CRISC Practice Test 5 — 25 Questions

Question 1

After a major system upgrade, the control testing team reports that a critical automated control failed intermittently. The control owner states it's a temporary glitch. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a root cause analysis before deeming it effective.. An intermittent failure in a critical automated control requires a root cause analysis (RCA) to determine whether the issue is a transient software bug, a configuration error, or a deeper systemic flaw. Without understanding the root cause, the control cannot be deemed effective, and simply replacing, monitoring, or accepting the risk could leave the organization exposed to material control failures. The RCA should examine system logs, error codes, and change management records to isolate the intermittent behavior.

Answer

Replace the control with a manual one.

Answer

Increase frequency of monitoring.

Answer

Accept the risk and document the finding.

Question 2

A company is implementing a new access control system. According to the project plan, user training will be delivered after the system goes live. What change management issue does this present?

Accepted Answer

Training after go-live may lead to user errors and security incidents. Training should ideally be delivered before go-live to ensure users can operate the system securely. Delaying training increases the risk of errors and security incidents.

Answer

Training after go-live ensures the system is fully operational

Answer

Training after go-live is more effective because users have context

Answer

Training after go-live reduces the project budget

Question 3

A risk manager notices that a key risk indicator (KRI) has been consistently above the threshold for three months. What should be the first action?

Accepted Answer

Review the KRI definition and data source for accuracy.. Before escalating or implementing additional controls, it is important to verify the accuracy of the KRI data and definition. Option C is correct because data integrity issues are a common cause of false alarms. Option A is premature without verification. Option B is reactive without understanding the root cause. Option D is premature; escalation should follow verification.

Answer

Adjust the threshold to a higher value.

Answer

Implement additional controls immediately.

Answer

Escalate to senior management immediately.

Question 4

A large retail company is implementing a new cloud-based inventory management system. The system will store sensitive customer data and integrate with existing on-premises ERP. The risk manager is asked to identify the most critical risk to address in the shared responsibility model. Which risk is MOST likely to be overlooked?

Accepted Answer

Misconfiguration of access controls. In the shared responsibility model, the cloud provider secures the infrastructure (security OF the cloud), while the customer is responsible for securing what they put IN the cloud—including access controls, identity management, and configuration of their own applications and data. Misconfiguration of access controls is the most commonly overlooked risk because organizations often assume the provider handles all security, leading to overly permissive IAM roles, exposed storage buckets, or weak authentication. This risk is directly under the customer's control and is a leading cause of cloud data breaches, making it the most critical to address.

Answer

Vendor lock-in

Answer

Multi-tenancy isolation

Answer

Data sovereignty compliance

Question 5

An organization is evaluating the risk of a ransomware attack. Using the FAIR framework, which of the following components directly multiplies to calculate Loss Event Frequency (LEF)?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is calculated as Threat Event Frequency (TEF) multiplied by Vulnerability (V).

Answer

Control Effectiveness and Residual Risk

Answer

Annual Loss Expectancy and Single Loss Expectancy

Answer

Primary Loss and Secondary Loss

Question 6

Which of the following BEST describes inherent risk?

Accepted Answer

The risk level before any controls are applied. Inherent risk is defined as the level of risk that exists in the absence of any controls or mitigations. It represents the raw, untreated risk exposure that an organization faces from a specific threat-vulnerability pair, such as the risk of data exfiltration from an unpatched web server before any firewall rules, intrusion detection systems, or encryption are applied.

Answer

The level of risk after implementing controls

Answer

The amount of risk the organization is willing to accept

Answer

The risk level that remains after considering existing controls

Question 7

Which COBIT 2019 domain objective focuses on ensuring that risk is optimized through evaluation, direction, and monitoring?

Accepted Answer

EDM03 — Ensure Risk Optimization. EDM03 — Ensure Risk Optimization is the governance objective that addresses risk management evaluation, direction, and monitoring.

Answer

EDM01 — Ensure Governance Framework Setting and Maintenance

Answer

EDM02 — Ensure Benefits Delivery

Answer

EDM04 — Ensure Resource Optimization

Question 8

You are a risk practitioner at a financial institution that is migrating its core banking system to a cloud provider. The migration plan includes a phased approach, with the first phase moving non-critical applications. However, during the second phase (moving customer-facing applications), the cloud provider experiences a major outage that lasts 6 hours. The outage was caused by a misconfiguration in the provider's network. The institution had conducted a risk assessment and identified cloud provider downtime as a risk, but the treatment plan only included a service level agreement (SLA) with financial penalties. The SLA does not cover the reputational damage and loss of customer trust. The risk register shows that the residual risk level was marked as 'low' before the incident. After the incident, senior management is demanding a review. Which of the following is the MOST appropriate action for the risk practitioner to take?

Accepted Answer

Reassess the risk and recommend implementing a multi-cloud architecture for critical applications. The incident revealed that the existing risk treatment (SLA financial penalties) was insufficient to address the actual impact (reputational damage and loss of customer trust). The risk practitioner must reassess the risk with the new information and recommend a more robust mitigation strategy, such as multi-cloud architecture, to reduce the likelihood or impact of a single provider's outage affecting critical customer-facing applications.

Answer

Negotiate a higher penalty in the SLA

Answer

Initiate a legal claim against the provider

Answer

Update the risk register to reflect the incident and accept the residual risk

Question 9

A risk practitioner is designing a monitoring dashboard for senior management. Which key performance indicator (KPI) would be MOST useful for tracking control effectiveness over time?

Accepted Answer

Percentage of controls passing automated tests.. The percentage of controls passing automated tests directly measures the effectiveness of controls over time. A trend of increasing or stable high percentages indicates that controls are functioning as intended, while a decline signals degradation. This KPI is specifically designed for control monitoring, unlike metrics that measure activity or outcomes.

Answer

Number of security incidents reported.

Answer

Number of transactions processed per hour.

Answer

Value at Risk (VaR) for operational risk.

Question 10

Which TWO of the following are examples of inherent risk?

Accepted Answer

Risk of unauthorized access due to weak password policy. Inherent risk is the level of risk that exists before any controls or mitigations are applied, so option A (risk of unauthorized access due to weak password policy) qualifies because a weak password policy is a control deficiency that leaves the underlying exposure untreated, making unauthorized access an inherent risk. Option B (risk of data breach due to unencrypted sensitive data) also qualifies because storing sensitive data without encryption is an unmitigated condition, so the resulting breach exposure is inherent rather than residual. Option C is incorrect because residual risk is what remains after controls such as firewalls are implemented, which is the opposite of inherent risk. Option D is incorrect because risk appetite is a governance decision about how much risk an organization is willing to accept, not a risk example. Option E is incorrect because risk reduction from multifactor authentication describes the effect of a control, not an inherent exposure.

Answer

Residual risk after implementing firewalls

Answer

Risk appetite defined by the board

Answer

Risk reduction achieved by multifactor authentication

Question 11

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

Accepted Answer

Formally accept the residual risk. When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

Answer

Re-assess the inherent risk

Answer

Reduce current controls to lower costs

Answer

Implement additional controls despite the cost

Question 12

A regional bank uses a centralized GRC platform to monitor key risk indicators (KRIs) for operational risk. The chief risk officer (CRO) reviews the monthly risk report and notices that the KRI 'number of system outages exceeding 4 hours' has been consistently reported as 0 for the past six months. However, the IT incident log shows three such outages in the same period. The CRO suspects the KRI is not being accurately reported. What should the risk manager do next?

Accepted Answer

Investigate the KRI calculation and data feed to identify why outages are not being captured. The risk manager must first investigate the KRI calculation and data feed to determine why the IT incident log shows three outages but the KRI reports zero. Without understanding the root cause of the reporting discrepancy—whether it is a data integration error, a threshold misconfiguration, or a failure in the GRC platform's automated data collection—any subsequent action would be premature and could mask the underlying control monitoring failure.

Answer

Add additional controls to reduce the likelihood of system outages

Answer

Update the risk register to reflect the recent outage incidents

Answer

Increase the KRI threshold to 2 outages to align with historical data

Question 13

An IT risk report to the board of directors should primarily focus on which of the following?

Accepted Answer

Strategic risks and risk trends affecting the organization. The board of directors requires a high-level view of IT risk that aligns with business strategy and enterprise risk management. Strategic risks and risk trends provide the necessary context for informed decision-making, focusing on the aggregate impact of risk on organizational objectives rather than operational minutiae.

Answer

Specific control test results for each system

Answer

Vendor risk assessment scores for all third parties

Answer

Detailed weekly operational incidents

Question 14

An organization's risk report shows a risk heat map with several risks in the high-likelihood, high-impact quadrant. What is the most appropriate action for the risk owner?

