CRISC Practice Exam 3 — 20 Questions

Question 1

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 2

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. The frequency of control monitoring should be based on risk and criticality. Options D and E are correct because controls that are more critical to risk mitigation and processes with higher inherent risk levels require more frequent monitoring. Option A is incorrect because monitoring frequency should be driven by risk, not cost; cost is a secondary consideration. Option B is incorrect because the number of IT projects does not directly affect the monitoring frequency of existing controls. Option C is incorrect because external auditor preferences may influence the approach but are not a primary factor in determining monitoring frequency.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

Question 3

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

Accepted Answer

Historical incident data from industry reports. Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Answer

Vendor documentation

Answer

The risk owner's personal opinion

Answer

The organization's financial statements

Question 4

Which THREE of the following are effective risk treatment strategies?

Accepted Answer

Avoid the risk by discontinuing the activity. Avoiding risk by discontinuing the activity is a recognized risk treatment strategy under the ISACA Risk IT framework. By ceasing the activity that introduces the risk, the organization eliminates the possibility of the risk event occurring, which is a valid and often necessary response when the risk exceeds the organization's risk appetite and cannot be cost-effectively mitigated or transferred.

Answer

Accept the risk without any analysis

Answer

Ignore the risk if it has not materialized yet

Question 5

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 6

Match each information security objective to its description.

Accepted Answer

Confidentiality: Ensures that information is not disclosed to unauthorized individuals.. The CIA triad (Confidentiality, Integrity, Availability) plus Accountability are core security principles. Correct matches: Confidentiality prevents unauthorized disclosure, Integrity ensures accuracy, Availability guarantees access, and Accountability enables traceability.

Answer

Confidentiality: Ensures that information is accurate and complete, and not modified improperly.

Answer

Integrity: Ensures that information is not disclosed to unauthorized individuals.

Question 7

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register is a foundational artifact in IT risk management, and during the identification phase, its essential components are the risk description (to uniquely identify the risk), the risk owner (to assign accountability), and the root cause (to understand the underlying source). These three elements are documented before any quantitative analysis or mitigation planning occurs, as they form the basis for subsequent risk assessment and response.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 8

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 9

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

Accepted Answer

Provides real-time detection of security events. Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Answer

Reduces the need for security staff

Answer

Is less expensive than periodic testing

Answer

Eliminates all false positives

Question 10

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Contract compliance reviews (A) are a key component because they verify that vendors are meeting agreed-upon service level agreements (SLAs), security clauses, and regulatory requirements. This ensures that contractual obligations, such as data protection standards and incident response timelines, are being enforced and that any deviations are identified and remediated. Without this review, the organization cannot confirm that the vendor's actual practices align with the risk posture agreed upon during onboarding.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation

Question 11

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

Accepted Answer

Implement automated real-time monitoring of critical configuration changes with alerts.. Implementing automated real-time monitoring of critical configuration changes with alerts would have detected the misconfiguration immediately, allowing the SOC to respond within minutes rather than days. This directly addresses the monitoring gap (24-hour review cycle) and aligns with the low risk appetite for availability. Option B is incorrect because while CAB approval improves change control, it does not improve real-time detection; the change was made without following process, so additional approval steps would not prevent a rogue administrator. Option C is incorrect because monthly access reviews are still too infrequent to catch real-time configuration changes. Option D is incorrect because training does not provide immediate detection of unauthorized changes.

Answer

Require all change requests to be approved by the change advisory board (CAB).

Answer

Increase the frequency of access reviews to monthly.

Answer

Provide additional training to cloud administrators on security policies.

Question 12

An organization is evaluating threat intelligence feeds to improve IT risk identification. Which of the following criteria should be given the HIGHEST priority when selecting a feed?

Accepted Answer

Relevance to the organization's industry and technology stack. Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Answer

Ease of integration with existing security tools

Answer

The feed's update frequency

Answer

The number of indicators provided per day

Question 13

An organization is integrating IT risk into its enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It ensures IT risks are viewed in the context of business objectives. Integrating IT risk into enterprise risk management (ERM) ensures that IT risks are evaluated in the context of business objectives, enabling prioritization of risk responses that align with strategic goals. This alignment prevents IT from operating in a silo and ensures that risk decisions support overall business value, not just technical compliance.

Answer

It allows IT to operate independently

Answer

It eliminates all IT risks

Answer

It reduces the need for IT controls

Question 14

An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?

Accepted Answer

Preventive control. Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.

Answer

Detective control

Answer

Corrective control

Answer

Directive control

Question 15

When prioritizing risk treatment actions, which factor is most important to consider alongside the risk level?

Accepted Answer

Cost-benefit analysis of controls. Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Answer

Number of stakeholders involved

Answer

Regulatory requirements only

Answer

Time required to implement controls

Question 16

An OT environment is being assessed for compliance with IEC 62443. Which TWO of the following are key security requirements of this standard?

Accepted Answer

Segmentation of networks into zones and conduits. IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

Answer

Mandatory cloud-based backup for all control systems

Answer

Annual penetration testing by an external firm

Answer

Use of AES-256 encryption for all communications

Question 17

A risk practitioner is developing risk scenarios for a new cloud service. Which THREE of the following elements should be included in a complete risk scenario?

Accepted Answer

Threat event. A complete risk scenario includes a threat actor, a threat event, and a consequence. Asset/resource is also important but not listed in the options; timing, detection, and response are supplementary. The three core elements from the list are threat actor, threat event, and consequence.

Answer

Response plan

Answer

Detection mechanism

Question 18

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 19

Based on the exhibit, which of the following is the MOST likely risk scenario?

Accepted Answer

A brute-force attack targeting the root account. The exhibit shows repeated failed login attempts for the root account, which is a classic indicator of a brute-force attack. SSH logs typically record authentication failures, and a high frequency of 'Failed password for root' entries from a single source IP strongly suggests an automated password guessing attempt. This aligns with the risk scenario of a brute-force attack targeting the root account.

Answer

A denial-of-service attack on the SSH service

Answer

A successful privilege escalation by an insider

Answer

A misconfigured firewall allowing unauthorized access

Question 20

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Accepted Answer

Data architecture. Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

Answer

Application architecture

Answer

Infrastructure architecture

Answer

Business architecture