CRISC Practice Exam 1 — 20 Questions

Question 1

During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require authenticated access. Which risk rating is most appropriate if the vulnerability has a CVSS base score of 9.0, but the application is behind a strong firewall and requires two-factor authentication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Medium, after considering the compensating controls. The CVSS base score of 9.0 reflects the intrinsic severity of the vulnerability, but the final risk rating must incorporate compensating controls. The strong firewall and two-factor authentication (2FA) significantly reduce the likelihood of exploitation, as the attacker would need to bypass both network-level filtering and an additional authentication factor. In CRISC methodology, risk is a function of likelihood and impact; here, the controls lower the likelihood, resulting in a Medium residual risk rating despite the high base score.

Answer

Low, because the application requires authenticated access

Answer

High, because CVSS base score is 9.0

Answer

Very high, due to the criticality of the application

Question 2

When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?

Accepted Answer

Better alignment of IT risk with business objectives. Integrating IT risk into ERM ensures that IT risk decisions are directly linked to business strategy and objectives, enabling leadership to prioritize risks that could impact critical business outcomes. This alignment is the primary benefit because it transforms IT risk from a technical concern into a strategic business driver, facilitating better resource allocation and governance.

Answer

Improved compliance with IT standards

Answer

Reduced IT operational costs

Answer

Increased frequency of risk assessments

Question 3

During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what is the minimum security requirement for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor because it provides an independent audit of controls over security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6–12 months). This aligns with the organization's risk appetite for sensitive customer data, as it offers more assurance than a point-in-time assessment or self-report.

Answer

Annual compliance attestation

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 4

A risk register is being updated after a quarterly risk assessment. One risk has decreased in likelihood due to new controls. However, the risk score remains unchanged because the impact increased. What should the risk practitioner do?

Accepted Answer

Recalculate the risk score using the new likelihood and impact values. The risk score is a function of both likelihood and impact. Even though new controls reduced likelihood, the increased impact means the overall risk level may remain unchanged. The correct action is to recalculate the risk score using the updated values to reflect the current risk posture accurately, as required by the risk assessment process.

Answer

Remove the risk from the register because it is under control

Answer

Automatically accept the risk because likelihood decreased

Answer

Escalate to senior management for a new risk treatment plan

Question 5

Which risk identification technique relies on analyzing past incidents to predict future risks?

Accepted Answer

Loss event data analysis. Loss event data analysis (B) is the correct risk identification technique because it systematically examines historical incident records, such as security logs, breach reports, and audit findings, to identify patterns and trends that can predict future risks. This empirical approach leverages past loss events to quantify likelihood and impact, making it distinct from generative or qualitative methods.

Answer

Brainstorming

Answer

SWOT analysis

Answer

Delphi technique

Question 6

A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of the following risk identification techniques should the risk manager use to understand the full extent of the risk?

Accepted Answer

Interview the business unit head about the application's use and data stored. Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Answer

Run an automated data discovery tool across the network

Answer

Request an independent audit of the SaaS provider

Answer

Review network logs to identify data transfers to the SaaS provider

Question 7

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 8

An organization is implementing a new cloud-based customer relationship management (CRM) system. The risk practitioner is designing the control monitoring plan. Which approach BEST ensures continuous monitoring of controls across both the application and infrastructure layers?

Accepted Answer

Deploy an automated monitoring tool that ingests audit logs from the CRM and cloud infrastructure APIs to trigger alerts on anomalies.. It establishes a continuous, automated monitoring feedback loop by ingesting audit logs from both the CRM application (e.g., user activity logs) and cloud infrastructure APIs (e.g., AWS CloudTrail, Azure Monitor). This approach enables real-time anomaly detection and alerting, which is essential for maintaining control effectiveness across the entire stack without manual intervention.

Answer

Implement a generic Security Information and Event Management (SIEM) system with standard rules.

Answer

Rely on the CRM vendor's SOC 2 Type II report for control assurance.

Answer

Schedule quarterly manual reviews of user access logs and system configurations.

Question 9

During a risk assessment, the risk owner identifies that the residual risk level is higher than the risk appetite. Which of the following actions should the risk owner take FIRST?

Accepted Answer

Escalate to senior management. When residual risk exceeds risk appetite, the risk owner must escalate to senior management because they have the authority to accept the risk or allocate resources for additional controls. This aligns with the CRISC framework's principle that risk acceptance decisions beyond appetite are a management responsibility, not the risk owner's alone.

Answer

Update the risk register

Answer

Implement additional controls

Answer

Reduce the risk appetite

Question 10

Refer to the exhibit. Based on the KRI data for the current week, what action should the risk manager take FIRST?