Accepted Answer

Evaluate current controls and consider additional treatment. Risks in the high-likelihood, high-impact quadrant exceed the organization's risk appetite and require active treatment. The risk owner should first evaluate the effectiveness of existing controls, then consider additional treatment options (mitigate, transfer, avoid, or accept with justification). Simply accepting or ignoring high-exposure risks is not defensible risk management.

Answer

Report to the board without any analysis

Answer

Ignore the risks as they are inherent

Answer

Accept the risk without further action

Question 15

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system processes non-critical data. The risk manager has determined that the likelihood of exploitation is low, but the impact would be high. Which risk response strategy is MOST appropriate?

Accepted Answer

Accept the risk with compensating controls such as network segmentation.. The system processes non-critical data and cannot be patched, making risk acceptance with compensating controls the most appropriate strategy. Network segmentation reduces the likelihood of exploitation by isolating the legacy system from critical assets, while the low likelihood and non-critical data make decommissioning or insurance less suitable. This aligns with CRISC best practices for legacy systems where patching is impossible and the risk is within the organization's risk appetite.

Answer

Mitigate the risk by applying vendor patches.

Answer

Avoid the risk by decommissioning the system immediately.

Answer

Transfer the risk by purchasing cyber insurance.

Question 16

A medium-sized e-commerce company has a risk monitoring program that tracks key risk indicators (KRIs) monthly. One KRI is the percentage of orders with failed payment transactions. The threshold is 2%, but for the past three months, the KRI has been 2.5%, 3.1%, and 2.8%. The risk owner says this is due to a seasonal increase in fraudulent transactions and expects it to return to normal next month. The company has a compensating control that manually reviews flagged transactions. The internal audit team recently tested the compensating control and found it to be 100% effective. The risk committee wants to know if the KRI breach requires action. What should the risk practitioner recommend?

Accepted Answer

Acknowledge the breach but note that the compensating control is effective, so no immediate action is required; continue to monitor.. The compensating control (manual review of flagged transactions) has been tested as 100% effective, meaning the residual risk is within acceptable tolerance despite the KRI breach. The risk owner attributes the breach to a seasonal spike, and the risk monitoring program should continue to track the KRI monthly to confirm a return to normal. Immediate action is not warranted when the compensating control fully mitigates the risk, and the risk committee should be informed that the control is effective.

Answer

Immediately implement additional automated controls to reduce the KRI.

Answer

Escalate the issue to the board and recommend a risk acceptance.

Answer

Lower the KRI threshold to 3% to accommodate seasonal variations.

Question 17

A risk practitioner notices that a key control is tested only once a year, but the associated risk has a high velocity of change. What is the BEST recommendation?

Accepted Answer

Increase testing frequency to quarterly or monthly. A high velocity of change means the risk profile can shift rapidly between annual tests, leaving the organization exposed for months. Increasing testing frequency to quarterly or monthly ensures that control effectiveness is validated in near real-time, aligning monitoring cadence with risk dynamics. This is a core principle of risk-based monitoring: the testing interval must match the speed at which the risk can materialize.

Answer

Remove the control if it cannot be tested more often

Answer

Wait for a control failure before increasing frequency

Answer

Continue annual testing because it meets regulatory requirements

Question 18

A board member asks for a summary of the top five risks. The risk practitioner has 10 risks with current residual risk levels. Which approach BEST supports board-level reporting?

Accepted Answer

Present the top five by residual risk level, including a trend indicator. Board-level reporting requires concise, actionable insights. Presenting the top five risks by residual risk level, with a trend indicator (e.g., increasing, stable, decreasing), allows the board to quickly understand the most critical exposures and whether risk posture is improving or deteriorating. This aligns with the CRISC focus on risk communication that supports strategic decision-making, not operational detail.

Answer

Only highlight risks that have increased since last quarter

Answer

List risks alphabetically with current control status

Answer

Provide a detailed risk register with all 10 risks and full risk analysis

Question 19

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. When the cost of a control exceeds the ALE and the risk is already within the organization's risk appetite, accepting the risk is the economically justified response. Spending $500k to mitigate a $300k annualized loss is not cost-effective, and the risk is tolerable by definition.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 20

An organization is evaluating a new security control that costs $50,000 annually to implement and maintain. The current annualized loss expectancy (ALE) for a related risk is $200,000. The control is expected to reduce the ALE by 85%. Using cost-benefit analysis, what is the net benefit of implementing this control?

Accepted Answer

$120,000. The reduction in ALE is 85% of $200,000 = $170,000. The annual control cost is $50,000. Net benefit = $170,000 - $50,000 = $120,000.

Answer

$30,000

Answer

$170,000

Answer

$150,000