CRISC Practice Test 2 — 25 Questions

Question 1

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 2

Order the steps for implementing a risk treatment plan.

Accepted Answer

Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.. Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Answer

Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.

Answer

Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.

Answer

Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.

Question 3

Arrange the steps for performing a risk assessment in the correct order.

Accepted Answer

Asset identification, then threat and vulnerability identification, then likelihood and impact analysis, then risk calculation, then documentation.. Risk assessment begins with asset identification, then threats/vulnerabilities, followed by likelihood and impact analysis, risk calculation, and documentation.

Answer

Threat and vulnerability identification, then asset identification, then likelihood and impact analysis, then risk calculation, then documentation.

Answer

Risk calculation, then asset identification, then threat and vulnerability identification, then documentation, then likelihood and impact analysis.

Answer

Asset identification, then threat and vulnerability identification, then risk calculation, then likelihood and impact analysis, then documentation.

Question 4

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 5

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

Accepted Answer

Risk treatment plans are implemented within agreed timelines. The effectiveness of an IT risk assessment process is ultimately measured by whether identified risks are actually treated within agreed timelines. Option D directly demonstrates that the organization moves from risk identification to remediation, closing the risk management loop. Without timely implementation of treatment plans, even the most thorough risk assessments provide no reduction in actual risk exposure.

Answer

The risk register contains a large number of risks

Answer

Risk appetite statements are clearly defined

Answer

Risk assessments are performed annually

Question 6

Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?

Accepted Answer

Ease of exploitation. Ease of exploitation (A) is a key factor because it directly influences how readily a threat actor can leverage a vulnerability. For example, a vulnerability with a public exploit script or one that requires only low privileges is far more likely to be exploited than one requiring complex, custom tooling. This aligns with the CVSS exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) that quantify how easy it is to trigger the vulnerability.

Answer

Regulatory fines

Answer

Asset value

Question 7

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

Accepted Answer

Alert the risk owner and initiate a root cause analysis. The KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Answer

Lower the risk tolerance threshold to trigger more frequent alerts

Answer

Accept the increased risk without further analysis because the trend is gradual

Answer

Increase the risk tolerance threshold to match the current level

Question 8

When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?

Accepted Answer

Spoofing. Spoofing in STRIDE refers to impersonating something or someone else to gain unauthorized access, such as using stolen credentials.

Answer

Repudiation

Answer

Information Disclosure

Answer

Tampering

Question 9

An IT risk manager is facilitating a workshop to identify risks for a new mobile banking application. Which technique is MOST appropriate for generating a comprehensive list of risks?

Accepted Answer

Conduct a brainstorming session with cross-functional team members. Brainstorming with a cross-functional team (option C) is the most appropriate technique for generating a comprehensive list of risks for a new mobile banking application because it leverages diverse perspectives from development, security, compliance, and business units. This collaborative approach helps uncover unknown or emergent risks specific to the application's architecture, such as API vulnerabilities, session management flaws, or regulatory gaps, which might not be captured by historical data or structured questionnaires.

Answer

Review risk registers from similar projects

Answer

Perform a SWOT analysis

Answer

Distribute a risk questionnaire to project stakeholders

Question 10

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Accepted Answer

Implement a unidirectional gateway that enforces one-way data flow. A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Answer

Deploy a host-based intrusion detection system on each ICS device

Answer

Upgrade the ICS to modern protocols with built-in authentication

Answer

Disconnect the ICS from the corporate network and use manual data transfer

Question 11

Which of the following threat actors is MOST likely to be motivated by financial gain and possess moderate to high technical capabilities?

Accepted Answer

Organized crime. Organized crime groups are primarily motivated by financial gain and often have sophisticated technical skills to carry out attacks such as ransomware, data theft, or fraud.

Answer

Hacktivist

Answer

Nation-state APT

Answer

Script kiddie

Question 12

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 13

Which TWO of the following are examples of detective controls?

Accepted Answer

Log monitoring and analysis. Detective controls identify incidents that have already occurred. Intrusion detection systems and log monitoring are classic examples.

Answer

Encryption of data at rest

Answer

Firewall rules

Answer

Data backup process

Question 14

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

Question 15

In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?

Accepted Answer

A DDoS attack causes website unavailability for 4 hours, resulting in $500,000 lost sales and customer churn.. A proper connection shows the chain from threat to impact on business.

Answer

A firewall misconfiguration allows unauthorized access, causing a security incident.

Answer

A ransomware attack encrypts files, leading to IT department overtime.

Answer

An insider steals data, leading to legal fees.

Question 16

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 17

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. The frequency of control monitoring should be based on risk and criticality. Options D and E are correct because controls that are more critical to risk mitigation and processes with higher inherent risk levels require more frequent monitoring. Option A is incorrect because monitoring frequency should be driven by risk, not cost; cost is a secondary consideration. Option B is incorrect because the number of IT projects does not directly affect the monitoring frequency of existing controls. Option C is incorrect because external auditor preferences may influence the approach but are not a primary factor in determining monitoring frequency.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

Question 18

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

Accepted Answer

Historical incident data from industry reports. Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Answer

Vendor documentation

Answer

The risk owner's personal opinion

Answer

The organization's financial statements

Question 19

Which THREE of the following are effective risk treatment strategies?

Accepted Answer

Avoid the risk by discontinuing the activity. Avoiding risk by discontinuing the activity is a recognized risk treatment strategy under the ISACA Risk IT framework. By ceasing the activity that introduces the risk, the organization eliminates the possibility of the risk event occurring, which is a valid and often necessary response when the risk exceeds the organization's risk appetite and cannot be cost-effectively mitigated or transferred.

Answer

Accept the risk without any analysis

Answer

Ignore the risk if it has not materialized yet

Question 20

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols