CRISC Practice Test 22 — 15 Questions

Question 1

An organization uses the PASTA threat modeling methodology. In which stage would the team identify threat agents and their capabilities?

Accepted Answer

Threat analysis. PASTA's third stage involves profiling threat agents and their capabilities.

Answer

Define objectives

Answer

Vulnerability analysis

Answer

Decompose application

Question 2

Which of the following is a primary concern when using AI/ML models for decisions subject to regulatory oversight?

Accepted Answer

Explainability of model decisions. When AI/ML models drive decisions subject to regulatory oversight (e.g., credit, hiring, healthcare), explainability is the primary concern because regulators and affected individuals must understand how a decision was reached. Without explainability, the organization cannot demonstrate compliance with laws like GDPR Article 22 (right to explanation) or fair lending regulations, and cannot defend decisions in audits or disputes.

Answer

Adversarial attacks

Answer

Model bias

Answer

Data privacy in training

Question 3

An organization has a risk register that includes risks related to regulatory compliance, such as GDPR and SOX. The risk practitioner is now categorizing these risks. Which risk category would BEST fit these compliance-related risks?

Accepted Answer

Compliance risk. GDPR and SOX are laws and regulations, so risks tied to them are by definition compliance risks. Compliance risk captures exposure to legal penalties, sanctions, and regulatory action from failing to meet statutory or contractual obligations. Grouping GDPR and SOX under compliance risk aligns with standard CRISC risk taxonomy.

Answer

Financial risk

Answer

Operational risk

Answer

Strategic risk

Question 4

Which COBIT 2019 governance objective focuses on ensuring that the enterprise's risk appetite and tolerance are understood, articulated, and communicated, and that risk is managed appropriately?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Answer

EDM04 — Ensure Resource Optimization

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Question 5

Which control implementation activity involves updating system configurations and user access rights when a new security tool is deployed?

Accepted Answer

Change management. Deploying a new security tool requires updating system configurations and user access rights, which directly impacts the operational environment. Change management (Option D) is the formal process that governs these modifications to ensure they are authorized, tested, and documented, minimizing risk of disruption or security gaps. This aligns with the CRISC domain of Risk Response and Reporting, where controlled changes are a key risk mitigation activity.

Answer

User training

Answer

Project management

Answer

Documentation update

Question 6

Which of the following is a threat intelligence source that provides information about known exploited vulnerabilities, maintained by a government agency?

Accepted Answer

CISA KEV. The CISA Known Exploited Vulnerabilities (KEV) catalog is maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and lists vulnerabilities that have been exploited in the wild. It is a government-maintained threat intelligence source specifically focused on known exploited vulnerabilities.

Answer

OSINT

Answer

NVD

Answer

ISACs

Question 7

A multinational corporation is assessing the risk of non-compliance with GDPR. Which of the following is the BEST approach to quantify the potential fine?

Accepted Answer

Base the estimate on the organization's annual global turnover. Under GDPR, the maximum fine for non-compliance is the greater of €20 million or 4% of the organization's annual global turnover. Therefore, basing the estimate on annual global turnover directly aligns with the regulatory formula used by supervisory authorities, making it the most accurate and defensible quantification approach for potential fines.

Answer

Estimate based on the cost of cyber insurance premiums

Answer

Calculate the cost of data breach using the Ponemon Institute model

Answer

Use industry benchmarks for data breach costs

Question 8

A security operations center (SOC) uses a Security Information and Event Management (SIEM) system to continuously monitor for suspicious activities. Which type of monitoring is being performed?

Accepted Answer

Continuous monitoring. The SOC is using a SIEM system to continuously monitor for suspicious activities, which aligns with continuous monitoring. Continuous monitoring involves real-time or near-real-time collection and analysis of security events to detect threats as they occur, rather than at scheduled intervals. SIEM systems aggregate logs and alerts from various sources to provide ongoing visibility into the security posture.

Answer

Periodic control testing

Answer

Compliance audit

Answer

Vulnerability scanning

Question 9

Which of the following BEST describes the difference between a threat actor who is a 'hacktivist' and one who is an 'organized crime' actor?

