CRISC Practice Test 28 — 15 Questions

Question 1

An organization is assessing risks related to a new cloud-based CRM system. The risk team is developing a risk scenario. Which of the following is the BEST example of a complete risk scenario following the ISACA template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An external attacker (actor) performs a SQL injection (threat type) to exfiltrate customer records from the CRM database (event/asset); occurs during off-hours (timing); detected by IDS after 2 hours (detection); leads to regulatory fines and reputational damage (consequence).. ISACA's risk scenario template requires a structured narrative that identifies the threat actor, threat type, event, asset, timing, detection method, and consequence. Option C is the only choice that includes all these elements — actor (external attacker), threat type (SQL injection), event/asset (exfiltration from CRM database), timing (off-hours), detection (IDS after 2 hours), and consequence (regulatory fines and reputational damage). This completeness is what makes it a valid risk scenario rather than a vague risk statement.

Answer

A DDoS attack on the CRM disrupts service, leading to operational downtime.

Answer

A hacker exploits a vulnerability in the CRM to steal customer data, resulting in financial loss.

Answer

A disgruntled employee leaks data from the CRM, causing reputational damage.

Question 2

A risk manager is designing a third-party risk management program. Which THREE factors should be considered when determining the risk tier of a vendor?

Accepted Answer

The type of data the vendor will access. Option B is correct because the type of data the vendor will access directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or cardholder data (PCI DSS scope) warrant a higher risk tier than those with no data access. Option D is correct because a vendor's security certifications and audit results (e.g., SOC 2 Type II, ISO/IEC 27001, PCI DSS AOC) provide objective evidence of the maturity and effectiveness of its control environment, which is a core input to tiering. Option E is correct because the criticality of the service provided reflects business impact — an outage or compromise of a vendor supporting a critical business process or system causes far greater operational and financial harm than a non-essential service. Option A does not belong because a vendor's physical location alone is not a primary tiering factor; geography may inform jurisdictional or regulatory considerations but does not by itself indicate risk level. Option C does not belong because annual revenue is a financial size indicator, not a measure of the risk the vendor poses to the organization's data, systems, or operations.

Answer

The vendor's physical location

Answer

The vendor's annual revenue

Question 3

A company is prioritizing risk treatment actions. Which THREE factors should be considered when prioritizing risks?

Accepted Answer

Cost-benefit analysis of controls. Cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Answer

Industry best practices

Answer

Number of vulnerabilities

Question 4

An organization is deploying IoT devices in a smart building. Which of the following are significant security risks associated with IoT? (Choose THREE.)

Accepted Answer

Firmware update challenges due to device diversity. IoT risks include expanded attack surface, legacy device security gaps, and firmware update challenges.

Answer

Increased power consumption

Answer

Higher data transmission speeds

Question 5

An organization wants to promote a risk-aware culture. Which initiative is most effective in encouraging employees to report security incidents without fear?

Accepted Answer

Implementing a no-blame incident reporting policy. A no-blame incident reporting policy removes the fear of punishment for reporting mistakes, which is the single most effective cultural lever for increasing incident disclosure. Research (e.g., from aviation safety and DevOps postmortems) shows that psychological safety drives reporting rates, and reporting is the prerequisite for detecting and responding to incidents. This directly addresses the 'without fear' requirement in the question.

Answer

Conducting annual security awareness training

Answer

Increasing penalties for policy violations

Answer

Publishing names of employees who caused incidents

Question 6

An external audit finds that a control is not operating as designed. The auditor recommends corrective action. What should the risk practitioner do FIRST?

Accepted Answer

Assess the impact of the control deficiency on residual risk. The risk practitioner must first assess the impact of the control deficiency on residual risk because the finding may not represent a material risk to the organization. Without understanding the severity and likelihood of the risk, any remediation or reporting could be misprioritized. This aligns with the CRISC framework's emphasis on risk-based decision-making before action.

Answer

Implement the auditor's recommendation immediately

Answer

Develop a remediation plan with the control owner

Answer

Update the risk register with the auditor's finding

Question 7

After a risk assessment, a company decides to stop using a third-party service that has high residual risk. This is an example of:

Accepted Answer

Risk Avoidance. By discontinuing the use of the third-party service, the company eliminates the risk entirely rather than reducing or accepting it. This is the definition of risk avoidance, where the activity giving rise to the risk is ceased. The decision is based on the residual risk being too high to be acceptable or cost-effectively mitigated.

Answer

Risk Mitigation

Answer

Risk Transfer

Answer

Risk Acceptance

Question 8

An organization deployed a new intrusion detection system (IDS) that generates many alerts. The security team is overwhelmed and has started ignoring some alerts. What is the BEST way to address this issue?

Accepted Answer

Tune the IDS to reduce false positive alerts.. Tuning the IDS to reduce false positive alerts directly addresses the root cause of alert fatigue: excessive noise from misconfigured or overly sensitive detection rules. By adjusting thresholds, signatures, and exclusion lists, the security team can focus on genuine threats without being overwhelmed, which is a core risk monitoring and reporting practice.

