CRISC Practice Exam 4 — 20 Questions

Question 1

An organization is performing a risk assessment for its new customer relationship management (CRM) system. Which of the following is the BEST way to identify threats to the CRM?

Accepted Answer

Conduct a threat modeling workshop with the development team.. Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

Answer

Perform a vulnerability scan on the CRM server.

Answer

Run a penetration test against the CRM application.

Answer

Review the business impact analysis for the CRM.

Question 2

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

Accepted Answer

Risk mitigation. Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 3

A hospital uses a patient portal that allows patients to access their medical records. The portal has experienced multiple brute-force login attempts. The risk manager wants to identify the most critical risk scenario. Which of the following should be prioritized?

Accepted Answer

Unauthorized access to patient medical records.. The most critical risk scenario from brute-force login attempts is unauthorized access to patient medical records, as this directly compromises patient privacy and violates HIPAA regulations. While denial of service is a concern, the primary impact of successful brute-force attacks is data breach, not service availability. The risk manager must prioritize the confidentiality of protected health information (PHI) over other operational risks.

Answer

Denial of service due to excessive login attempts.

Answer

Insufficient encryption of data in transit.

Answer

Phishing attacks targeting portal users.

Question 4

A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?

Accepted Answer

Document the vulnerability and assess the associated risk in the risk register. The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

Answer

Apply a virtual patch via an intrusion prevention system

Answer

Isolate the application from the network

Answer

Notify the application owner and request an emergency patch

Question 5

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 6

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. A high false positive rate in a detective control leads to alert fatigue, where security personnel may ignore or dismiss alerts, increasing the risk that actual security incidents are missed. Option A is a consequence but not the most significant. Option C may occur but is secondary. Option D is an operational impact but does not directly increase risk.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 7

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. The primary purpose of a business impact analysis (BIA) is to identify critical business processes, determine their recovery priorities, and establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Option B is incorrect because identifying vulnerabilities is part of a vulnerability assessment, not a BIA. Option C is incorrect because identifying potential threat actors is part of threat modeling. Option D is incorrect because inventorying IT assets is part of asset management, not the primary goal of a BIA.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 8

A multinational corporation is conducting a risk assessment for its new online payment platform. The platform processes transactions in multiple currencies and stores sensitive customer financial data. The risk team has identified that the encryption algorithm used for data at rest is outdated and could be vulnerable to advanced attacks. The company's risk appetite is low for data breaches. The security team recommends upgrading the encryption to a modern standard, but the upgrade will require a 48-hour downtime impacting all global transactions. The business unit is concerned about revenue loss during the downtime. As the risk practitioner, what is the BEST course of action to balance security and business continuity?

Accepted Answer

Plan the upgrade during a low-traffic period and implement compensating controls such as additional monitoring during the downtime.. The best course of action because it balances the need to mitigate a high-risk encryption vulnerability with business continuity. By scheduling the upgrade during a low-traffic period and implementing compensating controls (e.g., enhanced monitoring and intrusion detection), the organization reduces the likelihood of exploitation during the 48-hour downtime while minimizing revenue loss. This aligns with the low risk appetite for data breaches and demonstrates a risk-based decision that treats the vulnerability without accepting unacceptable exposure.

Answer

Accept the risk and delay the upgrade until the next scheduled maintenance window in three months.

Answer

Outsource the payment processing to a third-party vendor that already uses modern encryption.

Answer

Implement the upgrade immediately to mitigate the vulnerability, accepting the revenue loss.

Question 9

Which of the following is an example of a 'configuration vulnerability' that should be identified during vulnerability assessment?

Accepted Answer

Default administrative passwords left unchanged on a network device. A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

Answer

A buffer overflow in a custom application

Answer

An SQL injection flaw in a web form

Answer

Missing security patches on a server

Question 10

Which TWO of the following are examples of risk avoidance?

Accepted Answer

Migrating to a different technology platform. Migrating to a different technology platform (Option D) is a risk avoidance strategy because it eliminates the risk entirely by moving away from the vulnerable or high-risk technology. For example, if an organization uses an outdated operating system with known unpatched vulnerabilities, migrating to a modern, supported platform removes the attack surface, avoiding the risk rather than mitigating or transferring it.

Answer

Implementing a firewall

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Question 11

A risk manager is reviewing the control monitoring reports and finds that a key control's effectiveness rating has dropped from 'effective' to 'partially effective' due to increased errors in manual data entry. Which of the following is the BEST course of action?

