CRISC Practice Test 4 — 25 Questions

Question 1

An organization uses a Key Control Indicator (KCI) to measure control effectiveness. The KCI shows a control deficiency rate of 12% over the past quarter, exceeding the target threshold of 5%. Which action is MOST appropriate as an initial response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a root cause analysis of the deficiencies. A high deficiency rate indicates the control is not working as intended. The first step is to investigate root causes to determine necessary remediation.

Answer

Report the deficiency to the board for oversight

Answer

Increase the frequency of control testing to monthly

Answer

Immediately replace the control with a more robust one

Question 2

In a qualitative risk assessment, which TWO elements are typically used to determine the risk rating?

Accepted Answer

Likelihood. In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Answer

Risk appetite

Answer

Cost of mitigation

Answer

Control effectiveness

Question 3

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

Accepted Answer

$100,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer

$25,000

Answer

$50,000

Answer

$200,000

Question 4

An organization decides to outsource its data center operations to a cloud provider with strict contractual penalties for security breaches. This is an example of which risk treatment option?

Accepted Answer

Transfer. Transferring risk shifts the financial consequences to a third party, such as through outsourcing or insurance.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 5

A manufacturing company's board of directors receives a monthly risk report. Which key performance indicator (KPI) is MOST relevant for the board to assess the effectiveness of internal controls?

Accepted Answer

Percentage of control tests passed within the reporting period.. The percentage of control tests passed within the reporting period directly measures the operational effectiveness of internal controls, which is the board's primary concern for risk mitigation. This KPI provides a quantifiable, trendable metric that reflects whether controls are functioning as designed to reduce residual risk to an acceptable level.

Answer

Number of audit findings per business unit.

Answer

Number of risk assessments completed this month.

Answer

Percentage of employees completing annual compliance training.

Question 6

Order the steps for incident response handling.

Accepted Answer

Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting. Incident response follows preparation, detection, containment/eradication/recovery, lessons learned, and reporting.

Answer

Step 1: Detection, Step 2: Preparation, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting

Answer

Step 1: Reporting, Step 2: Preparation, Step 3: Detection, Step 4: Containment/Eradication/Recovery, Step 5: Lessons Learned

Answer

Step 1: Preparation, Step 2: Containment/Eradication/Recovery, Step 3: Detection, Step 4: Lessons Learned, Step 5: Reporting

Question 7

An organization is conducting a risk assessment and finds that the inherent risk for a critical asset is very high due to a high threat event frequency and high vulnerability. The current controls are assessed as adequate in design but not operating effectively. Which THREE of the following should be considered when calculating residual risk?

Accepted Answer

Inherent risk score. Inherent risk score (A) is correct because residual risk is calculated by considering the inherent risk level and the effectiveness of controls in reducing that risk. Since the inherent risk is very high due to high threat frequency and vulnerability, this baseline score must be factored into the residual risk calculation to determine the remaining risk after controls are applied.

Answer

Cost-benefit analysis of controls

Answer

Risk appetite statement

Question 8

An IT risk assessment team is using a 5×5 risk matrix with likelihood and impact ratings. A risk scenario is rated as likelihood = 4 (likely) and impact = 5 (catastrophic). According to the typical heat map, what would be the risk rating?

Accepted Answer

Critical. In a 5×5 matrix, likelihood 4 and impact 5 give a product of 20, which is typically in the 'critical' range. Common thresholds: 1-5 low, 6-10 medium, 11-15 high, 16-25 critical.

Answer

High

Answer

Medium

Answer

Low

Question 9

An organization is updating its IT risk universe to include emerging threats. The CISO wants to ensure the risk register captures realistic risk scenarios. Which THREE components are essential for constructing a complete risk scenario according to ISACA's risk scenario template?

Accepted Answer

Event. A complete risk scenario includes actor (who), threat type (what), event (how), and asset/resource (what is affected). Timing, detection, and response are additional elements but not part of the core template.

Answer

Timing

Answer

Detection

Question 10

Which THREE of the following should be included in a board-level risk report to effectively communicate the organization's risk profile?

Accepted Answer

Emerging risks and trend analysis of key risk indicators over the past quarter.. A board-level risk report must include forward-looking information such as emerging risks and trend analysis of key risk indicators (KRIs) over the past quarter. This enables the board to understand not only the current risk posture but also the direction and velocity of risk changes, which is essential for strategic oversight and proactive decision-making.

Answer

A list of the most recent security incidents with root cause analysis.

Answer

Detailed descriptions of all controls mitigating the top risks.

Question 11

During the risk identification process, an IT risk universe is defined. Which of the following BEST describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. The IT risk universe is a comprehensive inventory of all potential IT risks that could affect the organization, serving as the foundation for further risk assessment and treatment.

Answer

A list of all known vulnerabilities in the organization's IT systems

Answer

A database of past security incidents and their root causes

Answer

A framework for categorizing risks into strategic, operational, financial, and compliance

Question 12

A financial institution is redesigning its control monitoring program to comply with a new regulatory requirement that mandates near-real-time monitoring of high-risk transactions. The current system performs batch processing daily. Which approach BEST meets the requirement while minimizing operational impact?

