CRISC Practice Test 19 — 15 Questions

Question 1

A financial institution uses a quantitative risk assessment for a core banking system. The annual loss expectancy (ALE) is calculated as $500,000 with a single loss expectancy (SLE) of $2,500,000. What is the annualized rate of occurrence (ARO)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

0.2. The annualized rate of occurrence (ARO) is derived from the formula ALE = SLE × ARO. Given ALE = $500,000 and SLE = $2,500,000, solving for ARO yields $500,000 / $2,500,000 = 0.2. This means the core banking system is expected to experience a loss event once every five years on average.

Answer

5.0

Answer

2.0

Answer

0.5

Question 2

Which TWO outcomes indicate that a risk assessment process is effective?

Accepted Answer

Risk treatment decisions are based on clear, prioritized findings.. Option B is correct because an effective risk assessment must produce clear, prioritized findings that directly drive risk treatment decisions — prioritization based on likelihood and impact is the core purpose of the process, and if decisions are not traceable to those findings, the assessment is not functioning. Option C is correct because consistently keeping residual risk (the risk remaining after treatment) below the organization's defined risk appetite demonstrates that the assessment and subsequent treatment are actually reducing risk to a tolerable level, which is the measurable goal of risk management. Option A is not correct because identifying 'all' potential risks is neither realistic nor required; risk assessment is iterative and aims to identify relevant, material risks, not achieve completeness. Option D is not correct because the absence of negative events may reflect luck or effective controls rather than a sound assessment process, and zero incidents is not a valid effectiveness metric. Option E is not correct because compliance with standards is a separate objective from risk assessment effectiveness; an organization can be compliant yet still have poorly prioritized or unmanaged risks.

Answer

All potential risks have been identified.

Answer

No negative risk events occur after the assessment.

Answer

The organization achieves full compliance with security standards.

Question 3

During a risk assessment, the risk practitioner discovers that a critical database does not have an active failover solution. The database is used by multiple business applications. Which of the following factors should be given the HIGHEST weight when determining the inherent risk level?

Accepted Answer

The criticality of the database to business operations. The inherent risk level is determined by the potential impact and likelihood of a threat exploiting a vulnerability, without considering controls. The criticality of the database to business operations directly drives the impact severity—if the database fails, multiple business applications could be disrupted, leading to significant operational and financial damage. This makes option A the highest-weighted factor because it defines the worst-case consequence, which is the foundation of inherent risk.

Answer

The number of existing compensating controls

Answer

The frequency of vulnerability scans

Answer

The cost to restore the database from backup

Question 4

An organization is integrating its IT risk program with the enterprise risk management (ERM) framework. Which THREE of the following activities support this integration?

Accepted Answer

Using consistent risk metrics and terminology across IT and enterprise levels. Option A is correct because using consistent risk metrics and terminology across IT and enterprise levels enables IT risk data to be aggregated, compared, and communicated within the ERM framework rather than being siloed in IT-specific language. Option B is correct because aligning IT risk appetite with enterprise risk appetite ensures IT risk tolerances and thresholds are derived from and consistent with the organization's overall risk appetite, which is a core requirement of ERM integration. Option C is correct because reporting IT risk as a component of broader operational risk allows IT risk to be consolidated into enterprise risk reporting, giving leadership a holistic view of risk exposure. Option D does not belong because maintaining a separate IT risk register not shared with ERM perpetuates silos and prevents aggregation and enterprise-level visibility. Option E does not belong because reporting IT risks only to the CIO without board visibility excludes key governance stakeholders and contradicts the top-down, board-engaged nature of ERM integration.

Answer

Maintaining a separate IT risk register not shared with ERM

Answer

Reporting IT risks only to the CIO without board visibility

Question 5

After a security incident, an organization discovers that a critical database was accessed by an unauthorized user due to weak authentication controls. As part of the IT risk assessment process, which step should have identified this vulnerability?