Accepted Answer

Conduct a root cause analysis to identify why errors increased.. A root cause analysis (RCA) is the best course of action because it systematically identifies the underlying reasons for the increased manual data entry errors, such as inadequate training, unclear procedures, or system interface issues. Without understanding the root cause, any corrective action (like automation or additional staff) may address symptoms rather than the actual problem, leading to wasted resources or recurring control failures. This aligns with the CRISC principle that control effectiveness must be restored by addressing the fundamental cause of degradation, not just the symptoms.

Answer

Immediately implement an automated data entry solution.

Answer

Increase the frequency of monitoring to detect errors sooner.

Answer

Assign additional staff to double-check data entries.

Question 12

A risk practitioner is facilitating a workshop to identify IT risks for a new product launch. Which technique BEST encourages participants to think about risks from different perspectives?

Accepted Answer

Using a structured framework such as STRIDE or OCTAVE.. A structured framework like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) or OCTAVE provides predefined threat categories that force participants to systematically consider risks from multiple angles—such as security, operational, and compliance perspectives—rather than relying on ad hoc thinking. This ensures comprehensive coverage of the attack surface for the new product launch, including often-overlooked areas like repudiation or elevation of privilege in cloud-based microservices.

Answer

Asking each participant to write risks individually.

Answer

Using a checklist of common IT risks.

Answer

Brainstorming without any predefined categories.

Question 13

A risk manager decides to accept a risk because the cost of controls exceeds the potential loss. Which of the following is required for this risk treatment option?

Accepted Answer

Formal sign-off by the risk owner. When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Answer

Elimination of the business process

Answer

Transfer of risk via insurance

Answer

Implementation of compensating controls

Question 14

Which of the following is the BEST example of a key risk indicator (KRI) for the risk of unauthorized access to sensitive data?

Accepted Answer

Percentage of users with access to sensitive data. A KRI must directly measure the likelihood or impact of a specific risk. The percentage of users with access to sensitive data is a direct indicator of the attack surface for unauthorized access; a higher percentage increases the probability that an unauthorized user could gain access, making it a leading indicator for that risk.

Answer

Average server uptime

Answer

Number of firewalls deployed

Answer

Number of security awareness trainings completed

Question 15

You are the risk manager at a financial institution that processes online transactions. The organization relies on a legacy system for transaction authorization, which is monitored via manual log reviews performed weekly by a junior analyst. Recently, the internal audit team identified that several unauthorized transactions were not detected for over two weeks. The logs showed that the authorization control failed intermittently due to a known software bug, but the bug had been documented in the risk register with a low residual risk rating. The CRO asks you to recommend the most effective improvement to the control monitoring process. Which of the following would be the BEST course of action?

Accepted Answer

Implement an automated real-time monitoring tool that alerts on authorization failures.. Implementing an automated real-time monitoring tool that alerts on authorization failures directly addresses the root cause: the detection delay caused by manual weekly log reviews. Unlike manual reviews, automated monitoring provides immediate notification of control failures, enabling rapid response to intermittent software bugs and reducing the window of exposure for unauthorized transactions.

Answer

Increase the frequency of log reviews to daily.

Answer

Update the risk register to increase the residual risk rating for the bug.

Answer

Retrain the junior analyst on log analysis techniques.

Question 16

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 17

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Accepted Answer

Likelihood. In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Answer

Risk appetite

Answer

Cost of mitigation

Answer

Control effectiveness

Question 18

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 19

An organization decides to outsource its data center operations to a cloud provider with strict contractual penalties for security breaches. This is an example of which risk treatment option?

Accepted Answer

Transfer. Transferring risk shifts the financial consequences to a third party, such as through outsourcing or insurance.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 20

A manufacturing company's board of directors receives a monthly risk report. Which key performance indicator (KPI) is MOST relevant for the board to assess the effectiveness of internal controls?

Accepted Answer

Percentage of control tests passed within the reporting period.. The percentage of control tests passed within the reporting period directly measures the operational effectiveness of internal controls, which is the board's primary concern for risk mitigation. This KPI provides a quantifiable, trendable metric that reflects whether controls are functioning as designed to reduce residual risk to an acceptable level.

Answer

Number of audit findings per business unit.

Answer

Number of risk assessments completed this month.

Answer

Percentage of employees completing annual compliance training.