CRISC Practice Test 2 — 10 Questions

Question 1

Arrange the steps for performing a vulnerability assessment.

Accepted Answer

Scope definition, then scanning, then analysis, then prioritization, then reporting. Vulnerability assessment starts with scope, scanning, analysis, prioritization, and reporting.

Answer

Scope definition, then scanning, then prioritization, then analysis, then reporting

Answer

Scanning, then scope definition, then analysis, then prioritization, then reporting

Answer

Scope definition, then analysis, then scanning, then prioritization, then reporting

Question 2

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 3

Sequence the steps for implementing a new control based on risk assessment findings.

Accepted Answer

Design the control, then Procure/Build the control, then Test the control, then Deploy the control, then Monitor the control.. Control implementation involves design, procurement/build, testing, deployment, and monitoring.

Answer

Procure/Build the control, then Design the control, then Test the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Test the control, then Procure/Build the control, then Deploy the control, then Monitor the control.

Answer

Design the control, then Procure/Build the control, then Deploy the control, then Test the control, then Monitor the control.

Question 4

In the context of IT governance, which COBIT 2019 process is specifically focused on ensuring risk optimization?

Accepted Answer

EDM03 — Ensure Risk Optimization. COBIT 2019's EDM03 — Ensure Risk Optimization is the governance process specifically focused on ensuring that IT-related risk is identified, assessed, and managed within the enterprise's risk appetite. It is part of the Evaluate, Direct, and Monitor (EDM) domain, which is the governance domain.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Question 5

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 6

Order the steps for implementing a risk treatment plan.

Accepted Answer

Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.. Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Answer

Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.

Answer

Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.

Answer

Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.

Question 7

During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require authenticated access. Which risk rating is most appropriate if the vulnerability has a CVSS base score of 9.0, but the application is behind a strong firewall and requires two-factor authentication?

Accepted Answer

Medium, after considering the compensating controls. The CVSS base score of 9.0 reflects the intrinsic severity of the vulnerability, but the final risk rating must incorporate compensating controls. The strong firewall and two-factor authentication (2FA) significantly reduce the likelihood of exploitation, as the attacker would need to bypass both network-level filtering and an additional authentication factor. In CRISC methodology, risk is a function of likelihood and impact; here, the controls lower the likelihood, resulting in a Medium residual risk rating despite the high base score.

Answer

Low, because the application requires authenticated access

Answer

High, because CVSS base score is 9.0

Answer

Very high, due to the criticality of the application

Question 8

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.

Question 9

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 10

A company is conducting an IT risk assessment for the first time. Which of the following should be the FIRST step?

Accepted Answer

Establish the risk assessment context. Before any risk assessment activities can begin, the organization must establish the context—defining the scope, risk appetite, criteria for risk evaluation, and the business objectives the assessment supports. Without this foundational step, subsequent identification of assets, threat analysis, or control implementation would lack alignment with business goals and could produce irrelevant or misleading results. This aligns with the ISACA Risk IT framework and the CRISC domain of IT Risk Assessment.

Answer

Identify all IT assets

Answer

Analyze the likelihood and impact of threats

Answer

Implement mitigating controls