CRISC Practice Test 3 — 25 Questions

Question 1

A large bank has implemented a sophisticated risk and control monitoring system with multiple dashboards and automated reporting for key risk indicators (KRIs). However, the board of directors has been receiving conflicting KRI reports from different business units (e.g., retail banking, corporate lending, and wealth management). For example, the fraud KRI shows a high risk in retail but low risk in wealth management, yet both units use the same underlying data source. The chief risk officer (CRO) is concerned that the board is losing confidence in the risk reporting. An investigation reveals that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. What is the most likely root cause and the best remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KRI definitions and calculation methods are not standardized across business units.. The root cause of conflicting KRI reports is that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. This lack of standardization leads to inconsistent risk measurements, even when using the same underlying data source. The best remediation is to standardize KRI definitions, calculation methods, thresholds, and reporting frequencies across all business units to ensure consistent and comparable risk reporting to the board.

Answer

The reporting frequency is inadequate; monthly reports should be weekly.

Answer

The data sources for KRIs are inconsistent across business units.

Answer

The board members are misinterpreting the KRI reports due to lack of training.

Question 2

An organization's risk committee reviews a risk heat map showing that a key IT risk has moved from the "high" to "medium" category. However, the associated control's effectiveness has decreased from 95% to 85%. What is the most likely explanation?

Accepted Answer

The inherent risk has decreased due to external factors.. The risk heat map shows a reduction in residual risk from high to medium, yet the control effectiveness dropped from 95% to 85%. This apparent contradiction is best explained by a decrease in inherent risk—the risk before controls are applied. If inherent risk falls (e.g., due to external factors like new regulations or reduced threat activity), the residual risk can decrease even if the control becomes less effective, because the starting risk level is lower.

Answer

The control testing frequency was increased.

Answer

The risk assessment methodology was changed.

Answer

The control owner has implemented additional compensating controls.

Question 3

A risk manager is evaluating the effectiveness of a control that requires dual authorization for high-value transactions. The Key Control Indicator (KCI) for this control is the rate of transactions processed without dual authorization (i.e., exception rate). If the acceptable exception rate is less than 1% and the observed rate is 2.5%, what is the most appropriate immediate action?

Accepted Answer

Investigate the root cause of the exceptions. The observed exception rate of 2.5% exceeds the acceptable threshold of 1%, indicating a control deficiency. The most appropriate immediate action is to investigate the root cause of the exceptions to determine whether the control is failing due to process gaps, user behavior, or system issues. Root cause analysis (RCA) is a foundational step before any remediation, as it prevents premature redesign or unjustified risk acceptance.

Answer

Redesign the control immediately

Answer

Accept the risk since the rate is still low

Answer

Increase the acceptable exception rate to 2.5%

Question 4

During a vendor risk assessment, a third-party vendor is classified as "critical" because it has access to sensitive customer data. According to the organization's risk appetite, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor with access to sensitive customer data because it provides an independent, audited assessment of the vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. This aligns with the organization's risk appetite by ensuring that the vendor has demonstrated effective controls in place to protect sensitive data, rather than relying on a point-in-time test or self-reported information.

Answer

General liability insurance certificate

Answer

Penetration test results from the vendor

Answer

Self-assessment questionnaire only

Question 5

During a quarterly control effectiveness test, internal audit finds that a detective control missed 15% of security incidents. The control owner claims this is within the acceptable error rate of 20%. However, the risk practitioner notes that the missed incidents were high-severity. What should the risk practitioner do?

Accepted Answer

Escalate the findings to senior management with a recommendation to enhance the control. The risk practitioner should escalate the findings to senior management with a recommendation to enhance the control because the detective control's failure to detect 15% of incidents, while within the 20% acceptable error rate, specifically missed high-severity incidents. High-severity incidents pose a disproportionate risk to the organization, and a control that fails to detect them is not effective in mitigating critical risks, regardless of meeting a generic threshold. Escalation ensures that management is aware of the residual risk and can authorize appropriate enhancements, such as tuning the control's detection logic or implementing additional monitoring for high-severity events.

Answer

Accept the control as effective since it is within the threshold

Answer

Implement a compensating control to cover high-severity incidents

Answer

Recommend revising the KCI threshold to include severity weighting

Question 6

Which of the following best describes risk capacity?

Accepted Answer

The maximum risk the organization can absorb before threatening viability. Risk capacity is the maximum amount of risk an organization can absorb before its viability, solvency, or strategic objectives are threatened — it is an objective, externally-influenced limit. It differs from risk appetite (willingness to accept risk) and risk tolerance (acceptable deviation around appetite). The correct answer captures the 'maximum absorbable' framing that distinguishes capacity from the other risk concepts.

Answer

The acceptable risk level for each risk category

Answer

The total risk identified in the risk universe

Answer

The amount of risk the organization is willing to accept

Question 7

A company is identifying risks associated with a new cloud-based CRM. Which of the following is the MOST effective method for identifying potential threats?

