CRISC Practice Test 23 — 15 Questions

Question 1

A risk assessment reveals that the likelihood of a phishing attack is high, and the impact is moderate. The organization decides to implement security awareness training and email filtering. This is an example of which risk treatment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk mitigation. Risk mitigation (also called risk reduction) involves taking actions to reduce the likelihood and/or impact of a risk. Implementing security awareness training reduces the likelihood of successful phishing, and email filtering reduces both likelihood and impact. This is the classic definition of mitigation.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 2

Which risk assessment approach is most appropriate for a new technology that has limited historical data and high uncertainty?

Accepted Answer

Delphi technique with a panel of experts.. The Delphi technique is most appropriate for a new technology with limited historical data and high uncertainty because it leverages the collective judgment of a panel of experts through iterative, anonymous rounds to reach a consensus on risk likelihood and impact. This approach does not rely on historical loss data or predefined benchmarks, making it ideal for novel or emerging technologies where empirical data is scarce.

Answer

Quantitative risk assessment using ALE calculations.

Answer

Bow-tie analysis to map causes and consequences.

Answer

Automated risk scoring based on industry benchmarks.

Question 3

A company uses a dashboard to monitor KRIs. One KRI shows a warning level, but the data is two months old. What is the primary concern?

Accepted Answer

The monitoring is not timely.. The primary concern with a KRI showing a warning level based on data that is two months old is that the monitoring is not timely. Timeliness is a critical attribute of effective Key Risk Indicators (KRIs) because risk conditions can change rapidly; stale data renders the warning obsolete and may lead to incorrect risk decisions. Without current data, the organization cannot respond to emerging threats or control failures in a relevant timeframe, undermining the entire monitoring process.

Answer

The KRI is not relevant.

Answer

The dashboard is not user-friendly.

Answer

The threshold is too low.

Question 4

A security operations center (SOC) analyst notices multiple failed login attempts from an internal IP address followed by a successful login from an unusual geographic location. Which risk identification technique should the risk manager use to assess this as a potential risk?

Accepted Answer

Perform user and entity behavior analytics (UEBA) on the user account. User and entity behavior analytics (UEBA) uses behavioral baselines and anomaly detection to identify patterns such as multiple failed logins followed by a successful login from an unusual geographic location, which is indicative of account compromise and a potential risk. Option A is incorrect because a phishing simulation tests user susceptibility to phishing attacks, not behavioral anomalies in login patterns. Option B is incorrect because manual log review is time-consuming and may not effectively detect subtle behavioral deviations without automated analysis. Option C is incorrect because a vulnerability scan focuses on system vulnerabilities, not user behavior.

Answer

Run a phishing simulation for the user

Answer

Review the logs manually for other indicators

Answer

Conduct a vulnerability scan on the workstation

Question 5

Which type of threat actor is characterized by having significant resources, advanced skills, and often state-sponsored objectives?

Accepted Answer

Nation-state APTs. Nation-state advanced persistent threats (APTs) are characterized by significant resources, advanced technical skills, and objectives aligned with state interests, such as espionage, sabotage, or influence operations. They are typically well-funded and persistent.

Answer

Script kiddies

Answer

Organized crime

Answer

Hacktivists

Question 6

A control test reveals a 100% pass rate for a detective control. What does this indicate?

Accepted Answer

The control is operating effectively. A 100% pass rate for a detective control indicates that every time the control was tested, it successfully detected the condition or event it was designed to identify. This demonstrates the control is operating effectively, meaning it is functioning as intended and providing the expected level of assurance. For example, if the detective control is an intrusion detection system (IDS) that correctly alerts on all test attack patterns, a 100% pass rate confirms its detection logic and signature updates are working correctly.

Answer

The control is too expensive to maintain

Answer

The control is compensating for other weaknesses

Answer

The associated risk has been fully mitigated

Question 7

Which of the following is the PRIMARY purpose of a risk register in an IT risk management program?

Accepted Answer

To document and track identified risks and their treatment plans. The risk register is the central repository for documenting identified risks, their assessed impact and likelihood, and the corresponding treatment plans (e.g., mitigate, accept, transfer, avoid). Its primary purpose is to provide a structured, living record that enables ongoing tracking, prioritization, and management of risk treatment activities throughout the IT risk management lifecycle.

Answer

To provide a historical record of past incidents

Answer

To calculate key risk indicators (KRIs)

Answer

To ensure compliance with regulatory requirements

Question 8

A smart manufacturing company has deployed hundreds of IoT sensors and actuators across its production line. These devices are connected directly to the corporate network without any segmentation and communicate using unencrypted protocols. A third-party vendor manages all IoT devices and has administrative access from their own network. Recently, the IT team detected unusual outbound traffic from the IoT segment to unknown IP addresses on the internet. The risk manager is leading a risk identification workshop. Based on this scenario, what is the most critical risk to the organization that should be identified and documented?

