CRISC Practice Exam 2 — 20 Questions

Question 1

Which of the following is the BEST indicator that a risk assessment's results are reliable?

Accepted Answer

It uses the most recent threat intelligence.. B is correct because the reliability of a risk assessment hinges on the accuracy and timeliness of its inputs. Using the most recent threat intelligence ensures that the assessment reflects the current threat landscape, including newly discovered vulnerabilities, active exploit campaigns, and emerging attack vectors. Without current intelligence, even a perfectly structured assessment will produce outdated risk scores that fail to represent actual exposure.

Answer

It is based on a standard framework such as ISO 31000.

Answer

It includes both quantitative and qualitative methods.

Answer

It is performed by an external consultant.

Question 2

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 3

A global financial services firm has implemented a risk monitoring system that aggregates data from 50+ systems across three regions (Americas, EMEA, APAC). The system uses a centralized data lake and provides dashboards to regional risk committees. Recently, the APAC committee reported that their dashboard shows a spike in cyber risk indicators, but the Americas and EMEA dashboards show no change. The data source for the spike is a single system in APAC that tracks failed VPN logins. The risk owner for that system believes the spike is due to a misconfiguration during a recent patch. However, the APAC risk committee is concerned that this indicates a coordinated attack. The Chief Risk Officer (CRO) wants a clear assessment. Which course of action is most appropriate?

Accepted Answer

Advise the CRO that the spike is likely a false positive due to the recent patch and recommend the system owner confirm and fix the misconfiguration.. The spike originates from a single system in APAC tracking failed VPN logins, and the risk owner has identified a misconfiguration from a recent patch as the cause. This is a classic false positive scenario where a technical anomaly (e.g., a patch altering authentication timeout or lockout thresholds) generates an alert spike without evidence of lateral movement or other indicators. The CRO needs a clear assessment, and the most appropriate action is to confirm the misconfiguration and fix it, rather than escalating or adding controls prematurely.

Answer

Recommend implementing additional monitoring controls across all regions to detect similar spikes.

Answer

Suggest the APAC committee accept the risk based on the system owner's opinion.

Answer

Immediately escalate to the board and activate the incident response team.

Question 4

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 5

Which THREE factors should be considered when determining the inherent risk level of a new IT project prior to any controls?

Accepted Answer

Regulatory requirements governing the project's outcomes.. Regulatory requirements (A) are a key factor in determining inherent risk because they impose mandatory compliance obligations that, if unmet, can result in legal penalties, fines, or operational shutdowns. For a new IT project, the inherent risk level is assessed based on the nature of the data processed and the applicable laws (e.g., GDPR, HIPAA, PCI DSS) before any controls are applied. This is a fundamental input to the risk assessment, as non-compliance risk exists independently of any security measures.

Answer

Past security incidents in similar projects.

Answer

Experience level of the project team.

Question 6

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 7

Order the steps for implementing a risk treatment plan.

Accepted Answer

Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.. Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Answer

Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.

Answer

Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.

Answer

Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.

Question 8

Arrange the steps for performing a risk assessment in the correct order.

Accepted Answer

Asset identification, then threat and vulnerability identification, then likelihood and impact analysis, then risk calculation, then documentation.. Risk assessment begins with asset identification, then threats/vulnerabilities, followed by likelihood and impact analysis, risk calculation, and documentation.

Answer

Threat and vulnerability identification, then asset identification, then likelihood and impact analysis, then risk calculation, then documentation.

Answer

Risk calculation, then asset identification, then threat and vulnerability identification, then documentation, then likelihood and impact analysis.

Answer

Asset identification, then threat and vulnerability identification, then risk calculation, then likelihood and impact analysis, then documentation.

Question 9

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 10

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

Accepted Answer

Risk treatment plans are implemented within agreed timelines. The effectiveness of an IT risk assessment process is ultimately measured by whether identified risks are actually treated within agreed timelines. Option D directly demonstrates that the organization moves from risk identification to remediation, closing the risk management loop. Without timely implementation of treatment plans, even the most thorough risk assessments provide no reduction in actual risk exposure.

Answer

The risk register contains a large number of risks

Answer

Risk appetite statements are clearly defined

Answer

Risk assessments are performed annually

Question 11

Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?

Accepted Answer

Ease of exploitation. Ease of exploitation (A) is a key factor because it directly influences how readily a threat actor can leverage a vulnerability. For example, a vulnerability with a public exploit script or one that requires only low privileges is far more likely to be exploited than one requiring complex, custom tooling. This aligns with the CVSS exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) that quantify how easy it is to trigger the vulnerability.

Answer

Regulatory fines

Answer

Asset value

Question 12

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

Accepted Answer

Alert the risk owner and initiate a root cause analysis. The KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Answer

Lower the risk tolerance threshold to trigger more frequent alerts

Answer

Accept the increased risk without further analysis because the trend is gradual

Answer

Increase the risk tolerance threshold to match the current level

Question 13

When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?

Accepted Answer

Spoofing. Spoofing in STRIDE refers to impersonating something or someone else to gain unauthorized access, such as using stolen credentials.

Answer

Repudiation

Answer

Information Disclosure

Answer

Tampering

Question 14

An IT risk manager is facilitating a workshop to identify risks for a new mobile banking application. Which technique is MOST appropriate for generating a comprehensive list of risks?

Accepted Answer

Conduct a brainstorming session with cross-functional team members. Brainstorming with a cross-functional team (option C) is the most appropriate technique for generating a comprehensive list of risks for a new mobile banking application because it leverages diverse perspectives from development, security, compliance, and business units. This collaborative approach helps uncover unknown or emergent risks specific to the application's architecture, such as API vulnerabilities, session management flaws, or regulatory gaps, which might not be captured by historical data or structured questionnaires.

Answer

Review risk registers from similar projects

Answer

Perform a SWOT analysis

Answer

Distribute a risk questionnaire to project stakeholders

Question 15

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Accepted Answer

Implement a unidirectional gateway that enforces one-way data flow. A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Answer

Deploy a host-based intrusion detection system on each ICS device

Answer

Upgrade the ICS to modern protocols with built-in authentication

Answer

Disconnect the ICS from the corporate network and use manual data transfer

Question 16

Which of the following threat actors is MOST likely to be motivated by financial gain and possess moderate to high technical capabilities?

Accepted Answer

Organized crime. Organized crime groups are primarily motivated by financial gain and often have sophisticated technical skills to carry out attacks such as ransomware, data theft, or fraud.

Answer

Hacktivist

Answer

Nation-state APT

Answer

Script kiddie

Question 17

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 18

Which TWO of the following are examples of detective controls?

Accepted Answer

Log monitoring and analysis. Detective controls identify incidents that have already occurred. Intrusion detection systems and log monitoring are classic examples.

Answer

Encryption of data at rest

Answer

Firewall rules

Answer

Data backup process

Question 19

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

Question 20

In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?

Accepted Answer

A DDoS attack causes website unavailability for 4 hours, resulting in $500,000 lost sales and customer churn.. A proper connection shows the chain from threat to impact on business.

Answer

A firewall misconfiguration allows unauthorized access, causing a security incident.

Answer

A ransomware attack encrypts files, leading to IT department overtime.

Answer

An insider steals data, leading to legal fees.