CRISC Practice Test 4 — 25 Questions

Question 1

An organization is planning for post-quantum cryptography migration. Which THREE of the following are key considerations for this migration?

Accepted Answer

Inventory of all cryptographic assets and dependencies. A comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

Answer

Replacing all existing hardware immediately

Answer

Eliminating cloud services to reduce risk

Question 2

After a control self-assessment (CSA) workshop, business units reported that 80% of controls are operating effectively. However, internal audit's recent testing indicates a 30% control failure rate. What is the BEST explanation for this discrepancy?

Accepted Answer

CSA participants may have a biased perception of control effectiveness, while audit uses objective evidence.. The most likely explanation for the gap between CSA self-reported effectiveness (80%) and audit-observed failure (30%) is that CSA participants assess controls subjectively and may overestimate effectiveness due to familiarity, optimism, or lack of objectivity, whereas internal audit tests controls using independent, evidence-based procedures. This perception bias is a well-documented limitation of self-assessment. The other options introduce speculative factors (timing, training, scope) that are not supported by the scenario.

Answer

The audit was conducted three months after the CSA, and controls may have degraded.

Answer

CSA participants lacked adequate training on what constitutes a control failure.

Answer

The CSA covered a different scope of controls than the audit.

Question 3

During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?

Accepted Answer

Perform an on-site technical assessment and interview key IT staff. An on-site technical assessment combined with interviews of key IT staff is the most effective technique because it uncovers undocumented risks, shadow IT, cultural issues, and technical debt that documents and scans alone cannot reveal. Interviews provide context about how systems are actually used versus how they are documented, and on-site observation can expose physical and operational risks.

Answer

Analyze the target's existing risk register

Answer

Review the target's IT policies and procedures

Answer

Conduct a network vulnerability scan

Question 4

A global organization is consolidating risk data from multiple business units into a single enterprise risk management (ERM) system. The risk practitioner notices that KRIs for the same risk type (e.g., cybersecurity) are calculated differently across units. What is the BEST approach to ensure consistent and reliable risk monitoring and reporting?

Accepted Answer

Establish a common definition and calculation methodology for each KRI across all business units.. Consistent risk monitoring and reporting requires a standardized definition and calculation methodology for each KRI across all business units. Without this common baseline, the aggregated risk data in the ERM system will be incomparable and unreliable, leading to flawed decision-making. Establishing common definitions ensures that the same risk type (e.g., cybersecurity) is measured uniformly, enabling accurate trend analysis and risk aggregation.

Answer

Require all units to adopt a common set of key performance indicators for their control environment.

Answer

Allow each business unit to maintain its own KRI definitions but report explanations for variances.

Answer

Implement automated data feeds from each unit's system to the ERM system without changing the KRI definitions.

Question 5

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed

Question 6

Which THREE of the following are effective techniques for identifying IT risks?

Accepted Answer

Brainstorming. Brainstorming is a structured group technique that leverages the collective expertise of stakeholders to identify a wide range of IT risks, including emerging threats and vulnerabilities that may not be captured by automated tools. It is effective because it encourages creative thinking and surfaces risks related to business processes, third-party dependencies, and human factors that are often missed by purely technical assessments.

Answer

Root cause analysis

Answer

Cost-benefit analysis

Question 7

An architecture review board (ARB) is evaluating a new solution architecture that processes sensitive data. Which of the following should the ARB review to ensure security risks are addressed before implementation?

Accepted Answer

Threat model and security controls. The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Answer

User acceptance test plan

Answer

Business case and ROI analysis

Answer

Project timeline and budget

Question 8

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Accepted Answer

Risk of data exposure; apply a deny rule to restrict access. The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.

Answer

Risk of cost; set a budget alert

Answer

Risk of availability; implement backup

Answer

No risk; the policy is standard

Question 9

A multinational retailer's risk committee is reviewing its risk register. The CISO argues that a newly identified vulnerability in the point-of-sale system should be escalated immediately to the board. The risk manager notes that the vulnerability has a low likelihood of exploitation and existing compensating controls reduce the impact to a tolerable level. Which of the following is the MOST appropriate action for the risk manager to take?

