CRISC Practice Test 26 — 15 Questions

Question 1

A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?

Accepted Answer

Include security requirements in the contract and perform regular vendor audits. Option A is correct because contractually requiring the vendor to adhere to security standards and performing audits is a common risk mitigation approach. Option B is wrong as transferring via insurance doesn't reduce the actual risk. Option C is wrong as avoidance by not using the system may be too drastic. Option D is wrong as denial is not a risk response.

Answer

Deny the existence of the risk

Answer

Purchase cyber insurance to cover potential losses

Answer

Avoid using the cloud CRM system

Question 2

A risk assessment reveals that a data center is located in a flood-prone area. The organization decides to build a secondary data center in a different region and replicate critical data between both sites. This is an example of which risk response?

Accepted Answer

Risk mitigation. Option C is correct because mitigation involves reducing risk through controls like redundancy. Option A is wrong because avoidance would mean moving the primary data center. Option B is wrong because transfer would involve insurance. Option D is wrong because acceptance would mean doing nothing.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 3

After implementing a set of controls, the risk owner calculates the residual risk and finds it is still above the risk tolerance. However, the cost to further reduce the risk exceeds the potential loss. What is the MOST appropriate next step?

Accepted Answer

Formally accept the residual risk. Option B is correct because when additional mitigation is cost-prohibitive, acceptance with formal sign-off is appropriate. Option A is wrong as implementing further controls is not cost-effective. Option C is wrong because reducing controls would increase risk. Option D is wrong because re-assessing inherent risk doesn't change the situation.

Answer

Re-assess the inherent risk

Answer

Reduce current controls to lower costs

Answer

Implement additional controls despite the cost

Question 4

An organization is considering outsourcing its IT support to a third-party provider. The risk manager has identified that the provider's data handling practices may not comply with regulatory requirements. Which of the following is the BEST risk response strategy?

Accepted Answer

Avoid by keeping IT support in-house. Option D is correct because the most effective response is to avoid by not outsourcing if compliance cannot be ensured. Option A is wrong because transferring via contract may not be sufficient. Option B is wrong because mitigation through monitoring may not ensure compliance. Option C is wrong because acceptance is not appropriate when regulatory non-compliance is possible.

Answer

Mitigate by regularly monitoring the provider

Answer

Transfer the risk through the outsourcing contract

Answer

Accept the risk because the provider is cheaper

Question 5

A bank implements a new transaction monitoring system to detect fraudulent activities. After six months, the system has a high false positive rate, causing analysts to miss real threats. Which of the following is the BEST way to address this risk?

Accepted Answer

Tune the system to reduce false positives. Option C is correct because tuning the system reduces false positives, improving effectiveness. Option A is wrong as removal would leave the bank exposed. Option B is wrong as hiring more analysts does not fix the root cause. Option D is wrong as ignoring false positives would increase risk.

Answer

Accept the false positives as a cost of doing business

Answer

Remove the monitoring system to focus on other controls

Answer

Hire additional analysts to review all alerts

Question 6

Which TWO of the following are examples of risk mitigation controls?

Accepted Answer

Implementing a firewall. Option A and D are correct. A firewall is a preventive control to mitigate network threats. Encryption protects data. Option B is wrong because insurance is a risk transfer. Option C is wrong because accepting risk is not mitigation. Option E is wrong because avoiding risk means not engaging in the activity.

Answer

Purchasing cyber insurance

Answer

Accepting the risk

Answer

Discontinuing a high-risk service

Question 7

A multinational corporation is evaluating a new vendor for cloud services. The vendor's data centers are located in a country with weak data protection laws. The corporation's data includes personal information of EU citizens subject to GDPR. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to sign standard contractual clauses and encrypt all data. Option A is correct because GDPR requires adequate safeguards; contractual clauses and data encryption can mitigate the risk. Option B is wrong as insurance does not cover regulatory fines. Option C is wrong as acceptance may lead to non-compliance. Option D is wrong as avoidance may not be practical if the vendor is the best option.

Answer

Avoid by choosing a vendor in a country with strong data protection laws

Answer

Accept the risk because the vendor offers the best price

Answer

Purchase cyber insurance to cover potential fines

Question 8

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. Option C is correct because eliminating the use of the service removes the risk entirely, which is avoidance.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 9

Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?

Accepted Answer

Risk Mitigation. Option B is correct because the firewall rule blocks malicious traffic, which reduces risk, i.e., mitigation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 10

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. Option D is correct because such risks are usually accepted as the cost of response would outweigh the benefit. Options A, B, and C are excessive.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 11

A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?

Accepted Answer

Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.. Option A is correct because it directly addresses the contractual breach with a remediation plan while keeping the supplier. Option B is wrong because acceptance disregards the contractual requirement. Option C is wrong because termination may be too severe and disrupt operations. Option D is wrong because transferring risk to the supplier's insurance does not restore certification.

Answer

Transfer the risk to the supplier's cyber liability insurance policy.

Answer

Accept the risk because the supplier still has effective controls, and update the risk register.

Answer

Terminate the contract immediately and find an alternative supplier.

Question 12

Which THREE of the following are key considerations when selecting a risk response option?

Accepted Answer

Cost-benefit analysis of controls. Options A, C, and D are correct. Risk appetite determines acceptable level. Cost of control vs benefit is essential. Regulatory requirements cannot be ignored. Option B is wrong because current controls are not a selection criterion but part of assessment. Option E is wrong because impact without likelihood gives incomplete view.

Answer

Impact of the risk without controls

Answer

Current control effectiveness

Question 13

A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:

Accepted Answer

Risk Mitigation. Option A is correct because implementing controls reduces the risk, which is mitigation.

Answer

Risk Transfer

Answer

Risk Acceptance

Answer

Risk Avoidance

Question 14

Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?

Accepted Answer

Risk of data exposure; apply a deny rule to restrict access. Option A is correct because the policy allows anyone to read objects, leading to data exposure; the appropriate response is to apply a deny rule or restrict access.

Answer

Risk of cost; set a budget alert

Answer

Risk of availability; implement backup

Answer

No risk; the policy is standard

Question 15

A company has a critical production system with a known vulnerability. Due to the system's age, the vendor no longer supports it. The company decides to implement network segmentation and purchase cyber insurance to cover potential losses. Which TWO risk response options are they applying?

Accepted Answer

Transfer. Options C and D are correct: Mitigate via segmentation and Transfer via insurance. Options A, B, and E are not applied.

Answer

Accept

Answer

Avoid

Answer

Ignore