Accepted Answer

Risk identification. Risk identification is the step in the IT risk assessment process where potential vulnerabilities, such as weak authentication controls, are systematically discovered and documented. In this scenario, the weak authentication that allowed unauthorized database access should have been identified during risk identification, which involves cataloging assets, threats, and existing controls. This step precedes any treatment, monitoring, or evaluation activities.

Answer

Risk treatment

Answer

Risk monitoring

Answer

Risk evaluation

Question 6

A company uses a third-party vendor to process customer data. The vendor's security control monitoring reports show no issues. However, the company's internal monitoring detects anomalies in vendor response times. What is the BEST interpretation?

Accepted Answer

The anomalies may indicate a control gap in the vendor's environment.. The discrepancy between the vendor's security monitoring reports (showing no issues) and the company's internal monitoring (detecting anomalies in response times) suggests a potential control gap in the vendor's environment. Response time anomalies can indicate underlying security issues such as resource exhaustion, data exfiltration, or compromised systems that the vendor's monitoring may not be capturing. This misalignment warrants further investigation rather than dismissal.

Answer

The vendor's monitoring is accurate; the anomalies are false positives.

Answer

The internal monitoring should be disabled to avoid confusion.

Answer

The vendor's monitoring is more reliable than internal monitoring.

Question 7

A company is adopting a DevSecOps approach and wants to conduct threat modeling early in the development lifecycle. Which threat modeling methodology is BEST suited for this environment due to its focus on agile and continuous integration?

Accepted Answer

VAST. VAST (Visual, Agile, and Simple Threat modeling) is the only methodology explicitly designed for agile and DevSecOps environments, integrating threat modeling into CI/CD pipelines and scaling across large development teams. It uses two model types — application threat models for developers and operational threat models for infrastructure — making it suitable for continuous delivery. This agile-native design is why VAST is the best fit when threat modeling must occur early and iteratively in the SDLC.

Answer

TRIKE

Answer

STRIDE

Answer

PASTA

Question 8

A third-party vendor is classified as high risk due to its access to sensitive data. Which THREE activities should be part of ongoing monitoring for this vendor?

Accepted Answer

Contract compliance reviews to ensure terms are met.. Option A is correct because ongoing monitoring for a high-risk vendor must include contract compliance reviews, which verify that the vendor continues to meet agreed security, privacy, and service-level terms throughout the relationship, not just at signing. Option C is correct because continuous monitoring via shared threat intelligence platforms provides real-time visibility into emerging threats, indicators of compromise, and the vendor's security posture, which is essential for a vendor with access to sensitive data. Option D is correct because annual reassessment of the vendor's security posture is a recurring due-diligence activity that re-evaluates controls, risk ratings, and changes in the vendor's environment over time. Option B is not part of ongoing monitoring because requiring SOC 2 Type II certification is a pre-contract due-diligence step performed before signing, not a continuous monitoring activity. Option E is also not ongoing monitoring because the initial onboarding security questionnaire review occurs only at the start of the relationship and does not provide continuous oversight.

Answer

Requiring SOC 2 Type II certification before contract signing.

Answer

Initial onboarding security questionnaire review.

Question 9

An organization has recently suffered a ransomware attack that encrypted critical files. During the post-incident review, the risk team is identifying key risk indicators (KRIs) to improve early detection. Which of the following KRIs would be MOST effective in detecting similar attacks in the future?

Accepted Answer

Number of unauthorized remote access attempts.. A KRI must be a measurable, leading indicator that provides early warning of an emerging risk. A spike in unauthorized remote access attempts is a direct precursor to ransomware intrusion (which typically begins with credential abuse or RDP exploitation), so monitoring this metric can trigger early detection before encryption occurs. It is behavioral, actionable, and tied to the attack chain.

Answer

Frequency of antivirus signature updates.

Answer

Percentage of employees who completed security awareness training.

Answer

Time to patch critical vulnerabilities.

Question 10

When implementing a new access control system, which activity is essential during the change management process?