Accepted Answer

Document the vulnerability in the risk register with its assessed likelihood, impact, and compensating controls, and report it through the normal risk reporting process.. The risk manager should follow the organization's established risk assessment and reporting criteria. Since the vulnerability has low likelihood and compensating controls keep residual risk within tolerance, it does not meet the threshold for board escalation. Documenting it in the risk register with supporting rationale and reporting through normal channels ensures accurate risk visibility while avoiding unnecessary escalation.

Answer

Override the CISO's assessment and remove the vulnerability from the risk register to avoid unnecessary alarm.

Answer

Escalate the vulnerability to the board because all identified vulnerabilities must be reported to the highest governance body.

Answer

Close the vulnerability without documentation because the compensating controls already reduce the risk to an acceptable level.

Question 10

Match each risk response strategy to its definition.

Accepted Answer

Avoid: Identifying a risk and making the decision to no longer perform the activity that gives rise to the risk.. The correct matches are: Avoid – decision to not perform the activity; Accept – formal acceptance of risk; Mitigate – reduce likelihood/impact; Transfer – shift to another party. Common confusions include mixing transfer with avoidance and acceptance with mitigation.

Answer

Avoid: Shifting the risk to another party.

Answer

Accept: Actions taken to reduce the likelihood or impact of a risk.

Question 11

An organization is considering cyber insurance to transfer residual risk. Which factor would MOST significantly influence the premium?

Accepted Answer

Security controls and incident history. Cyber insurance premiums are most significantly influenced by the organization's security controls and incident history, because insurers underwrite based on the likelihood and severity of a claim. Strong controls (MFA, EDR, backups, segmentation) and a clean incident history reduce perceived risk and lower premiums; poor controls and prior breaches raise them.

Answer

Industry sector

Answer

Company revenue

Answer

Number of employees

Question 12

A company is considering outsourcing its data center operations to a cloud provider. Which risk treatment option is the company primarily exercising?

Accepted Answer

Risk transfer. Risk transfer shifts the financial and operational impact of a risk to a third party, typically through contracts, insurance, or outsourcing arrangements. By outsourcing data center operations to a cloud provider, the company contractsually shifts responsibility for the physical, operational, and infrastructure risks (power, cooling, hardware failure, physical security) to the provider. The risk itself still exists, but the ownership of its consequences is transferred via the service agreement and SLAs.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 13

Refer to the exhibit. Based on the exhibit, what is the most appropriate action regarding the control OWF?

Accepted Answer

The control should be reviewed because the alert frequency is approaching the threshold.. The exhibit shows that the OWF (Outbound Web Filtering) control has logged 95 alerts against a threshold of 100. Since the alert frequency is approaching but has not yet reached the threshold, the most appropriate action is to review the control to determine if the threshold is still appropriate or if the control needs tuning. Option C correctly identifies this proactive monitoring step, which aligns with the CRISC domain of Risk and Control Monitoring and Reporting.

Answer

The control is effective because the traffic was blocked.

Answer

The control is ineffective because alerts indicate potential malware.

Answer

No action is needed because the threshold has not been reached.

Question 14

An organization wants to promote a risk-aware culture. Which of the following actions is most effective in encouraging employees to report incidents without fear?

Accepted Answer

Establishing a non-punitive incident reporting policy. A non-punitive incident reporting policy is the most effective action because it directly removes the fear of retaliation or blame, which is the primary psychological barrier to reporting security incidents. By guaranteeing that employees will not face disciplinary action for reporting their own mistakes or observed issues, the organization fosters psychological safety and encourages timely disclosure. This aligns with the CRISC principle that a risk-aware culture requires trust and openness, which cannot be achieved through training or metrics alone if fear persists.

Answer

Conducting annual security awareness training

Answer

Publishing risk metrics on the intranet

Answer

Providing incentives for risk identification

Question 15

Which TWO of the following are valid risk scenarios that should be documented during IT risk identification?

