CRISC Practice Exam 4 — 20 Questions

Question 1

Which control type is primarily focused on identifying that a risk event has occurred?

Accepted Answer

Detective. Detective controls are designed to detect incidents after they happen.

Answer

Compensating

Answer

Preventive

Answer

Corrective

Question 2

During a risk assessment, the IT risk manager needs to prioritize risks for treatment. Which of the following risk characteristics should be weighted MOST heavily?

Accepted Answer

The degree to which the risk affects strategic business objectives. In CRISC, risk prioritization is fundamentally driven by alignment with strategic business objectives because IT risk management exists to protect the enterprise’s mission and goals. Even a high-likelihood or high-financial-impact risk may be deprioritized if it does not materially affect the organization’s strategic objectives, as the risk treatment decision must support business value and continuity. This weighting ensures that resources are allocated to risks that most threaten the enterprise’s ability to achieve its core mission.

Answer

The ease of implementing mitigating controls

Answer

The likelihood that the threat will be exploited

Answer

The financial impact calculated in monetary terms

Question 3

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. A fine for violating GDPR is a direct consequence of failing to meet a legal/regulatory obligation, which is the definition of compliance risk. Compliance risk encompasses penalties, sanctions, and legal actions arising from non-conformance with laws, regulations, and standards. Although the fine is monetary, its root cause is regulatory non-compliance, so it belongs in the compliance category.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 4

Based on the exhibit, which aspect of risk monitoring is MOST concerning?

Accepted Answer

The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.. The vulnerability has been open for three months with a patch available, yet there is no evidence of monitoring or remediation. This indicates a complete breakdown of the risk monitoring process, as the organization failed to track, escalate, or patch a known critical vulnerability, leaving the system exposed to exploitation. In risk monitoring, the absence of any monitoring activity or remediation action over such a long period is far more concerning than the severity alone, as it reflects a systemic failure in the control environment.

Answer

The vulnerability severity is critical.

Answer

The last scan was three months after the initial detection.

Answer

The risk was accepted by the system owner.

Question 5

A hospital's IT risk manager is preparing a quarterly risk report for the executive committee. The report currently lists 240 technical vulnerabilities with CVSS scores but no business context. The CIO asks for a report that helps executives decide where to allocate limited remediation funding. Which change best aligns the report with risk response and reporting objectives?

Accepted Answer

Group vulnerabilities by the business processes and assets they affect, and express exposure in terms of potential impact and likelihood.. Risk reporting to executives must translate technical findings into business language. Grouping vulnerabilities by affected processes and assets and expressing exposure through impact and likelihood gives leaders the context needed to prioritize remediation spending against organizational objectives. Raw counts, technical artifacts, or alphabetical ordering do not support funding decisions because they omit the business consequences that drive risk-based prioritization.

Answer

Report only the total count of vulnerabilities and the percentage remediated within the past quarter.

Answer

Sort the vulnerabilities alphabetically by vendor name so the report is easier to navigate.

Answer

Increase the report's technical depth by including exploit code snippets and packet captures for each vulnerability.

Question 6

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Accepted Answer

Inability to apply security patches due to legacy firmware. IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Answer

Interference with radio frequency signals

Answer

Limited data storage capacity

Answer

High power consumption leading to operational costs

Question 7

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. The root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 8

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is lower than inherent risk because the three controls (preventive, detective, corrective) do reduce the risk, but it remains significant because weak operating effectiveness — inconsistent patching — means the controls are not functioning as designed. Design adequacy alone does not guarantee risk reduction; actual operating effectiveness determines the true residual level.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 9

An international bank is expanding its operations into a new country with strict data localization laws. The IT department plans to use a cloud service provider that stores data in neighboring countries but promises compliance. The risk team has identified several potential risks: regulatory fines for non-compliance, data interception during cross-border transmission, and difficulty in auditing the cloud provider. The legal team advises that the contract includes data protection clauses, but these have not been tested. The risk manager must now prioritize risk identification efforts. What is the MOST important risk identification step the risk team should undertake?

Accepted Answer

Perform a regulatory compliance assessment specific to the new country's laws.. The most critical risk identification step when entering a new country with strict data localization laws is to perform a regulatory compliance assessment specific to that country's laws. This ensures the bank understands the exact legal requirements for data storage, processing, and transfer, which directly informs whether the cloud provider's promised compliance is achievable. Without this assessment, the risk team cannot accurately identify the scope and severity of regulatory fines or other legal risks.

Answer

Review the cloud provider's SOC 2 report.

Answer

Conduct a thorough legal review of the contract's data handling clauses.

Answer

Map data flows to ensure all data is properly classified.

Question 10

A company has implemented a key risk indicator (KRI) for system availability, with a threshold of 99.5%. The monitoring team observes that availability has dropped to 99.2% for two consecutive months. What is the most appropriate next step?

Accepted Answer

Notify the risk owner and initiate a root cause analysis.. A sustained breach of a KRI threshold (99.2% vs. 99.5%) for two consecutive months indicates a systemic issue that requires formal risk management action. The risk owner must be notified to assess the impact, and a root cause analysis (RCA) should be initiated to identify underlying failures—such as network congestion, hardware faults, or software bugs—before any remediation is planned.

Answer

Implement additional redundancy to improve availability.

Answer

Increase the threshold to 99.0% to avoid false alarms.