Accepted Answer

Threat modeling workshops with stakeholders. Threat modeling workshops with stakeholders are the most effective method because they leverage diverse expertise to systematically identify threats specific to the cloud-based CRM architecture, including misconfigurations in IAM roles, API vulnerabilities, and data residency issues. This collaborative approach aligns with the CRISC focus on proactive risk identification by considering business context, technical constraints, and regulatory requirements early in the lifecycle.

Answer

Reviewing industry standards only

Answer

Conducting penetration testing alone

Answer

Analyzing historical security incidents from similar organizations

Question 8

An organization notices a spike in failed authentication attempts over the past week. This metric is best classified as which type of risk indicator?

Accepted Answer

Key Risk Indicator (KRI). A spike in failed authentication attempts is a direct measure of a risk condition (e.g., brute-force attacks or credential stuffing) that can lead to unauthorized access. This metric is best classified as a Key Risk Indicator (KRI) because it tracks changes in risk exposure over time, enabling proactive risk response. Unlike a KCI, which measures control effectiveness, or a lagging indicator, which reports past incidents, this metric signals an evolving threat in near real-time.

Answer

Key Control Indicator (KCI)

Answer

Lagging indicator

Answer

Compliance metric

Question 9

An organization assesses a risk and determines the inherent risk score is 20 (critical). After implementing controls, the residual risk score is 8 (medium). What does this indicate about the controls?

Accepted Answer

Controls are effective in reducing risk to a lower level. The reduction from 20 to 8 indicates the controls are effective in reducing risk.

Answer

The residual risk is still critical

Answer

The inherent risk was overestimated

Answer

Controls are ineffective because residual risk is still above zero

Question 10

A company's risk appetite statement says it is willing to accept moderate levels of operational risk but has low tolerance for compliance risk. During risk identification, which of the following scenarios should be IMMEDIATELY escalated to senior management?

Accepted Answer

A new cloud service may inadvertently expose customer PII due to misconfiguration. The risk appetite statement explicitly declares low tolerance for compliance risk, and exposing customer PII triggers regulatory/legal obligations (e.g., GDPR, CCPA, contractual data-protection clauses). Because compliance risk is the organization's stated low-tolerance area, any scenario with potential PII exposure must be escalated immediately to senior management. The other scenarios fall within the 'moderate operational risk' appetite the company has already accepted.

Answer

A planned system upgrade may cause two hours of downtime during maintenance window

Answer

A vendor is late in delivering a software patch for a low-severity bug

Answer

An employee mistakenly deletes a non-critical test database

Question 11

Which control type is primarily focused on identifying that a risk event has occurred?

Accepted Answer

Detective. Detective controls are designed to detect incidents after they happen.

Answer

Compensating

Answer

Preventive

Answer

Corrective

Question 12

During a risk assessment, the IT risk manager needs to prioritize risks for treatment. Which of the following risk characteristics should be weighted MOST heavily?

Accepted Answer

The degree to which the risk affects strategic business objectives. In CRISC, risk prioritization is fundamentally driven by alignment with strategic business objectives because IT risk management exists to protect the enterprise’s mission and goals. Even a high-likelihood or high-financial-impact risk may be deprioritized if it does not materially affect the organization’s strategic objectives, as the risk treatment decision must support business value and continuity. This weighting ensures that resources are allocated to risks that most threaten the enterprise’s ability to achieve its core mission.

Answer

The ease of implementing mitigating controls

Answer

The likelihood that the threat will be exploited

Answer

The financial impact calculated in monetary terms

Question 13

A risk manager is categorizing IT risks. Which risk category would a potential fine for violating GDPR be assigned to?

Accepted Answer

Compliance. A fine for violating GDPR is a direct consequence of failing to meet a legal/regulatory obligation, which is the definition of compliance risk. Compliance risk encompasses penalties, sanctions, and legal actions arising from non-conformance with laws, regulations, and standards. Although the fine is monetary, its root cause is regulatory non-compliance, so it belongs in the compliance category.

Answer

Operational

Answer

Financial

Answer

Strategic

Question 14

Based on the exhibit, which aspect of risk monitoring is MOST concerning?

Accepted Answer

The vulnerability has been open for three months with no evidence of monitoring or remediation despite a patch being available.. The vulnerability has been open for three months with a patch available, yet there is no evidence of monitoring or remediation. This indicates a complete breakdown of the risk monitoring process, as the organization failed to track, escalate, or patch a known critical vulnerability, leaving the system exposed to exploitation. In risk monitoring, the absence of any monitoring activity or remediation action over such a long period is far more concerning than the severity alone, as it reflects a systemic failure in the control environment.

Answer

The vulnerability severity is critical.

Answer

The last scan was three months after the initial detection.

Answer

The risk was accepted by the system owner.

Question 15

A hospital's IT risk manager is preparing a quarterly risk report for the executive committee. The report currently lists 240 technical vulnerabilities with CVSS scores but no business context. The CIO asks for a report that helps executives decide where to allocate limited remediation funding. Which change best aligns the report with risk response and reporting objectives?

