CRISC Practice Exam 2 — 20 Questions

Question 1

An organization uses a quantitative risk analysis method. The annualized rate of occurrence (ARO) for a specific threat is 0.5, and the single loss expectancy (SLE) is $200,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated as ARO × SLE = 0.5 × $200,000 = $100,000. This represents the expected annual financial loss from the threat, factoring in both the frequency of occurrence and the impact per incident.

Answer

$400,000

Answer

$100,000

Answer

$200,000

Question 2

During a control monitoring review, the auditor finds that a control designed to detect unauthorized access has not triggered any alerts in six months. What should the risk practitioner do first?

Accepted Answer

Test the control to ensure it is functioning correctly.. The absence of alerts does not automatically confirm that the control is working; it could indicate that the control has failed silently or that the detection logic is misconfigured. The risk practitioner must first test the control (e.g., by simulating an unauthorized access attempt) to verify that it can actually detect and alert on violations. Only after confirming correct functionality can the lack of alerts be interpreted as evidence of effectiveness.

Answer

Document the lack of alerts as evidence of effectiveness.

Answer

Redesign the control with different parameters.

Answer

Increase the frequency of monitoring.

Question 3

Which TWO of the following are appropriate actions when a control deficiency is identified during monitoring? (Select exactly two.)

Accepted Answer

Document the deficiency and its impact. Option B is correct because documenting the deficiency and its impact is a fundamental step in the risk and control monitoring process. It ensures that the nature, severity, and potential consequences of the control failure are formally recorded, which is essential for risk assessment, reporting, and audit trails. Without this documentation, the organization cannot properly evaluate the risk exposure or justify remediation efforts.

Answer

Increase the risk appetite

Answer

Ignore if the deficiency is minor

Answer

Immediately terminate the control owner

Question 4

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

Question 5

You are a risk analyst for a financial institution that uses a legacy mainframe system for core banking transactions. The mainframe is critical for daily operations, but it is no longer supported by the vendor. The system has known vulnerabilities that cannot be patched due to compatibility issues. The institution has a risk appetite that is very low for any disruption to core banking services. Recently, there was a minor outage caused by a hardware failure, which was resolved quickly, but it highlighted the system's fragility. The IT director proposes to migrate to a modern system, but the migration will take 2 years and cost $5 million. The board is concerned about the cost and timeline. You need to recommend an immediate risk treatment to reduce the likelihood of a major outage while the migration is underway. Which of the following is the BEST course of action?

Accepted Answer

Implement redundant hardware for critical components and conduct regular failover testing.. Option B is correct because implementing redundant hardware for critical components and conducting regular failover testing directly reduces the likelihood of a major outage by addressing the single point of failure exposed by the recent hardware failure. This is an immediate risk treatment that does not depend on the 2-year migration timeline, and it aligns with the institution's very low risk appetite for core banking disruption.

Answer

Accept the risk because the migration plan is in place.

Answer

Negotiate with the vendor for extended support.

Answer

Purchase business interruption insurance to cover potential losses.

Question 6

A risk manager is evaluating the risk associated with a new third-party vendor that will have access to customer data. The vendor has been in business for 10 years and holds ISO 27001 certification. Which factor should be given the MOST weight when determining the vendor's risk level?

Accepted Answer

The sensitivity and volume of data the vendor will access.. The sensitivity and volume of data directly determine the potential impact of a breach, which is a core component of inherent risk. Even with strong controls like ISO 27001, the risk level is primarily driven by the value and quantity of the asset at risk (customer data). In IT risk assessment, the asset's criticality and exposure outweigh historical or certification-based indicators when calculating residual risk.

Answer

The vendor's years in operation.

Answer

The vendor's ISO 27001 certification.

Answer

The contractual terms for data protection.

Question 7

After a risk assessment, the risk owner decides to mitigate a high-risk finding by implementing additional access controls. What should the risk manager do NEXT?