Answer

Escalate immediately to the board of directors.

Question 11

An organization decides to outsource its data center operations to a third party. This is an example of which risk response?

Accepted Answer

Risk transfer. Outsourcing data center operations transfers the financial and operational risks associated with managing the infrastructure to a third-party provider. This is a classic risk transfer response because the organization retains ownership of the data and business accountability but shifts the liability for physical security, hardware maintenance, and uptime to the vendor via contractual agreements, such as SLAs with penalty clauses.

Answer

Risk reduction

Answer

Risk acceptance

Answer

Risk avoidance

Question 12

An organization is designing a risk and control monitoring program for a new cloud-based application. Which of the following is the MOST important factor to consider when selecting Key Risk Indicators (KRIs)?

Accepted Answer

Alignment with strategic objectives.. Alignment with strategic objectives is the most important factor because KRIs must directly measure risks that could impede the organization's business goals and strategic initiatives. For a new cloud-based application, KRIs tied to strategic objectives ensure monitoring focuses on risks that matter most to the business, such as data breaches affecting customer trust or service downtime impacting revenue, rather than irrelevant metrics.

Answer

Historical loss data availability.

Answer

Ease of automated data collection.

Answer

Industry best practices.

Question 13

During a VAST threat modeling session for a DevSecOps pipeline, the team focuses on threats that align with agile development. Which of the following is a key advantage of VAST?

Accepted Answer

It is tailored for use in agile and DevOps environments. VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Answer

It requires detailed system architecture upfront

Answer

It replaces the need for vulnerability scanning

Answer

It focuses on compliance requirements only

Question 14

An organization is implementing a new data loss prevention (DLP) solution. The risk manager is identifying potential risks related to the DLP solution itself. Which of the following is a risk that should be considered?

Accepted Answer

The DLP solution may generate a high volume of false positives, causing alert fatigue and missed real incidents.. A DLP solution may generate false positives, leading to alert fatigue and missed detections. Option B is a benefit, not a risk. Option C is a control. Option D is a desired outcome.

Answer

The DLP solution will reduce the risk of data exfiltration.

Answer

The DLP solution will block all unauthorized data transfers.

Answer

The DLP solution will automatically encrypt sensitive data in transit.

Question 15

An organization is reviewing its enterprise architecture to identify risks. In which IT architecture layer would a risk related to data classification and data sovereignty be primarily addressed?

Accepted Answer

Data architecture layer. Data classification and data sovereignty are concerns about how data is categorized, where it resides, and which legal/regulatory jurisdictions govern it — all of which are addressed in the data architecture layer. This layer defines data models, ownership, retention, classification schemes, and cross-border data flow rules. Risk related to sovereignty (e.g., GDPR data residency) is fundamentally a data architecture design issue.

Answer

Application architecture layer

Answer

Business architecture layer

Answer

Infrastructure/Technology architecture layer

Question 16

An organization is planning for post-quantum cryptography migration. Which THREE of the following are key considerations for this migration?

Accepted Answer

Inventory of all cryptographic assets and dependencies. A comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

Answer

Replacing all existing hardware immediately

Answer

Eliminating cloud services to reduce risk

Question 17

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Accepted Answer

CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.. The most likely explanation for the gap between CSA self-reported effectiveness (80%) and audit-observed failure (30%) is that CSA participants assess controls subjectively and may overestimate effectiveness due to familiarity, optimism, or lack of objectivity, whereas internal audit tests controls using independent, evidence-based procedures. This perception bias is a well-documented limitation of self-assessment. The other options introduce speculative factors (timing, training, scope) that are not supported by the scenario.

Answer

The audit was conducted three months after the CSA, and controls may have degraded.

Answer

CSA participants lacked adequate training on what constitutes a control failure.

Answer

The CSA covered a different scope of controls than the audit.

Question 18

During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?

Accepted Answer

Perform an on-site technical assessment and interview key IT staff. An on-site technical assessment combined with interviews of key IT staff is the most effective technique because it uncovers undocumented risks, shadow IT, cultural issues, and technical debt that documents and scans alone cannot reveal. Interviews provide context about how systems are actually used versus how they are documented, and on-site observation can expose physical and operational risks.

Answer

Analyze the target's existing risk register

Answer

Review the target's IT policies and procedures

Answer

Conduct a network vulnerability scan

Question 19

A global organization is consolidating risk data from multiple business units into a single enterprise risk management (ERM) system. The risk practitioner notices that KRIs for the same risk type (e.g., cybersecurity) are calculated differently across units. What is the BEST approach to ensure consistent and reliable risk monitoring and reporting?

Accepted Answer

Establish a common definition and calculation methodology for each KRI across all business units.. Consistent risk monitoring and reporting requires a standardized definition and calculation methodology for each KRI across all business units. Without this common baseline, the aggregated risk data in the ERM system will be incomparable and unreliable, leading to flawed decision-making. Establishing common definitions ensures that the same risk type (e.g., cybersecurity) is measured uniformly, enabling accurate trend analysis and risk aggregation.

Answer

Require all units to adopt a common set of key performance indicators for their control environment.

Answer

Allow each business unit to maintain its own KRI definitions but report explanations for variances.

Answer

Implement automated data feeds from each unit's system to the ERM system without changing the KRI definitions.

Question 20

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed