CRISC Practice Test 5 — 25 Questions

Question 1

A financial institution is integrating a new cloud-based analytics platform that will process sensitive customer data. The project team is conducting risk identification. Which technique would be MOST effective for identifying risks related to the integration of this platform with existing on-premises systems?

Accepted Answer

Threat modeling of the integration architecture.. Threat modeling of the integration architecture is the most effective technique because it systematically identifies potential security threats, attack vectors, and vulnerabilities specific to the data flows, trust boundaries, and API interactions between the cloud-based analytics platform and existing on-premises systems. Unlike generic methods, threat modeling (e.g., STRIDE or PASTA) focuses on the unique integration points, such as authentication handshakes, data-in-transit encryption (TLS 1.2/1.3), and session management, which are critical for protecting sensitive customer data during integration.

Answer

Vulnerability scanning of the cloud platform's API endpoints.

Answer

Brainstorming sessions with the project team.

Answer

SWOT analysis to assess strengths, weaknesses, opportunities, and threats.

Question 2

A critical infrastructure organization is enhancing its threat identification capabilities. The risk team wants to leverage threat intelligence sources to identify emerging threats. Which THREE sources are most relevant for obtaining actionable threat intelligence?

Accepted Answer

OSINT (Open Source Intelligence). OSINT provides open-source threat data, ISACs offer sector-specific intelligence, and government advisories (e.g., CISA KEV) provide authoritative information on exploited vulnerabilities. Commercial feeds are useful but not always actionable or free.

Answer

Commercial threat feeds

Answer

Social media monitoring

Question 3

A risk practitioner is using a 5×5 heat map to assess IT risks. Which of the following is the primary advantage of this qualitative approach?

Accepted Answer

Requires less data and time to implement. A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Answer

Produces financially meaningful loss estimates

Answer

Provides objective and comparable risk scores across organizations

Answer

Eliminates subjectivity in risk ratings

Question 4

An organization is evaluating risks and decides to purchase cyber insurance to cover potential financial losses from data breaches. Which risk treatment option does this represent?

Accepted Answer

Transfer. Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.

Answer

Accept

Answer

Mitigate

Answer

Avoid

Question 5

A company is evaluating the risk of a data breach using the FAIR framework. The threat event frequency is estimated at 10 per year, and the vulnerability is 0.2. The primary loss per event is $50,000 and secondary loss is $20,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$140,000. The annualized loss expectancy (ALE) is calculated as threat event frequency (TEF) × vulnerability (V) × loss per event. Here, TEF = 10, V = 0.2, primary loss = $50,000, secondary loss = $20,000, so total loss per event = $70,000. ALE = 10 × 0.2 × $70,000 = 10 × $14,000 = $140,000, making option B correct.

Answer

$100,000

Answer

$70,000

Answer

$1,400,000

Question 6

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 7

During a quantitative risk analysis, the risk team calculates the loss event frequency (LEF) using the FAIR framework. If the threat event frequency (TEF) is 10 per year and the vulnerability (V) is 0.3, what is the LEF?

Accepted Answer

3 per year. In the FAIR framework, loss event frequency (LEF) is calculated as the product of threat event frequency (TEF) and vulnerability (V). Given TEF = 10 per year and V = 0.3, LEF = 10 × 0.3 = 3 per year. This represents the expected number of loss events per year, accounting for the probability that a threat event will actually result in a loss.

Answer

10.3 per year

Answer

30 per year

Answer

0.3 per year

Question 8

In the FAIR framework, which of the following correctly represents the calculation of Loss Event Frequency (LEF)?

Accepted Answer

LEF = Threat Event Frequency × Vulnerability. In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.

Answer

LEF = Threat Event Frequency + Vulnerability

Answer

LEF = Asset Value × Vulnerability

Answer

LEF = Annualized Rate of Occurrence × Single Loss Expectancy

Question 9

When prioritizing risk treatment actions, which of the following should be the primary consideration?

Accepted Answer

Risk level and cost-benefit analysis. Risk prioritization should balance the risk level (high vs low) and the cost-benefit of controls. High risks with cost-effective controls should be prioritized.

Answer

Ease of implementation

Answer

Regulatory compliance only

Answer

Risk owner preference

Question 10

After implementing controls for a high-risk IT process, the residual risk is calculated as medium. The risk owner argues that the controls are not adequate because the inherent risk was critical. Which of the following should be the primary basis for determining control adequacy?

Accepted Answer

The reduction from inherent risk to residual risk based on control effectiveness. Control adequacy is determined by assessing both design adequacy and operating effectiveness, which together reduce inherent risk to the desired residual risk level.