Accepted Answer

Reassess the residual risk level after controls are implemented.. After mitigation controls are implemented, the risk manager must reassess the residual risk level to determine whether the controls have effectively reduced the risk to an acceptable level. This step ensures that the risk treatment decision is validated and that any remaining exposure is understood before updating the risk register or closing the issue.

Answer

Update the risk register with the mitigation actions taken.

Answer

Accept the residual risk on behalf of the organization.

Answer

Close the risk issue and move to the next priority.

Question 8

An IT risk manager is reviewing the results of a recent risk assessment. The organization has a risk appetite that allows for low residual risk. One identified risk has an inherent risk score of 15 (on a scale of 1-25) and currently has no controls. Which of the following is the BEST recommendation for this risk?

Accepted Answer

Implement controls to reduce the residual risk to an acceptable level.. The inherent risk score of 15 (out of 25) is moderate, but the organization's risk appetite allows only low residual risk. Since there are currently no controls, the residual risk equals the inherent risk of 15, which exceeds the acceptable threshold. Therefore, implementing controls is the best recommendation to reduce the residual risk to a level that aligns with the risk appetite.

Answer

Accept the risk because the score is moderate.

Answer

Transfer the risk via cyber insurance.

Answer

Avoid the risk by discontinuing the business process.

Question 9

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

Accepted Answer

Obtain a third-party audit report (e.g., SOC 2 Type II).. A SOC 2 Type II report provides an independent, third-party assessment of a cloud provider's controls over a period of time, directly addressing the lack of visibility by offering verifiable evidence of control effectiveness. This is the standard approach for gaining assurance over a provider's security posture without relying on internal access or self-reporting.

Answer

Request the provider to self-attest their controls.

Answer

Accept the risk based on the provider's reputation.

Answer

Conduct a penetration test on the provider's infrastructure.

Question 10

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 11

Which THREE of the following are key components of an effective risk reporting framework?

Accepted Answer

Consistent risk metrics across the organization.. Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Answer

Automated collection of risk data from all sources.

Answer

Statistical models for predicting future risks.

Question 12

A risk assessment for a financial trading platform has identified a high-risk vulnerability in the order matching engine. The risk owner has recommended implementing compensating controls rather than fixing the underlying code. Which TWO of the following are valid compensating controls? (Choose two.)

Accepted Answer

Require manual approval for all orders above a threshold. Option D is correct because requiring manual approval for orders above a threshold directly reduces the impact of a successful exploit by preventing large-scale financial loss, even if the underlying code vulnerability remains unpatched. This compensating control shifts the risk acceptance decision to a human operator, effectively adding a business logic layer that can catch anomalous or malicious order matching attempts. Option E is correct because rate limiting on order submissions mitigates the risk of an attacker exploiting the vulnerability to submit a high volume of malicious orders, thereby limiting the blast radius and preventing denial-of-service or market manipulation scenarios.

Answer

Rewrite the order matching engine in a memory-safe language

Answer

Deploy a Web Application Firewall (WAF) to block malicious payloads

Answer

Enable detailed logging for all order matching transactions

Question 13

A company has a control that automatically rejects transactions over $10,000. During a review, it is found that 2% of transactions over $10,000 were approved due to a system glitch. The control owner says the glitch has been fixed. What should the risk practitioner do next?

Accepted Answer

Request evidence of the fix and perform a sample test of recent transactions.. Option B is correct because the risk practitioner must independently verify that the system glitch has been resolved before closing the finding. Requesting evidence of the fix (e.g., change logs, patch notes) and performing a sample test of recent transactions provides objective assurance that the control is now operating effectively. This aligns with the CRISC principle that control owner assurances alone are insufficient without validation, especially for automated controls where residual risk from the glitch could persist.

Answer

Accept the control owner's assurance and close the finding.

Answer

Recommend a compensating control until the fix is confirmed.

Answer

Report the issue to the audit committee.

