CRISC Practice Test 22 — 15 Questions

Question 1

A bank is evaluating the impact of a potential system outage. Which of the following is an example of a direct financial cost associated with this impact?

Accepted Answer

Cost of system restoration. Direct financial costs include incident response, recovery, and notification costs.

Answer

Share price decline

Answer

Regulatory fines

Answer

Loss of customer trust

Question 2

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is inherent risk adjusted for control effectiveness. Weak operating effectiveness means controls are not fully effective, so residual risk remains relatively high.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 3

Which of the following is a Key Risk Indicator (KRI) that provides leading indication of increasing vulnerability risk?

Accepted Answer

Patch lag metric. Patch lag (time since last patch) is a leading indicator that systems are exposed to known vulnerabilities.

Answer

Control deficiency rate

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 4

After implementing a set of controls, the risk owner calculates the residual risk. Which of the following is true about residual risk?

Accepted Answer

It is the risk that remains after controls are applied. Residual risk is the risk remaining after controls are applied, and it should be within the risk appetite.

Answer

It is not considered in risk treatment decisions

Answer

It is always higher than inherent risk

Answer

It is the risk before any controls are implemented

Question 5

A vendor is classified as 'critical' based on its access to sensitive data and the criticality of its service. According to best practices, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. For critical vendors, the risk appetite typically requires a SOC 2 Type II report, which provides assurance over controls related to security, availability, processing integrity, confidentiality, and privacy.

Answer

Annual self-assessment questionnaire

Answer

Penetration test results from the vendor

Answer

ISO 27001 certificate

Question 6

An organization is implementing a new control to address a high-risk vulnerability. Which TWO factors are MOST important to consider during the control implementation planning phase?

Accepted Answer

Resource requirements. Resource requirements (budget, personnel) and a clear implementation plan are critical to successful deployment.

Answer

Vendor reputation

Answer

Industry best practices

Answer

Number of previous incidents

Question 7

An organization has a risk culture where employees are hesitant to report security incidents due to fear of blame. Which of the following initiatives would MOST effectively promote a risk-aware culture?

Accepted Answer

Establish a confidential incident reporting system with a no-blame policy. To encourage incident reporting, the organization should foster a no-blame culture. Implementing an anonymous reporting mechanism removes fear of reprisal and encourages employees to report incidents without fear of blame.

Answer

Increase the frequency of security awareness training

Answer

Conduct more frequent audits to detect unreported incidents

Answer

Discipline employees who fail to report incidents

Question 8

Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?

Accepted Answer

IEC 62443. IEC 62443 is the international standard for industrial automation and control systems security, covering security for IACS across multiple levels.

Answer

ISO 27001

Answer

NERC CIP

Answer

NIST SP 800-53

Question 9

An organization is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, the vulnerability is 0.2, and the loss magnitude is $500,000 per event. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. ALE = ARO × SLE. In FAIR, LEF = TEF × Vulnerability = 10 × 0.2 = 2 events per year. SLE is the loss magnitude per event, $500,000. ALE = 2 × $500,000 = $1,000,000.

Answer

$500,000

Answer

$5,000,000

Answer

$100,000

Question 10

Which of the following best describes the purpose of a risk heat map in an IT risk report?

Accepted Answer

To provide a visual representation of the likelihood and impact of risks. A risk heat map visually displays risks based on likelihood and impact, helping to prioritize and communicate risk levels.

Answer

To list the top risks in order of priority

Answer

To illustrate the relationship between risks and controls

Answer

To show the cost of controls

Question 11

An organization is planning to adopt post-quantum cryptography. Which TWO considerations are MOST important for migration planning?

Accepted Answer

Assess the cryptographic agility of current systems. Migration must prioritize systems with long-term data sensitivity and assess cryptographic agility to adapt to new standards.

Answer

Evaluate the cost of quantum computers

Answer

Train employees on quantum physics

Answer

Purchase quantum-resistant hardware immediately

Question 12

An organization is considering cyber insurance to transfer residual risk. Which factor would MOST significantly influence the premium?

Accepted Answer

Security controls and incident history. Insurers assess the organization's security controls and past incidents to determine risk level, which directly affects premium.

Answer

Industry sector

Answer

Company revenue

Answer

Number of employees

Question 13

A company is considering outsourcing its data center operations to a cloud provider. Which risk treatment option is the company primarily exercising?

Accepted Answer

Risk transfer. Outsourcing shifts the risk of managing the data center to a third party, which is risk transfer. Contractual liability may also be transferred.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 14

An organization decides to discontinue a high-risk business process that cannot be effectively mitigated. This is an example of which risk treatment option?

Accepted Answer

Risk avoidance. Avoidance involves eliminating the activity that creates the risk, thus removing the risk entirely.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk mitigation

Question 15

Which of the following is an example of a corrective control?

Accepted Answer

Incident response plan. Corrective controls respond to and recover from risk events. Incident response procedures are corrective because they address incidents after they occur.

Answer

Access control list

Answer

Security awareness training

Answer

Log monitoring