CRISC Practice Exam 3 — 20 Questions

Question 1

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 2

During a risk assessment for a new financial application, the risk manager identifies that the application processes sensitive customer data and is accessible from the internet. Which of the following is the MOST appropriate risk scenario to document?

Accepted Answer

An attacker could exploit weak authentication mechanisms to gain unauthorized access and exfiltrate customer data, resulting in regulatory fines and reputational damage.. The most appropriate risk scenario because it follows the standard risk scenario structure: threat (attacker), vulnerability (weak authentication), impact (unauthorized access, data exfiltration, regulatory fines, reputational damage). It directly ties the technical weakness to a business consequence, which is essential for communicating risk to stakeholders. The scenario is specific to the application's internet-facing nature and sensitive data processing, making it actionable for risk treatment.

Answer

The application has several unpatched vulnerabilities that increase the likelihood of a security incident.

Answer

The application will implement multi-factor authentication to prevent unauthorized access.

Answer

The application must comply with PCI DSS requirements for data protection.

Question 3

Order the steps for incident response handling.

Accepted Answer

Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting. Incident response follows preparation, detection, containment/eradication/recovery, lessons learned, and reporting.

Answer

Step 1: Detection, Step 2: Preparation, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting

Answer

Step 1: Reporting, Step 2: Preparation, Step 3: Detection, Step 4: Containment/Eradication/Recovery, Step 5: Lessons Learned

Answer

Step 1: Preparation, Step 2: Containment/Eradication/Recovery, Step 3: Detection, Step 4: Lessons Learned, Step 5: Reporting

Question 4

Which THREE of the following are key components of a risk assessment report?

Accepted Answer

Risk register with identified risks. A risk assessment report must document the identified risks in a structured format, so option A (Risk register with identified risks) is correct because the risk register is the core artifact that catalogs each risk, its owner, and its status. Option C (Recommended risk response actions) is correct because the report must translate findings into actionable treatment options such as mitigate, transfer, avoid, or accept, guiding decision-makers on next steps. Option E (Risk analysis (likelihood and impact)) is correct because quantifying or qualifying each risk by its probability and potential impact is the analytical heart of the assessment, typically expressed as a risk score (e.g., likelihood × impact). Options B (Copies of vendor contracts) and D (Network topology diagram) are supporting evidence or technical artifacts that may inform the assessment but are not key components of the risk assessment report itself.

Answer

Copies of vendor contracts

Answer

Network topology diagram

Question 5

Which of the following is a key component of the NIST Cybersecurity Framework's 'Identify' function?

Accepted Answer

Risk assessment. The NIST Cybersecurity Framework's Identify function includes categories such as Asset Management, Business Environment, Governance, Risk Assessment, and Risk Management Strategy. Risk assessment is explicitly a key component of Identify because understanding organizational risk is foundational to prioritizing cybersecurity activities. It is listed under ID.RA in the framework core.

Answer

Recovery planning

Answer

Response planning

Answer

Anomalies and events detection

Question 6

A risk practitioner is developing a risk scenario for a potential ransomware attack. Using the ISACA risk scenario template, which element describes the entity that initiates the attack?

Accepted Answer

Actor. In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

Answer

Event

Answer

Threat type

Answer

Asset/Resource

Question 7

A company uses a third-party SaaS application for payroll processing. What is the most important activity to identify IT risks associated with this service?

Accepted Answer

Conducting a vendor risk assessment. A vendor risk assessment is the most important activity because it systematically evaluates the third-party SaaS provider's security controls, compliance posture, and operational resilience before and during service use. For a payroll SaaS, this includes reviewing data protection measures for sensitive employee PII, understanding the provider's SOC 2 Type II report, and assessing their incident response capabilities. Without this assessment, the organization cannot identify inherent risks like unauthorized data access, service downtime, or regulatory non-compliance specific to the third-party environment.

Answer

Performing penetration testing on the SaaS application

Answer

Reviewing the service-level agreement (SLA)

Answer

Implementing multi-factor authentication (MFA)

Question 8

A company has implemented a risk mitigation plan that includes technical controls. However, six months later, the residual risk is still higher than expected. The risk practitioner suspects that the controls are not being followed. Which of the following is the BEST approach to verify this?

Accepted Answer

Conduct a control testing and audit review. Conducting a control testing and audit review directly assesses whether controls are operating as intended, providing evidence of compliance or non-compliance. This is the most effective way to verify if controls are being followed. Option A (perform a new risk assessment) is indirect and does not focus on control effectiveness. Option B (interview control owners) relies on self-reporting and may not be objective. Option C (review risk register updates) does not provide evidence of actual control operation.

