CRISC Practice Test 20 — 15 Questions

Question 1

You are a risk analyst for a financial institution that uses a legacy mainframe system for core banking transactions. The mainframe is critical for daily operations, but it is no longer supported by the vendor. The system has known vulnerabilities that cannot be patched due to compatibility issues. The institution has a risk appetite that is very low for any disruption to core banking services. Recently, there was a minor outage caused by a hardware failure, which was resolved quickly, but it highlighted the system's fragility. The IT director proposes to migrate to a modern system, but the migration will take 2 years and cost $5 million. The board is concerned about the cost and timeline. You need to recommend an immediate risk treatment to reduce the likelihood of a major outage while the migration is underway. Which of the following is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement redundant hardware for critical components and conduct regular failover testing.. Implementing redundant hardware for critical components and conducting regular failover testing directly reduces the likelihood of a major outage by addressing the single point of failure exposed by the recent hardware failure. This is an immediate risk treatment that does not depend on the 2-year migration timeline, and it aligns with the institution's very low risk appetite for core banking disruption.

Answer

Accept the risk because the migration plan is in place.

Answer

Negotiate with the vendor for extended support.

Answer

Purchase business interruption insurance to cover potential losses.

Question 2

When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?

Accepted Answer

Spoofing. Spoofing in STRIDE refers to impersonating something or someone else to gain unauthorized access, such as using stolen credentials.

Answer

Repudiation

Answer

Information Disclosure

Answer

Tampering

Question 3

Which of the following threat actors is MOST likely to be motivated by financial gain and possess moderate to high technical capabilities?

Accepted Answer

Organized crime. Organized crime groups are primarily motivated by financial gain and often have sophisticated technical skills to carry out attacks such as ransomware, data theft, or fraud.

Answer

Hacktivist

Answer

Nation-state APT

Answer

Script kiddie

Question 4

Which of the following is a leading Key Risk Indicator (KRI) for the risk of a data breach?

Accepted Answer

Percentage of systems with unpatched critical vulnerabilities. A leading KRI predicts future risk events. The percentage of systems with unpatched critical vulnerabilities directly indicates an increasing attack surface and likelihood of exploitation, making it a leading indicator for a data breach. In contrast, lagging indicators like detection time or breach count measure past incidents.

Answer

Average time to detect a breach

Answer

Number of data breaches in the past quarter

Answer

Number of security incidents closed

Question 5

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Accepted Answer

Unauthorized access to patient medical records.. The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Answer

Denial of service due to excessive login attempts.

Answer

Insufficient encryption of data in transit.

Answer

Phishing attacks targeting portal users.

Question 6

You are the IT risk manager for a financial institution. During a routine vulnerability scan, you discover that a critical web application has a high-severity vulnerability that could allow remote code execution. The development team states that a patch is not yet available from the vendor, and the application is business-critical with no acceptable downtime. The risk owner wants to accept the risk. However, the organization's risk appetite is very low for security vulnerabilities. You have been asked to recommend a course of action. Which of the following should you recommend?

Accepted Answer

Implement a web application firewall (WAF) with virtual patching to reduce exploitability.. Implementing a web application firewall (WAF) with virtual patching provides an immediate, compensating control that reduces the exploitability of the vulnerability without requiring application downtime. This aligns with the organization's low risk appetite by actively mitigating the risk while waiting for an official vendor patch, rather than passively accepting it.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Decommission the application immediately.

Answer

Accept the risk as the team will monitor for patches.

Question 7

An organization uses a 5×5 risk heat map to assess IT risks. Which of the following is the PRIMARY advantage of this qualitative approach?

Accepted Answer

Quick and easy to communicate. A 5×5 risk heat map is a qualitative tool that plots likelihood against impact using ordinal scales, making it fast to produce and easy for executives and non-technical stakeholders to interpret at a glance. Its primary advantage is communication and speed, not quantitative precision.

Answer

Eliminates subjectivity in risk assessment

Answer

Provides comparable results across organizations

Answer

Produces financially meaningful results

Question 8

In a risk-aware culture, which of the following behaviors is MOST encouraged?

Accepted Answer

Reporting security incidents without fear of blame. In a risk-aware culture, the primary goal is to encourage transparency and continuous improvement in risk management. Reporting security incidents without fear of blame (Option D) is most encouraged because it enables timely detection, analysis, and remediation of threats, directly supporting the Risk Response and Reporting domain by fostering an environment where incidents are escalated promptly rather than concealed.

Answer

Focusing only on compliance requirements

Answer

Assigning blame to individuals for security breaches

Answer

Hiding minor incidents to maintain performance metrics

Question 9

A healthcare organization is migrating its electronic health records (EHR) system to a cloud provider. The risk assessment shows that the cloud provider has strong security certifications (e.g., SOC 2 Type II, ISO 27001). However, the organization's legal team is concerned about data sovereignty laws that require patient data to remain within the country. The cloud provider's data centers are located in three regions: one in-country, and two outside. The project manager proposes using only the in-country data center. The IT director warns that this will increase latency and reduce redundancy. The risk manager must propose a response. Which is the BEST option?

