CRISC Practice Test 2 — 10 Questions

Question 1

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 2

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 3

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 4

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 5

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. Service accounts should authenticate using non-replayable methods like certificates or managed service accounts (gMSA) rather than static passwords. A password-based authentication for a privileged service account, especially after a series of failed logins, indicates a high risk of credential compromise and lateral movement, making this the most significant finding from a risk monitoring perspective.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

Question 6

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Accepted Answer

Investigate the KRI calculation methodology. The KRI showing green while the underlying control has a high failure rate indicates a misalignment between the KRI and the actual control effectiveness. The first step is to investigate the KRI calculation methodology to determine if the KRI is measuring the wrong metric, using stale data, or has an incorrect threshold. Only after understanding why the KRI is misleading can the risk manager take appropriate corrective action.

Answer

Escalate to the risk committee

Answer

Change the KRI threshold to amber

Answer

Re-test the control

Question 7

Which TWO of the following are examples of control monitoring activities?

Accepted Answer

Periodic manual testing of a sample of transactions for compliance with approval policy.. A is correct because periodic manual testing of a sample of transactions is a classic detective control monitoring activity. It involves directly verifying that the control (approval policy) is operating effectively by examining actual evidence (transactions) after the fact. This is a direct, substantive test of control effectiveness, not a design or reporting activity.

Answer

Assigning owners to each control in the control framework.

Answer

Reporting key risk indicator values to the risk committee.

Answer

Updating the risk register based on control test results.

Question 8

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 9

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning

Question 10

An external audit finds that a control is not operating as designed. The auditor recommends corrective action. What should the risk practitioner do FIRST?

Accepted Answer

Assess the impact of the control deficiency on residual risk. The risk practitioner must first assess the impact of the control deficiency on residual risk because the finding may not represent a material risk to the organization. Without understanding the severity and likelihood of the risk, any remediation or reporting could be misprioritized. This aligns with the CRISC framework's emphasis on risk-based decision-making before action.

Answer

Implement the auditor's recommendation immediately

Answer

Develop a remediation plan with the control owner

Answer

Update the risk register with the auditor's finding