Answer

Perform a new risk assessment

Answer

Interview control owners

Answer

Review risk register updates

Question 9

Which of the following is the primary purpose of a risk and control monitoring program?

Accepted Answer

To provide ongoing assurance that controls are operating effectively.. The primary purpose of a risk and control monitoring program is to provide ongoing assurance that controls are operating effectively. This is achieved through continuous or periodic testing, observation, and analysis of control activities to confirm they are designed correctly and functioning as intended to mitigate risks. Without this ongoing assurance, an organization cannot reliably know whether its risk responses remain effective over time.

Answer

To identify new risks as they emerge.

Answer

To reduce the frequency of internal audits.

Answer

To calculate key risk indicators.

Question 10

Which THREE of the following are components of an effective IT risk reporting structure for a large enterprise? (Select THREE)

Accepted Answer

Strategic risk reporting to the board on a semi-annual basis. Option A is correct because strategic risk reporting to the board on a semi-annual basis aligns with the board's governance and oversight role, giving directors a periodic, high-level view of enterprise risk posture without overwhelming them with operational detail. Option B is correct because tactical risk reporting to the CISO on a quarterly basis matches the CISO's responsibility for managing the information security risk program and provides a cadence suitable for tracking risk treatment progress and emerging threats. Option E is correct because operational risk reporting to IT management on a weekly basis supports timely decision-making on day-to-day control failures, incidents, and remediation activities that require rapid attention. Option C is not appropriate because annual reporting to IT operational staff is too infrequent for the operational level, where risks change quickly and require continuous awareness. Option D is not appropriate because daily risk reporting to the board is excessive and misaligned with the board's strategic oversight role, which relies on summarized, periodic reporting rather than daily operational data.

Answer

Annual risk reporting to IT operational staff

Answer

Daily risk reporting to the board

Question 11

A large bank has implemented a sophisticated risk and control monitoring system with multiple dashboards and automated reporting for key risk indicators (KRIs). However, the board of directors has been receiving conflicting KRI reports from different business units (e.g., retail banking, corporate lending, and wealth management). For example, the fraud KRI shows a high risk in retail but low risk in wealth management, yet both units use the same underlying data source. The chief risk officer (CRO) is concerned that the board is losing confidence in the risk reporting. An investigation reveals that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. What is the most likely root cause and the best remediation?

Accepted Answer

The KRI definitions and calculation methods are not standardized across business units.. The root cause of conflicting KRI reports is that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. This lack of standardization leads to inconsistent risk measurements, even when using the same underlying data source. The best remediation is to standardize KRI definitions, calculation methods, thresholds, and reporting frequencies across all business units to ensure consistent and comparable risk reporting to the board.

Answer

The reporting frequency is inadequate; monthly reports should be weekly.

Answer

The data sources for KRIs are inconsistent across business units.

Answer

The board members are misinterpreting the KRI reports due to lack of training.

Question 12

An organization's risk committee reviews a risk heat map showing that a key IT risk has moved from the "high" to "medium" category. However, the associated control's effectiveness has decreased from 95% to 85%. What is the most likely explanation?

Accepted Answer

The inherent risk has decreased due to external factors.. The risk heat map shows a reduction in residual risk from high to medium, yet the control effectiveness dropped from 95% to 85%. This apparent contradiction is best explained by a decrease in inherent risk—the risk before controls are applied. If inherent risk falls (e.g., due to external factors like new regulations or reduced threat activity), the residual risk can decrease even if the control becomes less effective, because the starting risk level is lower.

Answer

The control testing frequency was increased.

Answer

The risk assessment methodology was changed.

Answer

The control owner has implemented additional compensating controls.

Question 13

A risk manager is evaluating the effectiveness of a control that requires dual authorization for high-value transactions. The Key Control Indicator (KCI) for this control is the rate of transactions processed without dual authorization (i.e., exception rate). If the acceptable exception rate is less than 1% and the observed rate is 2.5%, what is the most appropriate immediate action?

Accepted Answer

Investigate the root cause of the exceptions. The observed exception rate of 2.5% exceeds the acceptable threshold of 1%, indicating a control deficiency. The most appropriate immediate action is to investigate the root cause of the exceptions to determine whether the control is failing due to process gaps, user behavior, or system issues. Root cause analysis (RCA) is a foundational step before any remediation, as it prevents premature redesign or unjustified risk acceptance.