Answer

Implement a SIEM to filter and prioritize alerts.

Answer

Deactivate the IDS until it can be properly configured.

Answer

Hire additional security analysts to handle the alert volume.

Question 9

In the FAIR framework, loss magnitude (LM) is composed of primary loss and secondary loss. Which of the following is an example of secondary loss?

Accepted Answer

Lost business due to reputation damage. Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

Answer

Incident response costs

Answer

Legal notification costs

Answer

System restoration expenses

Question 10

Which THREE of the following are key indicators that a risk identification process is effective? (Choose three.)

Accepted Answer

The process covers all critical business processes. Option B is correct because an effective risk identification process must cover all critical business processes, ensuring that risks to essential operations, revenue streams, and service delivery are surfaced rather than only technical or peripheral concerns. Option C is correct because involving key stakeholders across the organization brings diverse perspectives from business, IT, legal, compliance, and operations, which improves completeness and accuracy of identified risks. Option D is correct because risk identification is not a one-time event; repeating it at regular intervals or when significant changes occur (new systems, mergers, regulatory shifts, threat landscape changes) keeps the risk register current and relevant. Option A is not correct because identifying 'all known vulnerabilities' is an unrealistic and overly narrow goal—risk identification focuses on risks, not just vulnerabilities, and completeness of vulnerability enumeration is not the measure of process effectiveness. Option E is not correct because completing the process within budget reflects cost efficiency, not effectiveness; a process can be cheap yet miss critical risks.

Answer

The process identifies all known vulnerabilities

Answer

The process is completed within budget

Question 11

A multinational organization is assessing the risk of a new cloud service that stores data across multiple geographic regions. The service provider offers standard contractual terms and does not commit to specific data residency requirements. What is the primary risk that should be evaluated?

Accepted Answer

Non-compliance with data protection regulations due to data location uncertainty.. The primary risk is non-compliance with data protection regulations due to uncertain data location (Option B). Because the provider does not commit to specific data residency, the organization cannot guarantee compliance with laws like GDPR that impose strict requirements on where data is stored and processed. This legal exposure outweighs the other options, as it could lead to fines and legal penalties.

Answer

Service availability and uptime commitments.

Answer

Unauthorized access to data by cloud provider employees.

Answer

Inadequate encryption of data at rest and in transit.

Question 12

An organization is implementing continuous monitoring for its critical systems. Which THREE of the following activities are examples of continuous monitoring? (Select three.)

Accepted Answer

Weekly vulnerability scanning of all servers. Weekly vulnerability scanning of all servers (B) is continuous monitoring because it runs on a recurring, automated schedule that repeatedly detects new weaknesses and configuration drift across the environment. Real-time monitoring of firewall logs for anomalies (C) qualifies because it continuously ingests and inspects traffic events to detect suspicious activity as it occurs. Automated correlation of security events via SIEM (D) is continuous monitoring because the SIEM aggregates and correlates log data from multiple sources in near real time to generate alerts. In contrast, an annual internal audit of access controls (A) and a quarterly review of user access rights (E) are periodic, point-in-time assessments rather than ongoing automated monitoring activities.

Answer

Annual internal audit of access controls

Answer

Quarterly review of user access rights by managers

Question 13

Which TWO of the following are key attributes of effective risk reporting?

Accepted Answer

Provides actionable information for decision-makers. Effective risk reporting must provide actionable information that enables decision-makers to prioritize and respond to risks. Option C is correct because reports should highlight key risk indicators (KRIs), trends, and control effectiveness, not just raw data, so that management can make informed decisions about risk treatment and resource allocation.

Answer

Includes full risk register details

Answer

Only issued when a risk incident occurs

Answer

Sent to all employees by email

Question 14

A risk owner wants to implement continuous monitoring for a set of critical controls. Which of the following is the PRIMARY benefit of continuous monitoring over periodic testing?

Accepted Answer

Timely detection of control failures.. Continuous monitoring provides near-real-time visibility into control performance, so failures are detected as they occur rather than at the next periodic test. This timely detection enables faster remediation and reduces the window of exposure, which is the primary benefit over periodic testing.

Answer

Elimination of manual testing.

Answer

Compliance with regulatory requirements.

Answer

Reduced cost of control testing.

Question 15

During a control monitoring review, a risk analyst discovers that the control owner has not been performing the required monthly reconciliations. What should the analyst do FIRST?

Accepted Answer

Contact the control owner to understand the reason for non-performance.. The first step in any control monitoring review is to investigate the root cause of a control failure before taking further action. Contacting the control owner allows the risk analyst to determine whether the non-performance was due to a process issue, resource constraint, or a deliberate decision, which informs the appropriate remediation. Jumping to escalation or documentation without understanding the context could lead to incorrect risk treatment or unnecessary disruption.

Answer

Escalate to the risk committee for immediate action.

Answer

Update the risk register to reflect control deficiency.

Answer

Recommend removal of the control as it is not being followed.