Answer

The number of controls implemented

Answer

The cost of controls relative to the asset value

Answer

The industry standards for similar processes

Question 11

An organization is implementing controls to mitigate the risk of data exfiltration. Which TWO control types would be considered preventive? (Select TWO)

Accepted Answer

Access controls to restrict data access. Preventive controls aim to stop a risk event from occurring. Access controls prevent unauthorized access, and encryption prevents data from being read if exfiltrated. Log monitoring is detective, and backup restoration is corrective.

Answer

Incident response plan

Answer

Backup restoration procedures

Answer

Log monitoring and analysis

Question 12

In a quantitative risk analysis using FAIR, which of the following best represents Loss Magnitude (LM)?

Accepted Answer

Primary Loss + Secondary Loss. In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

Answer

Single Loss Expectancy (SLE)

Answer

Threat Event Frequency × Vulnerability

Answer

Annualized Loss Expectancy (ALE)

Question 13

During an IT risk assessment, the risk team identifies a high inherent risk for a legacy application. The team is evaluating control options. Which THREE are considered preventive controls?

Accepted Answer

Encryption of data at rest. Preventive controls aim to stop risk events. Access controls, encryption, and change management are preventive. Logs are detective, backup restoration is corrective.

Answer

Log monitoring

Answer

Backup restoration procedures

Question 14

In third-party risk management, which of the following is typically used for initial onboarding assessment of a vendor?

Accepted Answer

Security questionnaire. Security questionnaires are commonly used during initial vendor assessment to gather information about the vendor's security posture.

Answer

Contract compliance review

Answer

SOC 2 Type II report

Answer

Shared intelligence platform feed

Question 15

During a cost-benefit analysis for a new control, the annualized loss expectancy (ALE) without the control is $500,000. The control is expected to reduce risk by 80% and will cost $150,000 annually to operate. What is the net benefit of implementing the control?

Accepted Answer

$250,000. ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Answer

$400,000

Answer

$100,000

Answer

$350,000

Question 16

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000

Question 17

An organization’s continuous monitoring program includes automated vulnerability scanning and log review. Which of the following is a Key Risk Indicator (KRI) that would BEST signal an increasing risk of a successful network breach?

Accepted Answer

Spike in failed authentication attempts from external IPs. A KRI should be leading, indicating a change in risk level. A spike in failed authentication attempts often precedes a brute force attack or credential compromise, signaling increased risk of breach.

Answer

Average time to patch critical vulnerabilities

Answer

Number of firewall rule changes per month

Answer

Percentage of systems with up-to-date antivirus signatures

Question 18

An organization's risk committee reviews a risk heat map showing that a key IT risk has moved from the "high" to "medium" category. However, the associated control's effectiveness has decreased from 95% to 85%. What is the most likely explanation?

Accepted Answer

The inherent risk has decreased due to external factors.. The risk heat map shows a reduction in residual risk from high to medium, yet the control effectiveness dropped from 95% to 85%. This apparent contradiction is best explained by a decrease in inherent risk—the risk before controls are applied. If inherent risk falls (e.g., due to external factors like new regulations or reduced threat activity), the residual risk can decrease even if the control becomes less effective, because the starting risk level is lower.

Answer

The control testing frequency was increased.

Answer

The risk assessment methodology was changed.

Answer

The control owner has implemented additional compensating controls.

Question 19

An IT risk manager is preparing a report for the board of directors. Which of the following content elements is most important for strategic risk reporting?

Accepted Answer

IT risk integration with enterprise risk management. Strategic risk reporting to the board requires a high-level view that aligns IT risk with enterprise objectives. Option B is correct because it demonstrates how IT risk is integrated into the broader enterprise risk management (ERM) framework, enabling the board to understand the business impact of IT risks. This integration is essential for strategic decision-making, as it connects technical risk data to organizational goals and risk appetite.

Answer

Weekly vulnerability scan results

Answer

List of all vendor risk assessments

Answer

Detailed control performance metrics

Question 20

A company is integrating its IT risk management program with the enterprise risk management (ERM) program. What is the primary benefit of this integration?

Accepted Answer

It provides a holistic view of risk across the organization.. Integration ensures that IT risks are considered in the context of overall organizational objectives and that risk responses are aligned across the enterprise.

Answer

It allows IT to operate independently from business units.

Answer

It eliminates the requirement for a separate IT risk register.

Answer

It reduces the need for IT-specific risk assessments.