Accepted Answer

Implement a real-time monitoring solution that only processes transactions flagged as high-risk based on predefined criteria.. It directly satisfies the near-real-time monitoring requirement by processing only high-risk transactions as they occur, using predefined criteria to minimize latency and operational overhead. This targeted approach avoids the cost and complexity of converting all transaction processing to real-time, while still meeting regulatory demands for immediate detection of high-risk activity.

Answer

Use manual reviews of high-risk transactions by compliance officers within 24 hours.

Answer

Replace batch processing with a fully real-time system for all transactions.

Answer

Increase batch processing frequency from daily to hourly.

Question 13

An organization is evaluating the impact of a potential data breach. Which THREE of the following are considered indirect financial impacts?

Accepted Answer

Legal fees from lawsuits. Indirect financial impacts include lost business, reputation damage, and opportunity costs.

Answer

Incident response costs

Answer

Notification costs to affected individuals

Question 14

A company's IT risk team is conducting a risk identification exercise for a new blockchain-based supply chain solution. Which THREE risks are MOST specific to this technology?

Accepted Answer

51% attack on the underlying consensus mechanism.. A 51% attack is a specific risk to blockchain consensus mechanisms where a single entity or group gains majority hashing power, allowing them to reverse transactions or prevent new blocks from being confirmed. This directly undermines the integrity and immutability that blockchain promises for the supply chain solution.

Answer

Incompatibility with legacy database systems.

Answer

High electricity consumption of mining nodes.

Question 15

During a vendor risk assessment, a prospective vendor for critical services cannot provide a SOC 2 Type II report. According to the organization's vendor risk appetite, which action should be taken?

Accepted Answer

Reject the vendor or request a formal risk acceptance. A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Answer

Lower the vendor's tier to reduce requirements

Answer

Accept the vendor's self-assessment instead

Answer

Onboard the vendor with additional monitoring

Question 16

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Accepted Answer

CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.. CSA relies on self-assessment by business units, which often introduces subjective bias leading to overestimation of control effectiveness, whereas internal audit uses independent, objective testing. Option A is incorrect because a three-month time lag alone is unlikely to cause such a large (50%) discrepancy; controls would require significant degradation to explain the gap. Option C is incorrect because inadequate training could contribute to inaccurate self-assessments, but it is not the primary cause; bias is more fundamental. Option D is incorrect because even if the scopes differ, the core issue is the inherent bias in self-assessment, making B the best explanation.

Answer

The audit was conducted three months after the CSA, and controls may have degraded.

Answer

CSA participants lacked adequate training on what constitutes a control failure.

Answer

The CSA covered a different scope of controls than the audit.

Question 17

Based on the exhibit, which of the following poses the HIGHEST risk to the environment?

Accepted Answer

The database has a direct SSH connection from the internet. A direct SSH connection from the internet to the database server bypasses all network segmentation and firewall controls, exposing the database to brute-force attacks, credential theft, and unauthorized remote access. SSH is a management protocol, not an application protocol, and its exposure on the internet creates a direct attack surface on the most sensitive data tier, which is the highest risk to the environment.

Answer

The web servers are in a public subnet

Answer

The communication between web and application servers is encrypted via HTTPS

Answer

The application servers use embedded credentials to access the database

Question 18

A multinational corporation is migrating its customer relationship management (CRM) system to a public cloud provider. The data includes personally identifiable information (PII) from multiple jurisdictions. Which risk should be considered most critical during the cloud architecture review?

Accepted Answer

Data sovereignty and cross-border data transfer restrictions. The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

Answer

Multi-tenancy isolation failures

Answer

Shared responsibility model gaps for patching

Answer

Vendor lock-in due to proprietary APIs

Question 19

A risk analyst is reviewing control monitoring results and notices that a detective control has a high false positive rate. What is the BEST action to improve the control's efficiency?

Accepted Answer

Adjust the control's threshold or criteria. A high false positive rate in a detective control indicates that the control's threshold or criteria are too sensitive, triggering alerts for benign events. Adjusting the threshold (e.g., increasing the baseline or fine-tuning anomaly detection parameters) directly reduces false positives, improving efficiency without sacrificing detection capability. This is the most targeted action to optimize signal-to-noise ratio.

Answer

Accept the false positives as operational tolerance

Answer

Increase the monitoring frequency

Answer

Convert the control to a preventive control

Question 20

What is the primary risk if the WAF is misconfigured?

Accepted Answer

SQL injection attacks. A Web Application Firewall (WAF) is designed to filter and monitor HTTP traffic to and from a web application, protecting against common web exploits like SQL injection. If misconfigured, the WAF may fail to block SQL injection attempts, leaving the application vulnerable. While unauthorized database access (B) and denial of service (C) could be consequences, the primary risk directly associated with WAF misconfiguration is exposure to SQL injection attacks.

Answer

Unauthorized database access

Answer

Denial of service

Answer

Network segmentation failure