Question 14

A multinational e-commerce company has experienced multiple security incidents involving unauthorized access to customer payment data. The incidents originated from different regional offices and exploited misconfigured firewall rules. The risk manager needs to identify the root cause of these risks. Which approach would BEST help in identifying the root cause of the IT risk?

Accepted Answer

Perform a root cause analysis on the firewall misconfigurations to determine underlying process weaknesses.. Option C is correct because conducting a root cause analysis on the firewall misconfigurations will identify the underlying weaknesses in the change management process. Option A is wrong because increasing logging without analysis does not identify root cause. Option B is wrong because a penetration test may find vulnerabilities but not the process failure. Option D is wrong because updating the risk register is a result of identification, not a method to identify root cause.

Answer

Implement additional logging on all firewall devices to capture configuration changes.

Answer

Conduct a penetration test targeting all regional office networks to identify vulnerabilities.

Answer

Update the risk register to include the incidents and assign risk owners.

Question 15

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. Option B is correct because the BIA identifies critical business processes and their recovery priorities. Option A is wrong because vulnerability assessment is separate. Option C is wrong because threats are identified in threat modeling. Option D is wrong because asset inventory is part of asset management.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 16

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

Accepted Answer

Accept the risk and monitor it. Option B is correct because acceptance is appropriate when the cost of mitigation exceeds the potential loss. Option A is wrong because mitigation might not be cost-effective. Option C is wrong because avoidance might not be necessary. Option D is wrong because transfer might not be possible for legacy systems.

Answer

Avoid the risk by decommissioning the system

Answer

Mitigate the vulnerability with a patch

Answer

Transfer the risk via a managed security service

Question 17

A manufacturing company uses an industrial control system (ICS) that is connected to the corporate network for monitoring. The risk manager is identifying risks related to this connectivity. Which of the following is the MOST significant risk?

Accepted Answer

Compromise of ICS causing physical damage to manufacturing equipment.. The most significant risk is that a compromise of the ICS could lead to physical damage, such as equipment destruction, safety hazards, or environmental release. Unlike IT systems where data loss is the primary concern, ICS failures directly impact the physical world, making safety and operational integrity the top priority in risk identification.

Answer

Malware infection spreading from corporate to ICS network.

Answer

Network congestion due to ICS traffic affecting corporate users.

Answer

Unauthorized access to corporate data through the ICS connection.

Question 18

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. Option D is correct because high false positives can cause alert fatigue, leading to missed real incidents. Option A is a secondary effect. Option B is not directly caused by false positives. Option C is a possible result but not the most significant.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 19

A risk officer is evaluating the effectiveness of a control that prevents unauthorized changes to configuration files. The control has not detected any unauthorized changes in the past year. What does this indicate?

Accepted Answer

Further testing is needed to determine control effectiveness.. The absence of detected unauthorized changes does not automatically confirm control effectiveness; it could also indicate that the control is not properly configured to detect changes (e.g., missing file integrity monitoring rules, incorrect baseline, or disabled logging). Further testing—such as manually introducing a test change or reviewing audit logs—is required to verify that the control can actually detect violations. This aligns with CRISC best practices for validating control effectiveness through testing rather than relying solely on absence of alerts.

Answer

The control is unnecessary because no changes occurred.

Answer

The control is not configured correctly to detect changes.

Answer

The control is operating effectively and no violations occurred.

Question 20

Based on the risk register exhibit, which of the following is the MOST appropriate risk response for R-0042?

Accepted Answer

Accept the risk and continue monitoring. R-0042 is a low-likelihood, low-impact risk involving PII stored with AES-256 encryption and strict access controls. The residual risk is within the organization's risk appetite, making acceptance with continued monitoring the most appropriate response. Mitigation, transfer, or avoidance would introduce unnecessary cost or operational disruption for a risk already well-controlled.

Answer

Mitigate the risk by implementing additional encryption controls

Answer

Transfer the risk to a third-party insurer

Answer

Avoid the risk by discontinuing storage of PII