Accepted Answer

Unauthorized remote access to the corporate network via the IoT devices. The most critical risk is unauthorized remote access to the corporate network via the IoT devices. The IoT devices are directly connected to the corporate network without segmentation and communicate using unencrypted protocols, while a third-party vendor has administrative access from their own network. The unusual outbound traffic to unknown IP addresses strongly suggests that an attacker has compromised the vendor's network or the devices themselves, using the unencrypted protocols (e.g., MQTT without TLS, Modbus/TCP) to pivot into the corporate network, bypassing perimeter defenses.

Answer

Compliance violation with industry regulations

Answer

Loss of data integrity due to tampering with sensor measurements

Answer

Physical damage to equipment due to unsafe actuator commands

Question 9

An organization implements an intrusion detection system (IDS) to monitor for security incidents. This is an example of which type of control?

Accepted Answer

Detective. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts when such patterns are detected. Unlike preventive controls, an IDS does not block or stop the attack in real time; it only identifies and reports the incident for subsequent investigation and response.

Answer

Corrective

Answer

Compensating

Answer

Preventive

Question 10

A risk analyst is reviewing control monitoring results and notices that a detective control has a high false positive rate. What is the BEST action to improve the control's efficiency?

Accepted Answer

Adjust the control's threshold or criteria. A high false positive rate in a detective control indicates that the control's threshold or criteria are too sensitive, triggering alerts for benign events. Adjusting the threshold (e.g., increasing the baseline or fine-tuning anomaly detection parameters) directly reduces false positives, improving efficiency without sacrificing detection capability. This is the most targeted action to optimize signal-to-noise ratio.

Answer

Accept the false positives as operational tolerance

Answer

Increase the monitoring frequency

Answer

Convert the control to a preventive control

Question 11

When reporting risk and control monitoring results to the board of directors, which of the following formats is MOST effective?

Accepted Answer

Visual dashboards with key metrics and trend indicators.. The board of directors requires a high-level, synthesized view of risk and control effectiveness to make strategic decisions. Visual dashboards with key metrics and trend indicators are most effective because they enable rapid comprehension of the risk posture, control performance, and emerging issues without overwhelming directors with granular data. This format aligns with the principle of reporting to governance bodies, which focuses on actionable insights rather than operational details.

Answer

Narrative reports describing findings in paragraphs.

Answer

Oral summary without supporting documentation.

Answer

Detailed spreadsheets with raw data for each control.

Question 12

A risk manager is designing an IT risk management programme. Which document should be created FIRST to guide the overall approach to risk management?

Accepted Answer

Risk management policy. A risk management policy establishes the principles, objectives, and responsibilities for risk management, providing a foundation for all other risk management activities.

Answer

Risk treatment plan

Answer

Risk register

Answer

Risk assessment methodology

Question 13

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Applying the vendor-released patch directly reduces the likelihood and impact of the SQL injection vulnerability, which is the definition of risk mitigation. Since a patch exists and the application is critical, mitigation is both feasible and the most appropriate response — it addresses the root cause rather than avoiding, accepting, or transferring the consequence.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 14

A small online retailer with 15 employees sells handmade crafts through its e-commerce website. The company processes payments via a third-party gateway. The owner manually reviews transaction logs once a week for fraud indicators, but recently discovered three chargebacks due to unauthorized transactions. The retailer has limited IT budget and no dedicated security staff. The owner wants to improve detection of fraudulent transactions without significant investment. The current manual process takes about two hours per week and often results in delayed detection. The payment gateway offers basic fraud detection features such as IP geolocation and velocity checks, but these are not enabled. What is the most practical first step?

Accepted Answer

Enable the built-in fraud detection features offered by the payment gateway.. Enabling the built-in fraud detection features offered by the payment gateway is the most practical first step because it is low-cost, quick to implement, and leverages existing capabilities without additional expense. Option B (hiring a part-time analyst) would increase costs and may not be sustainable for a small retailer. Option C (purchasing a third-party system) requires significant investment and implementation time. Option D (accepting the risk) is not acceptable given the recent chargebacks.

Answer

Hire a part-time fraud analyst to review logs daily.

Answer

Purchase an automated fraud detection system from a third-party vendor.

Answer

Accept the current risk and set aside a reserve fund for chargebacks.

Question 15

A financial institution is selecting a risk assessment methodology for evaluating cybersecurity risks across its critical systems. Which of the following is the PRIMARY consideration when choosing between qualitative and quantitative approaches?

Accepted Answer

Availability of reliable numerical data for risk factors. The choice between qualitative and quantitative risk assessment hinges on the availability of reliable numerical data. Quantitative methods require precise, objective data (e.g., asset values, historical loss frequencies, exposure factors) to compute metrics like Annualized Loss Expectancy (ALE). Without such data, the results would be misleading, making qualitative approaches (using ordinal scales and expert judgment) more appropriate. This is the primary technical gate, as it directly determines the feasibility and validity of the quantitative model.

Answer

The skill level of the risk assessment team

Answer

The organization's risk appetite statement

Answer

Compliance with regulatory requirements