Accepted Answer

Hacktivists are motivated by ideology; organized crime actors are motivated by financial gain. It accurately captures the fundamental distinction between hacktivists and organized crime actors: motivation. Hacktivists are driven by ideological, political, or social causes, and their attacks are often symbolic or aimed at raising awareness. Organized crime actors, on the other hand, are primarily motivated by financial gain, engaging in activities like ransomware, fraud, and data theft for profit. This motivational difference is a core concept in risk management, as it influences the threat's targeting, persistence, and methods.

Answer

Hacktivists target only government entities; organized crime targets only businesses

Answer

Hacktivists are always insiders; organized crime actors are external

Answer

Hacktivists use advanced persistent threats (APTs); organized crime uses commodity malware

Question 10

A company's key risk indicator (KRI) for 'failed login attempts' has exceeded its threshold by 20%. The control owner reports that a recent firewall change caused false positives. What should the risk practitioner do FIRST?

Accepted Answer

Validate the KRI data and investigate the root cause. The first step in risk management is to validate the data and understand the root cause before taking action. A KRI exceeding its threshold may be due to false positives from a firewall change, so the practitioner must confirm whether the alert is genuine. Investigating the root cause ensures that any response is based on accurate information and addresses the actual issue, rather than reacting to a symptom.

Answer

Implement additional controls to reduce failed logins

Answer

Revert the firewall change immediately

Answer

Increase the KRI threshold to eliminate false positives

Question 11

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

Accepted Answer

Include security requirements in the contract and perform regular vendor audits. The best way to address the risk that a vendor's security controls may not meet requirements is to include explicit security requirements in the contract and perform regular vendor audits. This contractual and assurance-based approach directly mitigates the risk by establishing enforceable obligations and ongoing verification. It aligns with risk management principles of treating risk through controls and monitoring rather than ignoring, transferring, or eliminating the business capability.

Answer

Deny the existence of the risk

Answer

Purchase cyber insurance to cover potential losses

Answer

Avoid using the cloud CRM system

Question 12

When assessing cloud computing risk, which of the following is a key concern related to data sovereignty?

Accepted Answer

Data may be stored in jurisdictions with different privacy laws. Data sovereignty is a key concern in cloud computing risk because data may be stored in jurisdictions with different privacy laws. This means that data could be subject to legal requirements that conflict with the organization's own compliance obligations, such as GDPR or HIPAA.

Answer

Shared responsibility model misunderstandings

Answer

Multi-tenancy isolation gaps

Answer

Vendor lock-in due to proprietary APIs

Question 13

During a risk assessment, the risk team identifies that a legacy system has multiple known vulnerabilities that cannot be patched. The system is critical for operations. Which of the following risk treatment options is MOST appropriate?

Accepted Answer

Mitigate by implementing compensating controls. Since the legacy system cannot be patched (Option B is impossible) and is critical for operations (decommissioning would disrupt the business, making Option C too drastic), the most appropriate treatment is to implement compensating controls. These controls, such as network segmentation, strict access controls, or an application-layer firewall, reduce the likelihood or impact of exploitation without modifying the vulnerable system itself, aligning with the risk mitigation strategy.

Answer

Accept the risk and monitor

Answer

Remediate by applying patches from the vendor

Answer

Avoid the risk by decommissioning the system

Question 14

Which control type is designed to stop a risk event from occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place, such as firewalls, access controls, encryption, and segregation of duties. They act before the event, reducing likelihood. This is the defining characteristic that distinguishes them from detective and corrective controls.

Answer

Detective

Answer

Compensating

Answer

Corrective

Question 15

During a threat modeling exercise for a new web application, the team uses STRIDE. Which threat type under STRIDE corresponds to an attacker modifying data in transit?

Accepted Answer

Tampering. In STRIDE, Tampering refers to the unauthorized modification of data, whether at rest or in transit. An attacker modifying data in transit (e.g., man-in-the-middle altering a message) is the canonical example of Tampering. It violates integrity.

Answer

Repudiation

Answer

Information Disclosure

Answer

Spoofing