CRISC Practice Test 21 — 15 Questions

Question 1

An energy company is integrating its IT network with OT systems for real-time monitoring. The risk manager is assessing the expanded attack surface. Which risk should be given the HIGHEST priority due to its potential for physical consequences?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Manipulation of operational parameters leading to equipment damage. In OT environments, the highest priority risk involves safety implications and physical consequences, such as an attacker manipulating operational parameters to cause equipment damage or safety incidents.

Answer

Increased number of malware infections

Answer

Unauthorized access to corporate financial systems

Answer

Denial of service affecting IT services

Question 2

Which type of control testing is typically performed on a continuous basis using automated tools?

Accepted Answer

Continuous monitoring. Continuous monitoring uses automated tools like SIEM rules, log monitoring, and vulnerability scanning to provide ongoing assurance over control effectiveness.

Answer

Annual penetration test

Answer

Manual control walkthrough

Answer

Quarterly internal audit review

Question 3

Which of the following is a common exclusion in cyber insurance policies that a risk manager should be aware of?

Accepted Answer

Acts of war. Cyber insurance policies often exclude acts of war, including state-sponsored cyber attacks. This is a critical exclusion that can leave organizations unprotected against nation-state threats.

Answer

Business interruption

Answer

Ransomware attacks

Answer

Social engineering fraud

Question 4

An organization is considering outsourcing its payroll processing to a third party. The risk assessment shows that the inherent risk of payroll errors is high, but the vendor contract includes liability clauses and the organization obtains cyber insurance. This risk treatment is best described as:

Accepted Answer

Risk transfer. Transfer involves shifting risk to a third party, such as through outsourcing with contractual liability transfer and insurance.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 5

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Accepted Answer

Expanded attack surface from IT to OT systems. Connecting OT to IT networks exposes ICS to threats from the corporate network, expanding the attack surface and potentially allowing attackers to pivot to OT systems.

Answer

Reduced network bandwidth for OT operations

Answer

Increased data storage costs

Answer

Loss of proprietary control protocols

Question 6

A risk assessment team is prioritizing risks for treatment using inherent risk ratings. Which TWO factors should be considered when deciding which risks to treat first?

Accepted Answer

Cost-benefit analysis of potential controls. Risk ranking by inherent risk score and cost-benefit analysis of controls are key factors in prioritization.

Answer

The asset's replacement value

Answer

The risk owner's department budget

Answer

The number of controls already in place

Question 7

In a risk report presented to the board of directors, which of the following elements is most appropriate to include?

Accepted Answer

Risk heat map with top risks and status. Strategic risk reporting to the board should focus on high-level information, such as a risk heat map showing top risks and their status.

Answer

Vendor security assessment scores for all vendors

Answer

Detailed weekly firewall log analysis

Answer

List of all IT incidents from the past month

Question 8

A security team is considering implementing a control to prevent unauthorized access to a critical database. Which type of control is most appropriate for this objective?

Accepted Answer

Preventive control. Preventive controls are designed to stop an incident from occurring. In this case, preventing unauthorized access aligns with a preventive control.

Answer

Corrective control

Answer

Detective control

Answer

Directive control

Question 9

A risk manager is using a 5x5 heat map to assess IT risks. Which of the following best describes the primary limitation of this qualitative risk analysis approach?

Accepted Answer

It is subjective and not comparable across organizations.. Qualitative risk analysis using heat maps is subjective and results are not comparable across different organizations due to varying risk appetites and cultural interpretations.

Answer

It requires extensive historical data to be accurate.

Answer

It is time-consuming and complex to implement.

Answer

It provides objective, financially meaningful results.

Question 10

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

Accepted Answer

Tactical risk reporting. Quarterly reporting to the CISO/CIO is considered tactical risk reporting, focusing on decisions affecting the IT portfolio.

Answer

Executive risk reporting

Answer

Operational risk reporting

Answer

Strategic risk reporting

Question 11

Which of the following is a key element of promoting a risk-aware culture within an IT department?

Accepted Answer

Establishing an anonymous incident reporting system. A risk-aware culture encourages employees to report incidents and near-misses without fear of blame, fostering learning and improvement.

Answer

Outsourcing risk management to a third party

Answer

Conducting annual performance reviews

Answer

Requiring employees to sign non-disclosure agreements

Question 12

In a qualitative risk assessment, a risk owner argues that the likelihood of a cyberattack is low because the organization has strong perimeter defenses. However, the analyst notes that the impact would be catastrophic. Which limitation of qualitative analysis is most relevant?

Accepted Answer

It relies on subjective judgments. Qualitative analysis is subjective; different stakeholders may interpret likelihood and impact differently based on their perspectives. The risk owner's judgment may be biased by existing controls.

Answer

It is not comparable across organizations

Answer

It is time-consuming and data-intensive

Answer

It does not produce financial values

Question 13

When implementing a new control, which of the following is the most important factor in ensuring its long-term effectiveness?

Accepted Answer

Updating documentation. Documentation updates ensure that the control operates correctly and can be maintained, audited, and improved over time.

Answer

Selecting a control owner

Answer

Conducting user training

Answer

Performing cost-benefit analysis

Question 14

A risk practitioner is designing an IT risk management programme. Which of the following is the BEST sequence of components to establish?

Accepted Answer

Risk management policy, risk assessment methodology, risk register, risk treatment process, risk reporting. A logical order is to first define policy, then methodology, then risk register, then treatment process, and finally reporting. However, the question asks for the best sequence among options. Typically, policy comes first, then methodology, then risk register, then treatment, then reporting.

Answer

Risk register, risk assessment methodology, risk treatment process, risk reporting, risk management policy

Answer

Risk assessment methodology, risk register, risk treatment process, risk management policy, risk reporting

Answer

Risk reporting, risk management policy, risk assessment methodology, risk register, risk treatment process

Question 15

During a solution architecture review, the Architecture Review Board (ARB) identifies that a new application communicates with a legacy system using plain text over a public network. Which risk treatment option is MOST appropriate?

Accepted Answer

Require encryption (e.g., TLS) for the communication. The risk of data exposure can be mitigated by implementing encryption, such as TLS, to protect data in transit.

Answer

Transfer the risk to a third-party vendor

Answer

Accept the risk because the legacy system cannot be changed

Answer

Decommission the legacy system immediately