Accepted Answer

Updating the system documentation and user manuals. Updating system documentation and user manuals is essential during change management because it ensures that the new access control system is accurately reflected in operational procedures, training materials, and compliance artifacts. Without updated documentation, users and auditors operate on stale information, leading to misconfigurations and audit findings. Documentation is a key change management deliverable that supports knowledge transfer and ongoing control effectiveness.

Answer

Removing all legacy controls

Answer

Assigning control ownership to external vendors

Answer

Disabling audit logs to save storage

Question 11

A large e-commerce company is assessing the risk of a distributed denial-of-service (DDoS) attack on its web applications. The company has experienced three DDoS attacks in the past year, each causing significant downtime and revenue loss. The current mitigation strategy relies on an on-premise appliance that can handle up to 10 Gbps of attack traffic. Recent industry reports indicate that DDoS attacks are growing in volume and sophistication, with some exceeding 100 Gbps. The company's risk appetite for availability is moderate. The security team has proposed migrating to a cloud-based DDoS protection service that scales to 200 Gbps, but it will increase annual operational costs by 40%. The business is concerned about the cost increase. Which of the following is the BEST risk treatment decision?

Accepted Answer

Reduce the risk by implementing the cloud-based DDoS protection service, accepting the cost increase.. The current on-premise appliance (10 Gbps capacity) is insufficient against modern DDoS attacks that can exceed 100 Gbps, as noted in industry reports. Migrating to a cloud-based DDoS protection service that scales to 200 Gbps directly reduces the risk to a level aligned with the company's moderate risk appetite for availability, despite the 40% cost increase. The business concern about cost is secondary to the necessity of mitigating a risk that could cause catastrophic revenue loss, and the cloud service provides elastic scalability that an on-premise upgrade cannot match.

Answer

Transfer the risk by purchasing business interruption insurance that covers revenue loss during outages.

Answer

Accept the risk because the company has survived previous attacks and the cost of mitigation is high.

Answer

Reduce the risk by upgrading the on-premise appliance to handle up to 50 Gbps, which is within budget.

Question 12

A company has identified a risk of data breach due to weak encryption. The current controls include encryption at rest but not in transit. The risk assessment team calculates inherent risk as high and residual risk as high. What should the team recommend FIRST?

Accepted Answer

Implement encryption in transit to reduce likelihood. The risk assessment team should first recommend implementing encryption in transit because the current controls only address data at rest, leaving data vulnerable during transmission. Since both inherent and residual risks are high, the most direct and effective control to reduce likelihood is to apply a technical safeguard like TLS 1.3 for data in transit, which directly addresses the identified gap.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing data transmission

Answer

Accept the risk because it is already high

Question 13

Which of the following is an example of a leading Key Risk Indicator (KRI) for IT risk?

Accepted Answer

Percentage of systems with missing critical patches. A leading Key Risk Indicator (KRI) predicts future risk events by measuring conditions that precede incidents. Missing critical patches on systems directly indicate a higher likelihood of exploitation, making it a leading indicator. In contrast, lagging KRIs like incident counts or costs measure outcomes after the fact.

Answer

Number of audit findings resolved

Answer

Number of security incidents this quarter

Answer

Total cost of security incidents

Question 14

Which TWO of the following are examples of corrective controls?

Accepted Answer

Disaster recovery plan execution. Disaster recovery plan execution (B) is a corrective control because it is activated after a disruptive event to restore normal operations. It directly addresses the impact of an incident by executing predefined procedures to recover systems and data, thereby correcting the damage caused by the outage or disaster.

Answer

Encryption of data at rest

Answer

Intrusion detection system

Answer

Access control lists

Question 15

When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?

Accepted Answer

Better alignment of IT risk with business objectives. Integrating IT risk into ERM ensures that IT risk decisions are directly linked to business strategy and objectives, enabling leadership to prioritize risks that could impact critical business outcomes. This alignment is the primary benefit because it transforms IT risk from a technical concern into a strategic business driver, facilitating better resource allocation and governance.

Answer

Improved compliance with IT standards

Answer

Reduced IT operational costs

Answer

Increased frequency of risk assessments