CRISC Practice Exam 2 — 20 Questions

Question 1

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

Question 2

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register must capture B (Risk owner), because every identified risk needs an accountable individual responsible for monitoring and managing it throughout its lifecycle. C (Root cause) is essential because documenting the underlying source or driver of the risk enables proper analysis and effective treatment rather than just addressing symptoms. E (Risk description) is required to clearly articulate the nature of the risk, including the event, its potential consequences, and context, so it can be understood and prioritized. A (Quantified monetary impact) is not always essential at the identification stage, since qualitative or semi-quantitative assessments may suffice initially and quantification often occurs later during analysis. D (Mitigation plan) is a risk treatment output that follows assessment and is not a core identification component, as the register first needs to record the risk itself before responses are defined.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 3

What is the primary purpose of a control self-assessment (CSA)?

Accepted Answer

To involve process owners in evaluating control effectiveness.. The primary purpose of a control self-assessment (CSA) is to involve process owners in evaluating the effectiveness of controls within their own areas of responsibility. This approach leverages the deep operational knowledge of those who design and execute processes daily, enabling them to identify control gaps and improvement opportunities that external auditors might miss. By fostering ownership and accountability, CSA enhances the control environment without replacing independent assurance functions.

Answer

To replace external audits.

Answer

To automate monitoring.

Answer

To generate compliance reports.

Question 4

A security awareness program is being designed to promote a risk-aware culture. Which TWO elements are most critical for the program's success?

Accepted Answer

Tone from the top. Option D, 'Tone from the top,' is critical because a risk-aware culture must be visibly championed by senior leadership; when executives model and reinforce risk-conscious behavior, employees perceive security as a genuine organizational priority rather than a compliance formality. Option E, 'Communicating risk in business terms,' is equally essential because awareness messages framed around business impact—such as financial loss, reputational damage, or operational disruption—resonate with staff and drive risk-informed decision-making far better than abstract technical jargon. Together, these two elements establish both the authority and the relevance needed for a sustainable security awareness program. Option A is not among the marked correct answers because a risk committee is a governance structure that supports risk management but is not itself a critical element of awareness-program success. Option B is not marked correct because mandatory pass/fail testing can create a compliance checkbox mentality rather than fostering genuine risk awareness. Option C is not marked correct because detailed technical training for all staff is unnecessary and impractical; awareness programs should target relevant behaviors, not deep technical expertise.

Answer

Establishing a risk committee

Answer

Mandatory annual testing with pass/fail

Answer

Detailed technical training for all staff

Question 5

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 6

Match each information security objective to its description.

Accepted Answer

Confidentiality: Ensures that information is not disclosed to unauthorized individuals.. The CIA triad (Confidentiality, Integrity, Availability) plus Accountability are core security principles. Correct matches: Confidentiality prevents unauthorized disclosure, Integrity ensures accuracy, Availability guarantees access, and Accountability enables traceability.

Answer

Confidentiality: Ensures that information is accurate and complete, and not modified improperly.

Answer

Integrity: Ensures that information is not disclosed to unauthorized individuals.

Question 7

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 8

An organization purchases cyber insurance to cover potential losses from data breaches. This is an example of:

Accepted Answer

Risk Transfer. Purchasing cyber insurance transfers the financial risk of a data breach to the insurer, making it a classic example of risk transfer. In risk management, transfer shifts the impact of a loss to a third party (e.g., an insurance carrier) without eliminating the underlying threat or vulnerability. This aligns with the CRISC domain of Risk Response and Mitigation, where transfer is a distinct response strategy.

Answer

Risk Avoidance

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 9

During a control self-assessment, an operational manager reports that a manual review control is performed quarterly instead of monthly as documented. What should the risk practitioner do?

Accepted Answer

Update the control frequency in the risk register and assess residual risk. The risk practitioner must update the control frequency in the risk register to reflect the actual operating reality (quarterly instead of monthly) and then reassess the residual risk. This ensures the risk register remains accurate and the risk exposure is properly evaluated based on the current control effectiveness. Simply accepting the change without documentation (A) or forcing immediate resumption (D) ignores the need for risk reassessment, while escalating for disciplinary action (B) is premature and not the primary risk management action.

Answer

Accept the change without documentation since risk level is unchanged

Answer

Escalate the deviation to senior management for disciplinary action

Answer

Require the manager to resume monthly reviews immediately

Question 10

A risk manager is updating the risk report for the IT steering committee. Which THREE elements should be included to provide a comprehensive view of the risk posture?

Accepted Answer

Risk trend analysis. Risk trend analysis (B) is correct because tracking how risk exposure changes over time (e.g., increasing, decreasing, or stable risk levels across reporting periods) gives the steering committee insight into whether risk management efforts are effective and where emerging risks are developing. A risk heat map (C) is correct because it visually plots risks by likelihood and impact, enabling the committee to quickly identify and prioritize the highest-exposure areas across the organization's risk posture. Top risks and their status (E) is correct because summarizing the most significant risks along with their current mitigation status, owners, and progress provides the committee with actionable, decision-ready information for governance. Names of all IT employees (A) is not a risk posture element—it is personnel data with no bearing on risk likelihood, impact, or treatment. Detailed configuration of each firewall (D) is far too granular and technical for a steering-committee risk report; such operational detail belongs in technical security documentation, not executive risk reporting.

Answer

Names of all IT employees

Answer

Detailed configuration of each firewall

Question 11

Which of the following is the BEST example of a key risk indicator (KRI) for the risk of unauthorized access to sensitive data?

Accepted Answer

Percentage of users with access to sensitive data. A KRI must directly measure the likelihood or impact of a specific risk. The percentage of users with access to sensitive data is a direct indicator of the attack surface for unauthorized access; a higher percentage increases the probability that an unauthorized user could gain access, making it a leading indicator for that risk.

Answer

Average server uptime

Answer

Number of firewalls deployed

Answer

Number of security awareness trainings completed

Question 12

After a significant cybersecurity incident, the board requests a report on the effectiveness of the security controls that were in place. Which reporting approach would BEST demonstrate the controls' performance?

Accepted Answer

Compare control test results against defined KRIs and risk appetite. Comparing control test results against defined Key Risk Indicators (KRIs) and risk appetite directly demonstrates whether the controls are operating within acceptable risk thresholds. This approach provides the board with a clear, quantitative assessment of control effectiveness relative to the organization's risk tolerance, which is the core objective of risk and control monitoring and reporting.

Answer

List all controls and their test results

Answer

Show the number of vulnerabilities patched

Answer

Provide a summary of the incident timeline

Question 13

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 14

A large e-commerce company uses several key risk indicators (KRIs) to monitor credit card fraud. The risk committee noticed that one KRI has been trending above the threshold for three consecutive months, yet no risk response was initiated. Which of the following is the MOST likely root cause?

Accepted Answer

The risk response workflow was not triggered automatically. The most likely root cause is that the risk response workflow was not triggered automatically. In a mature risk monitoring environment, KRIs should be linked to automated workflows that initiate a response when thresholds are breached. Since the KRI has been above threshold for three consecutive months without any action, it indicates a failure in the automated triggering mechanism, not in the KRI's accuracy or the threshold's leniency.

Answer

The KRI was not validated for accuracy

Answer

The KRI threshold was set too lenient

Answer

The monitoring tool failed to capture data

Question 15

Which TWO controls are most effective for reducing the risk of data leakage from endpoints in a remote work environment?

Accepted Answer

Implement Data Loss Prevention (DLP) software.. Option B, implementing Data Loss Prevention (DLP) software, is correct because DLP solutions inspect data in use, in motion, and at rest, applying content-aware policies (regex, keywords, file fingerprints) to block or quarantine sensitive data from being exfiltrated via email, USB, cloud uploads, or clipboard on remote endpoints. Option D, requiring full-disk encryption on all laptops, is correct because technologies like BitLocker, FileVault, or LUKS with TPM/PIN protect data at rest, ensuring that if a remote worker's laptop is lost or stolen, the stored data cannot be read without the decryption key, directly reducing leakage risk. Option A, phishing simulations, primarily reduces credential-theft and malware risk through user awareness, not endpoint data exfiltration. Option C, complex password policies for local accounts, hardens authentication against brute-force but does not prevent a legitimate user or malware from copying data out. Option E, a VPN, encrypts data in transit and hides traffic from local networks, but it does not stop an authorized endpoint from leaking data to unauthorized destinations.

Answer

Conduct regular phishing simulation campaigns.

Answer

Enforce complex password policies for local accounts.

Answer

Use a VPN for all remote connections.

Question 16

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. A high false positive rate in a detective control leads to alert fatigue, where security personnel may ignore or dismiss alerts, increasing the risk that actual security incidents are missed. Option A is a consequence but not the most significant. Option C may occur but is secondary. Option D is an operational impact but does not directly increase risk.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 17

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 18

Sequence the steps for developing a disaster recovery plan (DRP).

Accepted Answer

Business Impact Analysis (BIA), Prioritize critical functions, Select recovery strategy, Document the plan, Test the plan. DRP development begins with BIA, prioritization, strategy selection, documentation, and testing.

Answer

Document the plan, Business Impact Analysis (BIA), Prioritize critical functions, Select recovery strategy, Test the plan

Answer

Select recovery strategy, Business Impact Analysis (BIA), Prioritize critical functions, Document the plan, Test the plan

Answer

Business Impact Analysis (BIA), Select recovery strategy, Prioritize critical functions, Test the plan, Document the plan

Question 19

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 20

A company uses cyber insurance to cover losses from data breaches. This is an example of which risk treatment?

Accepted Answer

Transfer. Transfer shifts risk to a third party, such as an insurance company.

Answer

Avoid

Answer

Mitigate

Answer

Accept