CRISC Practice Test 21 — 15 Questions

Question 1

An organization uses the PASTA threat modeling methodology for a new e-commerce platform. Which of the following is a key characteristic of PASTA?

Accepted Answer

It emphasizes business impact analysis and attack simulation. PASTA (Process for Attack Simulation and Threat Analysis) is a seven-stage, risk-centric threat modeling methodology that explicitly aligns technical threats with business objectives. Its defining characteristic is that it starts from business impact analysis and uses attack simulation to validate which threats actually matter. This business-impact-first, adversary-simulation approach distinguishes it from code-centric or diagram-centric models.

Answer

It is a requirements-based model that uses a risk management perspective

Answer

It uses visual diagrams to represent threats in an agile manner

Answer

It focuses on agile development and integrates with DevSecOps

Question 2

A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?

Accepted Answer

Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.. The best course of action balances risk mitigation, business continuity, and compliance. Implementing a compensating control such as a web application firewall reduces the immediate exposure of the vulnerability while allowing the patch to be scheduled during off-peak hours within a short timeframe (48 hours), avoiding both peak-hour downtime and prolonged exposure. This aligns with CRISC's emphasis on risk response options that are proportionate and timely, and it addresses the CEO's PCI DSS compliance concern by reducing the window of non-compliance.

Answer

Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.

Answer

Accept the risk and schedule the patch during the next maintenance window as originally planned.

Answer

Apply the patch immediately during peak hours, accepting the revenue loss from downtime.

Question 3

During an IT risk assessment, the risk owner decides to accept a risk that falls within the organization's risk appetite. Which of the following actions is most appropriate for the risk owner to take?

Accepted Answer

Document the risk and obtain formal sign-off from the risk owner.. When a risk falls within the organization's risk appetite, the most appropriate action is to formally accept it. The risk owner must document the risk and obtain formal sign-off to ensure accountability and auditability, as required by the risk management framework. This aligns with the principle that risks within appetite do not require additional treatment beyond formal acceptance.

Answer

Eliminate the business process that creates the risk.

Answer

Transfer the risk to a third party via insurance.

Answer

Implement additional controls to reduce the risk to zero.

Question 4

A security analyst is reviewing CVE entries and NVD data to identify vulnerabilities in software assets. This activity is part of which vulnerability identification approach?

Accepted Answer

Asset-based vulnerability identification. Reviewing CVE entries and NVD data to identify vulnerabilities in software assets is asset-based vulnerability identification, because it maps known vulnerabilities to specific inventoried assets. The approach starts from the asset inventory and correlates it with vulnerability databases. Configuration, application, and operational categories describe different scopes, not the CVE/NVD correlation activity.

Answer

Configuration vulnerability assessment

Answer

Application vulnerability identification

Answer

Operational vulnerability identification

Question 5

A risk assessment identifies a critical vulnerability in a web application. Which control type would be most effective in preventing exploitation of this vulnerability?

Accepted Answer

Preventive control such as patching the vulnerability. A preventive control stops an incident before it occurs, and patching the vulnerability removes the exploitable condition entirely, which is the most effective way to prevent exploitation. Since the vulnerability is identified as critical, remediation via patching directly addresses the root cause rather than merely detecting or recovering from an exploit.

Answer

Compensating control such as additional monitoring

Answer

Corrective control such as backup restoration

Answer

Detective control such as log monitoring

Question 6

An organization is developing a new cloud-based application that will process personal data of EU citizens. The risk manager is assessing the shared responsibility model with the cloud service provider (CSP). Which of the following is the MOST critical risk to address in the risk assessment?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. When processing EU citizens' personal data in the cloud, the most critical risk is data sovereignty and cross-border transfer restrictions under GDPR. The regulation limits transfers of personal data outside the EU/EEA unless adequate safeguards (e.g., Standard Contractual Clauses, adequacy decisions) are in place. A CSP may store or replicate data in regions the organization did not intend, creating legal exposure that outweighs the other technical risks.

Answer

Lack of encryption at rest

Answer

Vendor lock-in due to proprietary APIs

Answer

Multi-tenancy isolation failures

Question 7

A company uses the FAIR model to perform a quantitative risk analysis. The threat event frequency (TEF) is estimated at 10 per year, vulnerability (V) is 0.5, and loss magnitude (LM) per event is $50,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. In the FAIR model, ALE = TEF × Vulnerability × Loss Magnitude. Here, TEF = 10, V = 0.5, LM = $50,000. So ALE = 10 × 0.5 × $50,000 = $250,000. This represents the expected annual loss from the risk event.

Answer

$25,000

Answer

$50,000

Answer

$500,000

Question 8

You are the risk manager for a healthcare organization that uses an electronic health records (EHR) system. The system has a built-in audit log that records all access to patient data. Recently, the Chief Information Security Officer (CISO) raised a concern that there have been multiple reports of unauthorized access to patient records, but the audit log analysis has not identified any suspicious activity. You have been asked to investigate. Your review of the audit log configuration reveals that the system only logs successful access events, not failed access attempts. Additionally, the log retention period is set to 30 days, and the logs are stored in a flat file on the same server as the EHR application. The monitoring team manually reviews the logs at the end of each month. Which of the following is the MOST significant risk associated with the current monitoring approach?

Accepted Answer

Storing logs on the same server as the EHR application exposes them to alteration or deletion if the server is compromised.. Storing audit logs on the same server as the EHR application violates the principle of log segregation. If the server is compromised, an attacker can alter or delete the logs to cover their tracks, making detection impossible. This is the most significant risk because it directly undermines the integrity and availability of the evidence needed to investigate unauthorized access.

Answer

The 30-day log retention period is too short to detect long-term patterns of unauthorized access.

Answer

Manual review of logs is ineffective and may miss critical events; automated monitoring should be implemented.

Answer

The audit log does not capture failed access attempts, which could indicate brute-force attacks or unauthorized access attempts.

Question 9

During a merger and acquisition (M&A) due diligence, the IT risk manager needs to identify risks in the target company's IT environment. Which approach is most effective for comprehensive risk identification?

Accepted Answer

Conduct an on-site assessment of the target's IT infrastructure. An on-site assessment (Option D) allows the IT risk manager to directly observe the target's IT infrastructure, including physical security, network configurations, and operational practices. This hands-on approach uncovers risks that may be hidden or misrepresented in self-reported questionnaires, such as outdated firmware, unpatched systems, or insecure network segmentation. It provides the most comprehensive and accurate risk identification for M&A due diligence.

Answer

Send a detailed questionnaire to the target's IT department

Answer

Review the target's public financial reports

Answer

Conduct a war gaming exercise

Question 10

A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?

Accepted Answer

Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.. The residual risk is a sophisticated phishing attack that could bypass MFA, and the board has a low risk appetite, so the risk must be reduced rather than transferred or accepted. Implementing phishing-resistant MFA such as FIDO2/WebAuthn (hardware security keys or passkeys) removes the shared-secret and OTP weaknesses that phishing kits exploit, and pairing it with ongoing phishing simulation training hardens the human layer. This directly addresses the specific residual risk while preserving the business value of the online banking platform.

Answer

Purchase cyber insurance to transfer the financial impact of a potential phishing attack.

Answer

Reduce the project scope to exclude online banking and revert to a less risky channel.

Answer

Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.

Question 11

A Key Risk Indicator (KRI) that shows a rising trend in the average time to apply critical security patches suggests:

Accepted Answer

Increasing risk of exploitation. A rising trend in the average time to apply critical security patches indicates that systems remain vulnerable for longer periods, increasing the likelihood of exploitation. This is a lagging indicator of control effectiveness and directly points to increased risk.

Answer

Decreasing risk of exploitation

Answer

Stable risk level

Answer

Improved control effectiveness

Question 12

A new privacy regulation requires that all personal data be encrypted at rest. The current systems lack encryption. The cost to implement encryption is moderate, and the risk of non-compliance is high. Which risk response is most appropriate?

Accepted Answer

Mitigate by implementing encryption. Mitigating the risk by implementing encryption is the most appropriate response because the cost is moderate and the risk of non-compliance is high. Encryption directly addresses the regulatory requirement and reduces the risk to an acceptable level. This aligns with risk management principles where high-impact risks with feasible controls should be mitigated.

Answer

Accept the risk

Answer

Avoid by discontinuing data processing

Answer

Transfer via cyber insurance

Question 13

Which of the following best describes residual risk?

Accepted Answer

Risk after assessing control effectiveness. Residual risk is the risk that remains after management has implemented risk responses and assessed the effectiveness of existing controls. It is calculated by considering the inherent risk (risk without controls) and the risk reduction provided by controls, factoring in control gaps or weaknesses. Option D correctly captures this definition by emphasizing the assessment of control effectiveness.

Answer

Risk that is transferred to a third party

Answer

Risk that is avoided by eliminating the activity

Answer

Risk without any controls in place

Question 14

When performing asset-based vulnerability identification, a security analyst uses the Common Vulnerabilities and Exposures (CVE) database along with the National Vulnerability Database (NVD). Which of the following BEST describes the relationship between CVE and NVD?

Accepted Answer

CVE provides unique identifiers for vulnerabilities, and NVD provides additional analysis including CVSS scores.. CVE (Common Vulnerabilities and Exposures) is a dictionary that assigns a unique identifier (e.g., CVE-2024-12345) to each publicly disclosed vulnerability, providing a common naming standard. NVD (National Vulnerability Database), maintained by NIST, consumes CVE records and enriches them with CVSS base scores, CWE classifications, CPE applicability statements, and references. So CVE provides the identifier and NVD provides the analysis and scoring.

Answer

Both databases are identical and maintained by the same organization.

Answer

CVE is the authoritative source for vulnerability scoring, while NVD assigns identifiers.

Answer

NVD lists only vulnerabilities that are actively exploited, while CVE lists all known vulnerabilities.

Question 15

A company identifies a high inherent risk in its online payment system. After implementing a Web Application Firewall (WAF) and conducting quarterly penetration tests, the residual risk is assessed as medium. Which of the following best explains the relationship between inherent risk, controls, and residual risk?

Accepted Answer

Residual risk is the inherent risk adjusted for the effectiveness of controls in reducing likelihood and impact.. Residual risk is defined as the risk that remains after controls have been applied to reduce the likelihood and/or impact of a threat exploiting a vulnerability. In this scenario, the high inherent risk was reduced to medium residual risk by the WAF and quarterly penetration tests, which is exactly the relationship described. This is the foundational risk equation in CRISC and ISO 31000.

Answer

Inherent risk is the risk after controls are applied, while residual risk is the risk before controls.

Answer

Residual risk equals inherent risk minus the total cost of controls implemented.

Answer

Inherent risk and residual risk are independent; residual risk is determined solely by threat intelligence.