Accepted Answer

Investigate Wednesday and Thursday spikes as they are above the Green threshold.. Wednesday (12) and Thursday (15) are in the Amber zone (10-20), indicating a need for investigation. Option A is premature because the threshold for Red (>20) was not breached. Option B ignores the amber days. Option D suggests adjusting the threshold without understanding the cause of the spikes.

Answer

Adjust the KRI threshold to 15 per day to reduce false positives.

Answer

Continue monitoring as all days are within Green or Amber.

Answer

Escalate to the risk committee because the threshold was breached.

Question 11

A database error log shows repeated login failures followed by a successful authentication. Which control failure is MOST likely?

Accepted Answer

Account lockout policy is not enforced. The repeated login failures followed by a successful authentication indicate that the account lockout policy was not enforced. Without a lockout threshold, an attacker can perform unlimited password attempts until they guess the correct credential. This is a direct failure of the account lockout control, which is designed to prevent brute-force attacks by disabling the account after a defined number of failed attempts (e.g., 5 failures within 15 minutes per NIST SP 800-63B).

Answer

No multi-factor authentication

Answer

Insufficient failed login monitoring

Answer

Weak password policy

Question 12

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Accepted Answer

Transfer. Purchasing insurance transfers the financial risk to the insurer. Options B, C, and D do not describe transfer via insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 13

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 14

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 15

A SIEM event shows multiple failed logins followed by a successful login for the service account 'svc-backup'. The risk practitioner is evaluating the controls. Which finding is MOST significant?

Accepted Answer

A service account is authenticating with a password rather than a certificate. Service accounts should authenticate using non-replayable methods like certificates or managed service accounts (gMSA) rather than static passwords. A password-based authentication for a privileged service account, especially after a series of failed logins, indicates a high risk of credential compromise and lateral movement, making this the most significant finding from a risk monitoring perspective.

Answer

The service account has excessive database privileges

Answer

The failed login events were not logged in real time

Answer

Failed logins indicate a possible brute force attack

Question 16

A company monitors key risk indicators (KRIs) using a dashboard. The risk manager notices that a KRI has a green status but the underlying control testing shows a high failure rate. What action should the risk manager take FIRST?

Accepted Answer

Investigate the KRI calculation methodology. The KRI showing green while the underlying control has a high failure rate indicates a misalignment between the KRI and the actual control effectiveness. The first step is to investigate the KRI calculation methodology to determine if the KRI is measuring the wrong metric, using stale data, or has an incorrect threshold. Only after understanding why the KRI is misleading can the risk manager take appropriate corrective action.

Answer

Escalate to the risk committee

Answer

Change the KRI threshold to amber

Answer

Re-test the control

Question 17

Which TWO of the following are examples of control monitoring activities?

Accepted Answer

Periodic manual testing of a sample of transactions for compliance with approval policy.. A is correct because periodic manual testing of a sample of transactions is a classic detective control monitoring activity. It involves directly verifying that the control (approval policy) is operating effectively by examining actual evidence (transactions) after the fact. This is a direct, substantive test of control effectiveness, not a design or reporting activity.

Answer

Assigning owners to each control in the control framework.

Answer

Reporting key risk indicator values to the risk committee.

Answer

Updating the risk register based on control test results.

Question 18

Refer to the exhibit. Which type of attack is MOST likely indicated by these log entries?

Accepted Answer

Brute-force or credential stuffing. The log entries show repeated failed login attempts from the same IP address with different usernames and passwords, which is characteristic of a brute-force or credential stuffing attack. These attacks systematically try many username/password combinations to gain unauthorized access, often using automated tools.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 19

An organization uses continuous monitoring via SIEM rules to detect anomalies. The SIEM generates an alert when the number of failed logins exceeds a threshold. This monitoring is an example of:

Accepted Answer

Continuous monitoring. This scenario describes continuous monitoring because the SIEM is configured with rules that automatically and perpetually analyze login events in real time, generating alerts when the count of failed logins surpasses a predefined threshold. Unlike periodic or manual checks, this process operates 24/7 without human intervention, directly detecting anomalies as they occur.

Answer

Periodic control testing

Answer

Access review

Answer

Vulnerability scanning

Question 20

An external audit finds that a control is not operating as designed. The auditor recommends corrective action. What should the risk practitioner do FIRST?

Accepted Answer

Assess the impact of the control deficiency on residual risk. The risk practitioner must first assess the impact of the control deficiency on residual risk because the finding may not represent a material risk to the organization. Without understanding the severity and likelihood of the risk, any remediation or reporting could be misprioritized. This aligns with the CRISC framework's emphasis on risk-based decision-making before action.

Answer

Implement the auditor's recommendation immediately

Answer

Develop a remediation plan with the control owner

Answer

Update the risk register with the auditor's finding