enterprise?

Accepted Answer

Brainstorming sessions. Options A, C, and D are correct. SWOT analysis (A) can identify risk-related strengths, weaknesses, opportunities, threats. Brainstorming (C) is a collaborative technique. Risk questionnaires (D) gather input from many stakeholders. Option B (Delphi technique) is used for consensus, not initial identification. Option E (cost-benefit analysis) is for evaluating controls, not identifying risks.

Answer

Cost-benefit analysis

Answer

Delphi technique

Question 8

After a data breach has been contained, what is the most important action for identifying underlying IT risks?

Accepted Answer

Perform a root cause analysis. Root cause analysis systematically identifies the weaknesses that allowed the breach, directly contributing to risk identification. Updating the risk register, implementing controls, and reviewing insurance are subsequent steps.

Answer

Update the risk register

Answer

Implement new security controls

Answer

Review cyber insurance policy

Question 9

A multinational organization uses a third-party vendor for cloud-based identity management. The vendor recently suffered a data breach that exposed user credentials. The risk manager is now re-evaluating the associated risk. Which of the following steps should the risk manager perform FIRST to identify potential new risks?

Accepted Answer

Update the risk register to include the new threat scenario of credential compromise via the vendor.. Option D is correct because updating the risk register with the new incident information is the first step to ensure all risks are captured. Option A (contract review) is important but secondary. Option B (penetration test) may be reactive but not immediate first step. Option C (access reviews) is a control, not risk identification.

Answer

Review the contract to determine if the vendor is liable for the breach.

Answer

Immediately revoke all vendor access to internal systems.

Answer

Conduct a penetration test of the organization's own systems.

Question 10

Refer to the exhibit. During a risk identification exercise for the internal network, the risk manager reviews this firewall log entry. Which of the following risks is MOST directly suggested by this log entry?

Accepted Answer

An attacker could use SMB to move laterally from a compromised workstation to the server.. The firewall log shows an inbound SMB connection (port 445) from a workstation (10.0.0.5) to a server (10.0.0.10). SMB is commonly used for file sharing and remote administration, and if the workstation is compromised, an attacker can leverage SMB to move laterally to the server, potentially gaining access to sensitive data or escalating privileges. This aligns with the risk of lateral movement, which is a primary concern in internal network segmentation.

Answer

Sensitive data is being exfiltrated via SMB.

Answer

The workstation may be accessing the internet via the server.

Answer

The organization is vulnerable to a distributed denial-of-service (DDoS) attack.

Question 11

An organization has recently suffered a ransomware attack that encrypted critical files. During the post-incident review, the risk team is identifying key risk indicators (KRIs) to improve early detection. Which of the following KRIs would be MOST effective in detecting similar attacks in the future?

Accepted Answer

Number of unauthorized remote access attempts.. Option A is correct because unauthorized remote access attempts are a direct indicator of potential ransomware vectors. Option B is important but not the most direct for detection. Option C is preventive, not detective. Option D is corrective.

Answer

Frequency of antivirus signature updates.

Answer

Percentage of employees who completed security awareness training.

Answer

Time to patch critical vulnerabilities.

Question 12

A company is conducting a Risk Identification for a new payment processing system. The team discovers that the system does not have encryption at rest. This is an example of:

Accepted Answer

Vulnerability. The absence of encryption at rest in a payment processing system is a weakness or flaw that can be exploited, making it a vulnerability. In risk identification, a vulnerability is a condition or weakness in an asset (e.g., database, storage volume) that, if exploited by a threat, could lead to a risk event. Here, the missing encryption at rest (e.g., AES-256 for stored cardholder data) is a specific security gap, not the threat itself or the resulting risk.

Answer

Control

Answer

Threat

Answer

Risk

Question 13

Which THREE of the following are effective risk identification techniques for a cloud migration project? (Select exactly THREE.)

Accepted Answer

Vendor lock-in analysis. Vendor lock-in analysis is an effective risk identification technique for cloud migration because it evaluates the dependency on a specific cloud provider's proprietary services, APIs, or data formats. Identifying this risk early allows the organization to plan for portability, avoid costly migration barriers, and negotiate exit strategies. Without this analysis, the project may face unexpected costs or technical constraints when attempting to switch providers or return to on-premises infrastructure.

Answer

User acceptance testing (UAT)

Answer

Network scanning of on-premises infrastructure

Question 14

Which THREE of the following are key indicators that a risk identification process is effective? (Choose three.)

Accepted Answer

The process covers all critical business processes. Option B is correct because an effective risk identification process must cover all critical business processes to ensure that risks are identified across the entire value chain. Without this coverage, significant risks in core operations could be missed, leading to incomplete risk assessments and potential business disruptions. This aligns with the CRISC focus on aligning IT risk management with business objectives.

Answer

The process identifies all known vulnerabilities

Answer

The process is completed within budget

Question 15

A risk manager is identifying risks for a new mobile payment application. The application will use end-to-end encryption. Which of the following is the BEST source of risk information for identifying potential threats?

Accepted Answer

Threat intelligence feeds specific to the financial services sector. Threat intelligence feeds specific to the financial services sector provide real-time, contextualized information about emerging threats, attack patterns, and vulnerabilities targeting mobile payment systems. Since the application uses end-to-end encryption, the risk manager needs to identify threats that could bypass or undermine encryption (e.g., side-channel attacks, key interception, or man-in-the-middle attacks on the handshake), which generic or historical sources would not capture. This source is the best because it is current, sector-specific, and directly relevant to the technology stack.

Answer

Industry benchmark risk assessments from similar organizations

Answer

Previous internal audit reports on legacy applications

Answer

Vendor-provided security white papers for the encryption product

CRISC Practice Test 17 — 15 Questions

Exhibit

CRISC Practice Test 17 — 15 Questions

Exhibit