Accepted Answer

Group vulnerabilities by the business processes and assets they affect, and express exposure in terms of potential impact and likelihood.. Risk reporting to executives must translate technical findings into business language. Grouping vulnerabilities by affected processes and assets and expressing exposure through impact and likelihood gives leaders the context needed to prioritize remediation spending against organizational objectives. Raw counts, technical artifacts, or alphabetical ordering do not support funding decisions because they omit the business consequences that drive risk-based prioritization.

Answer

Report only the total count of vulnerabilities and the percentage remediated within the past quarter.

Answer

Sort the vulnerabilities alphabetically by vendor name so the report is easier to navigate.

Answer

Increase the report's technical depth by including exploit code snippets and packet captures for each vulnerability.

Question 16

An organization is deploying IoT sensors in a manufacturing plant. Which of the following is the MOST significant security risk associated with these devices?

Accepted Answer

Inability to apply security patches due to legacy firmware. IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Answer

Interference with radio frequency signals

Answer

Limited data storage capacity

Answer

High power consumption leading to operational costs

Question 17

A multinational financial services company has implemented a continuous monitoring program for its trading systems. The program uses automated scripts to check system configurations against a baseline every hour. Recently, the company experienced a significant security incident where a malicious actor exploited a misconfigured firewall rule to exfiltrate sensitive customer data. Post-incident analysis revealed that the misconfiguration had been present for 72 hours before detection. The monitoring scripts did not detect the change because the baseline had been updated two weeks prior to include the misconfiguration as part of a planned change that was later reversed without updating the baseline. The company's change management process requires that all configuration changes be approved and documented, but the reversal of the change was not documented. The incident response team was only alerted when a customer reported suspicious activity. The risk practitioner is tasked with recommending improvements to prevent recurrence. Which of the following is the BEST course of action?

Accepted Answer

Implement a change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates.. The root cause is that the baseline was updated to include the misconfiguration, and the subsequent reversal was not documented or reflected in the baseline. A change detection system that compares current configurations to an approved, immutable baseline and alerts on any deviation, with strict change control for baseline updates, directly addresses this by ensuring that only approved changes are in the baseline and any unapproved deviation (including reversals) triggers an alert. This prevents the monitoring system from accepting unauthorized changes as normal.

Answer

Enhance incident response procedures to include notification of customers within 24 hours.

Answer

Increase the frequency of monitoring scripts to every 30 minutes.

Answer

Require manual review of all configuration changes by a second analyst.

Question 18

An organization has implemented a firewall (preventive), intrusion detection system (detective), and a backup restoration plan (corrective) to address a specific risk. The risk manager assesses the control effectiveness as follows: design adequacy is strong, but operating effectiveness is weak due to inconsistent patching. Which of the following best describes the residual risk?

Accepted Answer

Residual risk is lower than inherent risk but still significant due to weak operating effectiveness. Residual risk is lower than inherent risk because the three controls (preventive, detective, corrective) do reduce the risk, but it remains significant because weak operating effectiveness — inconsistent patching — means the controls are not functioning as designed. Design adequacy alone does not guarantee risk reduction; actual operating effectiveness determines the true residual level.

Answer

Residual risk cannot be determined without a quantitative analysis

Answer

Residual risk is negligible because multiple controls are in place

Answer

Residual risk is equal to inherent risk because controls are ineffective

Question 19

An international bank is expanding its operations into a new country with strict data localization laws. The IT department plans to use a cloud service provider that stores data in neighboring countries but promises compliance. The risk team has identified several potential risks: regulatory fines for non-compliance, data interception during cross-border transmission, and difficulty in auditing the cloud provider. The legal team advises that the contract includes data protection clauses, but these have not been tested. The risk manager must now prioritize risk identification efforts. What is the MOST important risk identification step the risk team should undertake?

Accepted Answer

Perform a regulatory compliance assessment specific to the new country's laws.. The most critical risk identification step when entering a new country with strict data localization laws is to perform a regulatory compliance assessment specific to that country's laws. This ensures the bank understands the exact legal requirements for data storage, processing, and transfer, which directly informs whether the cloud provider's promised compliance is achievable. Without this assessment, the risk team cannot accurately identify the scope and severity of regulatory fines or other legal risks.

Answer

Review the cloud provider's SOC 2 report.

Answer

Conduct a thorough legal review of the contract's data handling clauses.

Answer

Map data flows to ensure all data is properly classified.

Question 20

A company has implemented a key risk indicator (KRI) for system availability, with a threshold of 99.5%. The monitoring team observes that availability has dropped to 99.2% for two consecutive months. What is the most appropriate next step?

Accepted Answer

Notify the risk owner and initiate a root cause analysis.. A sustained breach of a KRI threshold (99.2% vs. 99.5%) for two consecutive months indicates a systemic issue that requires formal risk management action. The risk owner must be notified to assess the impact, and a root cause analysis (RCA) should be initiated to identify underlying failures—such as network congestion, hardware faults, or software bugs—before any remediation is planned.

Answer

Implement additional redundancy to improve availability.

Answer

Increase the threshold to 99.0% to avoid false alarms.

Answer

Escalate immediately to the board of directors.