Answer

Redesign the control immediately

Answer

Accept the risk since the rate is still low

Answer

Increase the acceptable exception rate to 2.5%

Question 14

During a vendor risk assessment, a third-party vendor is classified as "critical" because it has access to sensitive customer data. According to the organization's risk appetite, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor with access to sensitive customer data because it provides an independent, audited assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. This aligns with the organization's risk appetite by ensuring that the vendor has demonstrated effective controls in place to protect sensitive data, rather than relying on a point-in-time test or self-reported information.

Answer

General liability insurance certificate

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 15

During a quarterly control effectiveness test, internal audit finds that a detective control missed 15% of security incidents. The control owner claims this is within the acceptable error rate of 20%. However, the risk practitioner notes that the missed incidents were high-severity. What should the risk practitioner do?

Accepted Answer

Escalate the findings to senior management with a recommendation to enhance the control. The risk practitioner should escalate the findings to senior management with a recommendation to enhance the control because the detective control's failure to detect 15% of incidents, while within the 20% acceptable error rate, specifically missed high-severity incidents. High-severity incidents pose a disproportionate risk to the organization, and a control that fails to detect them is not effective in mitigating critical risks, regardless of meeting a generic threshold. Escalation ensures that management is aware of the residual risk and can authorize appropriate enhancements, such as tuning the control's detection logic or implementing additional monitoring for high-severity events.

Answer

Accept the control as effective since it is within the threshold

Answer

Implement a compensating control to cover high-severity incidents

Answer

Recommend revising the KCI threshold to include severity weighting

Question 16

Which of the following best describes risk capacity?

Accepted Answer

The maximum risk the organization can absorb before threatening viability. Risk capacity is the maximum amount of risk an organization can absorb before its viability, solvency, or strategic objectives are threatened — it is an objective, externally-influenced limit. It differs from risk appetite (willingness to accept risk) and risk tolerance (acceptable deviation around appetite). The correct answer captures the 'maximum absorbable' framing that distinguishes capacity from the other risk concepts.

Answer

The acceptable risk level for each risk category

Answer

The total risk identified in the risk universe

Answer

The amount of risk the organization is willing to accept

Question 17

A company is identifying risks associated with a new cloud-based CRM. Which of the following is the MOST effective method for identifying potential threats?

Accepted Answer

Threat modeling workshops with stakeholders. Threat modeling workshops with stakeholders are the most effective method because they leverage diverse expertise to systematically identify threats specific to the cloud-based CRM architecture, including misconfigurations in IAM roles, API vulnerabilities, and data residency issues. This collaborative approach aligns with the CRISC focus on proactive risk identification by considering business context, technical constraints, and regulatory requirements early in the lifecycle.

Answer

Reviewing industry standards only

Answer

Conducting penetration testing alone

Answer

Analyzing historical security incidents from similar organizations

Question 18

An organization notices a spike in failed authentication attempts over the past week. This metric is best classified as which type of risk indicator?

Accepted Answer

Key Risk Indicator (KRI). A spike in failed authentication attempts is a direct measure of a risk condition (e.g., brute-force attacks or credential stuffing) that can lead to unauthorized access. This metric is best classified as a Key Risk Indicator (KRI) because it tracks changes in risk exposure over time, enabling proactive risk response. Unlike a KCI, which measures control effectiveness, or a lagging indicator, which reports past incidents, this metric signals an evolving threat in near real-time.

Answer

Key Control Indicator (KCI)

Answer

Lagging indicator

Answer

Compliance metric

Question 19

An organization assesses a risk and determines the inherent risk score is 20 (critical). After implementing controls, the residual risk score is 8 (medium). What does this indicate about the controls?

Accepted Answer

Controls are effective in reducing risk to a lower level. The reduction from 20 to 8 indicates the controls are effective in reducing risk.

Answer

The residual risk is still critical

Answer

The inherent risk was overestimated

Answer

Controls are ineffective because residual risk is still above zero

Question 20

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Accepted Answer

A new cloud service may inadvertently expose customer PII due to misconfiguration. The risk appetite statement explicitly declares low tolerance for compliance risk, and exposing customer PII triggers regulatory/legal obligations (e.g., GDPR, CCPA, contractual data-protection clauses). Because compliance risk is the organization's stated low-tolerance area, any scenario with potential PII exposure must be escalated immediately to senior management. The other scenarios fall within the 'moderate operational risk' appetite the company has already accepted.

Answer

A planned system upgrade may cause two hours of downtime during maintenance window

Answer

A vendor is late in delivering a software patch for a low-severity bug

Answer

An employee mistakenly deletes a non-critical test database