CRISC Practice Test 23 — 15 Questions

Question 1

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Intrusion detection systems (IDS) monitor network traffic and alert on suspicious activity after it occurs.

Answer

Backup and recovery plan

Answer

Firewall

Answer

Data encryption

Question 2

The risk team is evaluating the cost-effectiveness of a proposed control that will reduce the annualized loss expectancy (ALE) for a cyber attack from $500,000 to $100,000. The annual cost of the control is $150,000. What is the net benefit of implementing this control?

Accepted Answer

$250,000. The ALE reduction is $400,000. Subtracting the control cost of $150,000 gives a net benefit of $250,000.

Answer

$400,000

Answer

$150,000

Answer

$350,000

Question 3

Which of the following is a limitation of qualitative risk analysis?

Accepted Answer

It provides subjective results that are not comparable across organizations.. Qualitative analysis is subjective and results may not be comparable across different organizations due to varying risk appetites and interpretations.

Answer

It cannot be used for regulatory compliance.

Answer

It requires specialized software to perform.

Answer

It is too data-intensive and time-consuming.

Question 4

A risk is assessed with inherent risk score of 25 on a 5x5 matrix. After implementing controls, the residual risk score is 10. The control effectiveness is considered:

Accepted Answer

Moderately effective. Control effectiveness can be measured as reduction in risk score. Inherent 25 to residual 10 is a 60% reduction (15/25). This indicates controls are moderately effective, but not extremely.

Answer

Not measurable

Answer

Highly effective

Answer

Ineffective

Question 5

A risk practitioner is developing a tactical risk report for the CISO. Which TWO of the following elements should be included in the report? (Select TWO)

Accepted Answer

Control performance metrics. Tactical risk reporting typically includes control performance metrics and top risks with status. Risk heat maps and trend analyses are more strategic, and detailed logs are operational.

Answer

Long-term risk trend analysis

Answer

Risk heat map

Answer

Detailed log analysis from SIEM

Question 6

An organization is implementing a risk-aware culture. Which TWO of the following are effective practices?

Accepted Answer

Encourage incident reporting without fear of blame.. Tone from top and incident reporting without blame are key to promoting a risk-aware culture. Security awareness training is also important, but the question asks for TWO practices, and these are most directly related to culture.

Answer

Conduct annual security awareness training only.

Answer

Provide incentives for risk identification.

Answer

Blame individuals for incidents to deter future occurrences.

Question 7

A risk practitioner is performing a cost-benefit analysis for a proposed control. The annualized loss expectancy (ALE) for a risk is currently $500,000. The proposed control will reduce the ALE by 80%, and the annual cost of the control is $150,000. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The reduction in ALE is $500,000 × 0.80 = $400,000. The annual control cost is $150,000, so net benefit = $400,000 - $150,000 = $250,000.

Answer

$100,000

Answer

$400,000

Answer

$350,000

Question 8

A company uses the FAIR model to perform a quantitative risk analysis. The threat event frequency (TEF) is estimated at 10 per year, vulnerability (V) is 0.5, and loss magnitude (LM) per event is $50,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. FAIR: LEF = TEF × V = 10 × 0.5 = 5 events/year. ALE = LEF × LM = 5 × $50,000 = $250,000.

Answer

$25,000

Answer

$50,000

Answer

$500,000

Question 9

The Chief Information Security Officer (CISO) receives a quarterly report that includes a risk heat map and trend analysis of top risks. This type of reporting is best described as:

Accepted Answer

Tactical risk reporting. Tactical risk reporting is typically provided to senior IT management (CISO/CIO) on a quarterly basis and includes risk heat maps and trend analyses.

Answer

Operational risk reporting

Answer

Strategic risk reporting

Answer

Compliance reporting

Question 10

During a control implementation project, the risk manager discovers that the resource requirements have increased significantly, making the original cost-benefit analysis invalid. What should the risk manager do first?

Accepted Answer

Perform a revised cost-benefit analysis. Before proceeding, the risk manager should reassess the cost-benefit analysis with updated costs to determine if the control is still justified.

Answer

Continue the project and request additional budget later

Answer

Escalate to the board for approval of additional funds

Answer

Cancel the project immediately

Question 11

A company identifies a high inherent risk in its online payment system. After implementing a Web Application Firewall (WAF) and conducting quarterly penetration tests, the residual risk is assessed as medium. Which of the following best explains the relationship between inherent risk, controls, and residual risk?

Accepted Answer

Residual risk is the inherent risk adjusted for the effectiveness of controls in reducing likelihood and impact.. Residual risk is the risk remaining after controls are applied. It is calculated by adjusting inherent risk for control effectiveness (design adequacy and operating effectiveness).

Answer

Inherent risk is the risk after controls are applied, while residual risk is the risk before controls.

Answer

Residual risk equals inherent risk minus the total cost of controls implemented.

Answer

Inherent risk and residual risk are independent; residual risk is determined solely by threat intelligence.

Question 12

After implementing controls, the risk remaining is called:

Accepted Answer

Residual risk. Residual risk is the risk remaining after controls are applied, calculated by adjusting inherent risk for control effectiveness.

Answer

Control risk

Answer

Acceptable risk

Answer

Inherent risk

Question 13

An organization is implementing a new access control system to protect sensitive data. Which type of control is most appropriate for preventing unauthorized access?

Accepted Answer

Preventive control. Preventive controls are designed to deter or prevent undesirable events from occurring. Access control systems are a classic example of preventive controls as they block unauthorized access before it happens.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 14

An IT risk manager is developing KRIs for a critical application. Which TWO of the following are leading indicators that the risk level may be increasing? (Select TWO)

Accepted Answer

Average patch lag time increasing. Leading indicators predict future risk. A rising number of failed login attempts and an increase in average patch lag are leading indicators that signal potential attacks or increased vulnerability.

Answer

Audit findings of control deficiencies

Answer

Number of successful intrusions

Answer

Number of security incidents in the past month

Question 15

A risk analyst is assessing a critical application's inherent risk. After implementing controls, the residual risk is calculated as high. The analyst determines that the control design is adequate but operating effectiveness is poor. Which factor most likely explains the high residual risk?

Accepted Answer

Control operating effectiveness is poor. Residual risk = inherent risk adjusted for control effectiveness. If controls are well-designed but not operating effectively, they fail to reduce risk as intended, leading to high residual risk.

Answer

Control design is inadequate

Answer

Risk appetite was misstated

Answer

Inherent risk is too low