Accepted Answer

An employee may inadvertently share confidential data via email due to lack of data classification training.. It describes a specific risk scenario: an employee inadvertently sharing confidential data via email due to lack of data classification training. This is a valid risk scenario as it identifies a threat (human error), a vulnerability (insufficient training), and a potential impact (data leakage). In IT risk identification, scenarios must be concrete and actionable, not just statements of compliance or controls.

Answer

The organization must comply with GDPR requirements for data protection.

Answer

The database server has not been patched for critical vulnerabilities.

Answer

The IT department will implement multi-factor authentication to reduce the risk of unauthorized access.

Question 16

During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?

Accepted Answer

Analyze the threat landscape and existing compensating controls to determine residual risk. The best approach to assess risk for a legacy application using a deprecated encryption protocol (e.g., SSL 3.0 or TLS 1.0) is to analyze the threat landscape and existing compensating controls. This allows the risk practitioner to determine the residual risk by considering factors such as whether the application is only accessible on an isolated network segment, whether network-level encryption (e.g., IPsec or a VPN tunnel) is in place, and whether the protocol is vulnerable to specific attacks like POODLE or BEAST. Simply assigning a high inherent risk score without further analysis (Option C) ignores compensating controls, while immediate escalation (Option D) or replacement (Option A) are risk treatment decisions, not risk assessment activities.

Answer

Replace the application with a modern alternative

Answer

Assign a high inherent risk score without further analysis

Answer

Immediately escalate to senior management for an exception

Question 17

A retail company monitors its key risk indicator (KRI) for credit card transaction fraud. The KRI has exceeded the established threshold for three consecutive days, but the weekly control performance report shows all fraud detection controls operating effectively. What should the risk practitioner do FIRST?

Accepted Answer

Investigate the data source of the KRI to ensure accuracy and timeliness.. The KRI breach may be caused by data inaccuracies or delays in the data feed, not by an actual increase in fraud. Investigating the data source ensures the KRI is reliable before taking any further action, aligning with the principle of validating monitoring data before making control decisions.

Answer

Immediately enhance the fraud detection controls.

Answer

Report the KRI breach to the board and recommend risk acceptance.

Answer

Adjust the KRI threshold to align with current control performance.

Question 18

An Architecture Review Board (ARB) is evaluating a new solution architecture for a customer-facing web application. Which of the following is the PRIMARY risk the ARB should consider?

Accepted Answer

The application exposes sensitive customer data through APIs without proper authentication. The primary risk an Architecture Review Board should consider is the exposure of sensitive customer data through unauthenticated APIs, because this represents a direct, high-impact security and compliance risk (data breach, regulatory penalties, reputational damage). ARBs focus on risks that threaten confidentiality, integrity, and availability of critical assets, and unauthenticated API access to sensitive data is a classic OWASP API Security Top 10 issue.

Answer

The application does not support mobile devices

Answer

The application development timeline is aggressive

Answer

The application uses the latest JavaScript framework

Question 19

An organization's IT risk team is promoting a risk-aware culture. Which initiative is most likely to encourage employees to report security incidents without fear?

Accepted Answer

Establishing a no-blame incident reporting policy. A no-blame incident reporting policy directly addresses the psychological barrier of fear of reprisal, which is the primary reason employees hesitate to report security incidents. By explicitly stating that reporters will not face disciplinary action for unintentional errors or omissions, the organization fosters psychological safety and encourages timely reporting, which is critical for effective risk response.

Answer

Publishing quarterly incident statistics

Answer

Increasing the frequency of security awareness training

Answer

Implementing automated incident detection

Question 20

Which THREE of the following are common challenges when implementing a risk monitoring dashboard? (Select exactly three.)

Accepted Answer

Data quality and consistency issues. Data quality and consistency issues (A) are a common challenge because risk monitoring dashboards aggregate data from multiple sources, each with its own format, timeliness, and accuracy. Inconsistent data leads to unreliable metrics and false alarms, undermining the dashboard's purpose of providing a single source of truth for risk posture.

Answer

Reduced need for manual controls

Answer

Improved decision-making