Accepted Answer

Configure the EHR system to store primary data in the in-country data center, and use the other two centers for disaster recovery with data residency controls ensuring data does not leave the country unless encrypted and with legal approval.. It balances compliance with data sovereignty laws (using the in-country data center for primary storage) and maintains redundancy for disaster recovery with data residency controls. Option A is wrong because simply accepting the legal risk based on certifications is not sufficient; data sovereignty laws are regulatory requirements that must be adhered to, and the certifications do not override those laws. Option B is wrong because automatic failover to data centers outside the country would violate data sovereignty laws by allowing patient data to leave the country without proper controls. Option D is wrong because using only one data center increases availability risk and does not address the legal concerns properly; it avoids the legal risk but introduces high operational risk.

Answer

Accept the legal risk because the cloud provider's certifications are sufficient, and document the decision.

Answer

Use all three data centers with automatic failover, and rely on the cloud provider's contractual guarantees of data residency.

Answer

Use only the in-country data center and accept the increased availability risk.

Question 10

A risk manager is evaluating the potential impact of quantum computing on the organization's encryption infrastructure. The organization uses RSA-2048 for key exchanges and digital signatures. According to current quantum computing projections, what is the MOST urgent risk management action to take?

Accepted Answer

Begin a cryptographic inventory and develop a migration plan to post-quantum cryptography. Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

Answer

Immediately replace all RSA-2048 keys with symmetric encryption

Answer

Purchase cyber insurance to cover potential losses from quantum attacks

Answer

Increase the RSA key length to 4096 bits

Question 11

A financial institution is implementing a new risk monitoring tool that aggregates data from multiple sources. The tool is expected to provide real-time dashboards for risk committees. However, during user acceptance testing, the dashboards show inconsistent data due to time zone differences across sources. What is the best approach to resolve this?

Accepted Answer

Standardize all timestamps to Coordinated Universal Time (UTC) during data ingestion.. Standardizing all timestamps to Coordinated Universal Time (UTC) during data ingestion ensures a single, unambiguous reference point for all aggregated data. This eliminates the root cause of inconsistency—differing local time zones—at the point of data entry, allowing the real-time dashboards to display consistent, comparable metrics regardless of the source's geographic location. This approach aligns with the principle of normalizing data at the earliest stage of the data pipeline, which is a fundamental practice in risk monitoring and reporting.

Answer

Modify the dashboard to display each source's local time separately.

Answer

Ask each source to adjust their time zone to the corporate headquarters time zone.

Answer

Use the time zone of the majority of sources and convert others.

Question 12

Refer to the exhibit. What risk is introduced by this IAM policy?

Accepted Answer

Excessive permissions. The IAM policy grants `s3:*` actions on all S3 resources (`"Resource": "*"`), which allows any user or service assuming this role to perform any S3 operation, including deleting buckets, modifying permissions, or accessing all objects. This violates the principle of least privilege and introduces the risk of excessive permissions, as the policy does not restrict actions or resources to only what is necessary for the intended function.

Answer

Misconfigured encryption

Answer

Lack of logging

Answer

Weak authentication

Question 13

An organization is deploying a large number of IoT sensors in a smart building project. The sensors are from multiple vendors and some have limited firmware update capabilities. Which of the following risks should be the PRIMARY concern for the risk manager?

Accepted Answer

Inability to patch vulnerabilities in legacy IoT devices. IoT devices with limited or no firmware update capability represent an unpatched, persistent attack surface that cannot be remediated through normal vulnerability management — this is the primary risk because it is both high-likelihood and difficult to mitigate. Unlike interoperability or power issues, unpatchable firmware means known CVEs remain exploitable for the device's entire lifecycle, and IoT devices are frequently recruited into botnets (e.g., Mirai). For a risk manager, the inability to patch is the foundational risk that amplifies all others.

Answer

Data sovereignty of sensor data stored in the cloud

Answer

Interoperability issues between different sensor protocols

Answer

High energy consumption of sensors

Question 14

During a quantitative risk analysis, the risk practitioner determines that the single loss expectancy (SLE) for a ransomware attack is $500,000 and the annualized rate of occurrence (ARO) is 0.4. The organization has a risk appetite that accepts annual losses up to $150,000. What is the recommended action?

Accepted Answer

Implement controls to reduce the likelihood or impact until ALE is below $150,000. The annualized loss expectancy (ALE) is SLE × ARO = $500,000 × 0.4 = $200,000, which exceeds the organization's risk appetite of $150,000. Since the risk is above appetite, the recommended action is to implement controls that reduce likelihood or impact until the ALE falls below the $150,000 threshold, aligning residual risk with appetite.

Answer

Purchase insurance to cover the potential loss

Answer

Accept the risk because it is within the organization's risk appetite

Answer

Reassess using qualitative analysis because the ARO is not precise

Question 15

A key control indicator (KCI) for a critical access control shows a deficiency rate of 12% for the quarter, exceeding the target of 5%. Which of the following should be the risk practitioner's PRIMARY action?

Accepted Answer

Investigate root causes of the high deficiency rate. The primary action is to investigate root causes because a KCI deficiency rate of 12% against a 5% target indicates a systemic control failure. Without understanding why the access control is failing (e.g., misconfigured role-based access control (RBAC) rules, stale user entitlements, or bypassed multi-factor authentication), any subsequent remediation may be ineffective. Root cause analysis ensures the risk practitioner addresses the underlying issue rather than applying a superficial fix.

Answer

Escalate the deficiency to the board immediately

Answer

Implement compensating controls to reduce risk

Answer

Increase the frequency of control testing