CRISC Practice Test 5 — 25 Questions

Question 1

Sequence the steps for developing a disaster recovery plan (DRP).

Accepted Answer

Business Impact Analysis (BIA), Prioritize critical functions, Select recovery strategy, Document the plan, Test the plan. DRP development begins with BIA, prioritization, strategy selection, documentation, and testing.

Answer

Document the plan, Business Impact Analysis (BIA), Prioritize critical functions, Select recovery strategy, Test the plan

Answer

Select recovery strategy, Business Impact Analysis (BIA), Prioritize critical functions, Document the plan, Test the plan

Answer

Business Impact Analysis (BIA), Select recovery strategy, Prioritize critical functions, Test the plan, Document the plan

Question 2

Match each risk management process step to its activity.

Accepted Answer

Risk Identification: The process of finding, recognizing, and documenting risks.. The risk management process steps are distinct: Risk Identification finds risks, Risk Assessment evaluates them, and Risk Response addresses them. Common confusions involve swapping these definitions.

Answer

Risk Identification: The process of determining the probability and impact of identified risks.

Answer

Risk Assessment: The process of finding, recognizing, and documenting risks.

Question 3

During a risk assessment, the IT risk manager needs to prioritize risks for treatment. Which of the following risk characteristics should be weighted MOST heavily?

Accepted Answer

The degree to which the risk affects strategic business objectives. In CRISC, risk prioritization is fundamentally driven by alignment with strategic business objectives because IT risk management exists to protect the enterprise’s mission and goals. Even a high-likelihood or high-financial-impact risk may be deprioritized if it does not materially affect the organization’s strategic objectives, as the risk treatment decision must support business value and continuity. This weighting ensures that resources are allocated to risks that most threaten the enterprise’s ability to achieve its core mission.

Answer

The ease of implementing mitigating controls

Answer

The likelihood that the threat will be exploited

Answer

The financial impact calculated in monetary terms

Question 4

Which TWO of the following are leading indicators that could be used as KRIs for information security risk? (Select TWO.)

Accepted Answer

Patch lag (average time to apply critical patches). Patch lag (average time to apply critical patches) is a leading indicator that measures the organization's vulnerability exposure window before an exploit occurs. A shorter patch lag indicates proactive risk mitigation, while a longer lag signals increased risk of compromise, making it a forward-looking KRI for information security risk.

Answer

Number of security incidents in the past quarter

Answer

Number of audit findings from the last audit

Answer

Percentage of employees who completed security awareness training

Question 5

An organization uses a qualitative risk assessment methodology. During a recent assessment, several risks were rated as 'high' due to vague definitions. What is the BEST way to improve the accuracy of the assessment?

Accepted Answer

Define clear and objective rating criteria for likelihood and impact. Vague rating criteria lead to inconsistent and subjective risk scores. By defining clear and objective rating criteria for likelihood and impact, the organization ensures that all assessors apply the same standards, reducing ambiguity and improving the accuracy of the qualitative assessment.

Answer

Switch to a quantitative methodology

Answer

Assign a single expert to rate all risks

Answer

Use historical loss data as the primary input

Question 6

Which TWO of the following are recognized techniques for identifying IT risks? (Select exactly 2.)

Accepted Answer

Brainstorming sessions. Brainstorming sessions (B) are a recognized technique for IT risk identification because they leverage the collective expertise of stakeholders to surface potential threats, vulnerabilities, and risk scenarios in a structured or unstructured group setting. This method is specifically cited in ISACA's CRISC Review Manual as a qualitative risk identification approach, often used during the early stages of risk assessment to generate a comprehensive list of risks without requiring quantitative data.

Answer

ROI calculation

Answer

Benchmarking against industry peers

Answer

SWOT analysis

Question 7

A SIEM generates alerts for the following events. Which TWO events should be considered potential emerging risks? (Select exactly 2.)

Accepted Answer

High number of failed authentication attempts from a single IP. A high number of failed authentication attempts from a single IP (C) is a classic indicator of a brute-force or password-spraying attack. This represents an emerging risk because it signals active reconnaissance or attempted unauthorized access, which could lead to account compromise or lateral movement if successful.

Answer

Scheduled backup completed successfully

Answer

Software update installed on server

Answer

Low disk space alert on a file server

Question 8

Which TWO risk identification techniques are most appropriate for identifying emerging risks from new technologies?

Accepted Answer

Scenario analysis. Scenario analysis is correct because it involves constructing plausible future states to explore how new technologies might introduce unforeseen risks, making it ideal for emerging technologies where historical data is absent. Threat intelligence feeds are correct because they provide real-time, external data on vulnerabilities, exploits, and attack patterns targeting new technologies, enabling proactive risk identification.

Answer

Historical incident review

Answer

Delphi technique

Answer

Peer benchmarking

Question 9

An international bank is expanding its operations into a new country with strict data localization laws. The IT department plans to use a cloud service provider that stores data in neighboring countries but promises compliance. The risk team has identified several potential risks: regulatory fines for non-compliance, data interception during cross-border transmission, and difficulty in auditing the cloud provider. The legal team advises that the contract includes data protection clauses, but these have not been tested. The risk manager must now prioritize risk identification efforts. What is the MOST important risk identification step the risk team should undertake?

Accepted Answer

Perform a regulatory compliance assessment specific to the new country's laws.. The most critical risk identification step when entering a new country with strict data localization laws is to perform a regulatory compliance assessment specific to that country's laws. This ensures the bank understands the exact legal requirements for data storage, processing, and transfer, which directly informs whether the cloud provider's promised compliance is achievable. Without this assessment, the risk team cannot accurately identify the scope and severity of regulatory fines or other legal risks.

Answer

Review the cloud provider's SOC 2 report.

Answer

Conduct a thorough legal review of the contract's data handling clauses.

Answer

Map data flows to ensure all data is properly classified.

Question 10

Refer to the exhibit. A risk manager is reviewing IAM policies for an S3 bucket used for sensitive data. This policy allows which of the following?

Accepted Answer

Users from the internal network (10.0.0.0/8) to write (PutObject) to the bucket. The policy statement includes a condition that restricts the s3:PutObject action to requests originating from the 10.0.0.0/8 IP range, and the principal is set to '*' (any authenticated user), meaning only authenticated users from the internal network can write to the bucket. The policy does not grant GetObject permissions, so reads are not allowed.

Answer

Any user to read (GetObject) from the bucket

Answer

Any user to write (PutObject) to the bucket from any IP address

Answer

Users from the internal network to read (GetObject) from the bucket

Question 11

A control test reveals a 100% pass rate for a detective control. What does this indicate?

Accepted Answer

The control is operating effectively. A 100% pass rate for a detective control indicates that every time the control was tested, it successfully detected the condition or event it was designed to identify. This demonstrates the control is operating effectively, meaning it is functioning as intended and providing the expected level of assurance. For example, if the detective control is an intrusion detection system (IDS) that correctly alerts on all test attack patterns, a 100% pass rate confirms its detection logic and signature updates are working correctly.

Answer

The control is too expensive to maintain

Answer

The control is compensating for other weaknesses

Answer

The associated risk has been fully mitigated

Question 12

An organization uses the FAIR framework to assess the risk of a data breach. The risk analyst estimates that the Threat Event Frequency (TEF) is 10 per year, the Vulnerability (V) is 0.2, the Primary Loss per event is $50,000, and the Secondary Loss per event is $30,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$160,000. ALE = LEF × LM. LEF = TEF × V = 10 × 0.2 = 2. LM = Primary Loss + Secondary Loss = $50,000 + $30,000 = $80,000. ALE = 2 × $80,000 = $160,000.

Answer

$100,000

Answer

$800,000

Answer

$80,000

Question 13

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. Risk avoidance means stopping the activity that introduces the risk.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 14

During a vendor risk assessment, an organization discovers that a critical vendor has not performed a security assessment in two years. The vendor is tiered as 'medium risk'. According to best practices, what should the risk practitioner recommend?

Accepted Answer

Request a current SOC 2 report or equivalent assessment. A SOC 2 report (or equivalent, such as an ISO 27001 certification or a SIG assessment) provides independent assurance over a vendor's controls, including security monitoring and assessment cadence. Since the vendor is tiered as 'medium risk' and has not performed a security assessment in two years, the risk practitioner should request current evidence of control effectiveness rather than accept, ignore, or escalate the risk prematurely. This aligns with the CRISC principle of verifying control status before making risk response decisions.

Answer

Downgrade the vendor to low risk to reduce monitoring frequency

Answer

Accept the risk because the vendor is only medium risk

Answer

Terminate the relationship immediately

Question 15

A company has implemented a new cloud-based customer relationship management (CRM) system. The IT risk manager is tasked with identifying risks related to this system. Which of the following is the MOST important risk identification technique to use initially?

Accepted Answer

Facilitating a risk workshop with IT, business, and security stakeholders. Facilitating a risk workshop (option C) is the most important initial risk identification technique because it brings together IT, business, and security stakeholders to collaboratively identify a broad range of risks associated with the new CRM system. This approach is more comprehensive than alternative methods: conducting interviews (option A) may miss systemic risks, while penetration testing (option B) and vulnerability scanning (option D) are focused on technical security vulnerabilities and are more appropriate for later stages of risk assessment.

Answer

Conducting a series of interviews with key users of the CRM

Answer

Performing a penetration test on the CRM environment

Answer

Automated vulnerability scanning of the CRM system

Question 16

A risk manager is reviewing the risk report content for a quarterly IT risk committee meeting. Which TWO items are most important to include in the report?

Accepted Answer

Risk heat map. A risk heat map is a critical visual tool for risk reporting because it provides a concise, at-a-glance view of the likelihood and impact of identified risks, enabling the IT risk committee to quickly prioritize and make informed decisions. It directly supports the Risk Response and Reporting domain by summarizing complex risk data into actionable insights, which is essential for quarterly governance meetings.

Answer

Individual employee performance metrics

Answer

Detailed technical logs

Answer

List of all IT assets

Question 17

An organization is reviewing its IT risk management program and identifies that the risk register is not being updated after project changes. Which TWO components of the risk management program are most likely deficient?

Accepted Answer

Risk management policy. The risk management policy (B) is deficient because it should mandate periodic updates to the risk register after project changes, ensuring alignment with the organization's risk appetite and tolerance. Without a policy that explicitly requires post-change risk reassessment, the process lacks governance and accountability. Risk reporting (C) is also deficient because it fails to communicate the updated risk status to stakeholders, which is critical for informed decision-making and maintaining an accurate risk posture.

Answer

Risk register

Answer

Risk assessment methodology

Answer

Risk treatment process

Question 18

Refer to the exhibit. What risk is most directly indicated by this log entry?

Accepted Answer

Unauthorized access attempt. The log entry shows repeated failed login attempts via RDP from internal IP addresses (10.0.1.100 and 192.168.2.50). This pattern directly indicates an unauthorized access attempt, as someone is trying to gain access using incorrect credentials. It is not an external attack because the source IPs are internal, not a misconfigured firewall because the traffic is allowed but authentication fails, and not definitively an insider threat as the source could be a compromised system. The most direct risk is the unauthorized access attempt.

Answer

External attack

Answer

Misconfigured firewall

Answer

Insider threat

Question 19

Which TWO are primary objectives of IT risk identification?

Accepted Answer

Identify threats and vulnerabilities. IT risk identification primarily involves cataloging threats (e.g., malware, insider misuse) and vulnerabilities (e.g., unpatched CVEs, misconfigured firewalls) that could exploit weaknesses in assets. This step is foundational to building a risk register and precedes any analysis or treatment. Without identifying specific threats and vulnerabilities, subsequent risk assessment and mitigation efforts would lack a factual basis.

Answer

Assign risk owners

Answer

Determine risk appetite

Answer

Implement controls

Question 20

A large financial services firm recently deployed a new security information and event management (SIEM) system to monitor thousands of servers, network devices, and applications. The system is generating over 1,000 alerts per hour, of which 80% are false positives. The security operations center (SOC) team is overwhelmed and has started ignoring all but the most critical alerts. As a result, a real attack recently went undetected for 48 hours. The risk manager is asked to recommend improvements. The SOC team has 12 analysts working in shifts. The SIEM is properly configured but the correlation rules are broad and noisy. The firm cannot add more staff due to budget freeze. What should the risk manager prioritize?

Accepted Answer

Tune the alerting rules and adopt risk-based prioritization to filter out known false positives.. Tuning alerting rules with risk-based prioritization reduces noise and ensures the SOC focuses on true positives. Disabling low-priority alerts (A) may cause missing important events; hiring (D) is not feasible due to budget freeze; machine learning (B) is complex and still needs tuning.

Answer

Disable all low-priority alerts to reduce volume immediately.

Answer

Implement a machine learning algorithm to automatically classify alerts.

Answer

Request budget to hire five additional SOC analysts.