CRISC Practice Test 28 — 15 Questions

Question 1

An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?

Accepted Answer

Implement compensating controls. Option B is correct because compensating controls mitigate the risk without replacing the system. Options A, C, and D are either unacceptable or impractical.

Answer

Accept the risk

Answer

Transfer via insurance

Answer

Avoid by decommissioning

Question 2

Which THREE of the following are key components of an effective risk response plan?

Accepted Answer

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept). Risk response plans must include documented strategy, assigned ownership, and resource allocation. Implementation timeline (A) and regulatory impact (D) are supporting details, not core components. Option E (Risk owner) is a role, not a component of the plan itself.

Answer

Detailed implementation timeline

Answer

Regulatory impact analysis

Question 3

During a post-mortem of a security incident, the risk manager notes that the response team failed to execute the incident response plan correctly because the plan was outdated. Which of the following is the BEST corrective action?

Accepted Answer

Conduct a tabletop exercise with the updated plan. Option D is correct because conducting a tabletop exercise validates the updated plan and helps prepare the team.

Answer

Add more detective controls

Answer

Update the risk register

Answer

Increase insurance coverage

Question 4

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. Option A is correct because the risk is accepted formally as it is within an acceptable range after controls.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 5

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. Option A is correct because implementing account lockout directly addresses the threat of brute-force attacks, which is mitigation.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 6

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Option D is correct because monitoring and restrictions address the risk without premature termination. Options A, B, and C are either too harsh or insufficient.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance

Question 7

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

Accepted Answer

Avoid by terminating the contract. Option A is correct because avoidance by terminating the contract addresses the risk directly. Options B, C, and D do not fully resolve the risk given the low appetite.

Answer

Mitigate by reducing data shared

Answer

Transfer via insurance

Answer

Accept the risk and monitor

Question 8

Refer to the exhibit. A risk manager reviews the vulnerability scan output. According to the policy, what is the required risk response?

Accepted Answer

Mitigate by patching or compensating controls. Option C is correct because the policy mandates remediation (mitigation) for CVSS >= 9.0. Options A, B, and D are inconsistent with the policy.

Answer

Accept the risk

Answer

Transfer the risk

Answer

Avoid by disabling the service

Question 9

A recent security assessment identified that a critical web application is vulnerable to SQL injection due to unpatched software. The vendor has released a security patch. Which risk response is most appropriate?

Accepted Answer

Mitigate by applying the patch. Option A is correct because applying the patch mitigates the vulnerability directly. Options B, C, and D are less effective.

Answer

Avoid by taking the application offline

Answer

Accept the risk

Answer

Transfer via insurance

Question 10

A risk assessment reveals that the cost of implementing a control ($500k) exceeds the annualized loss expectancy (ALE) of $300k. The risk is currently within the organization's risk appetite. What is the appropriate risk response?

Accepted Answer

Accept the risk. Option C is correct because accepting the risk is cost-effective when control cost exceeds ALE and risk is within appetite. Options A, B, and D are incorrect.

Answer

Implement the control

Answer

Avoid the risk

Answer

Transfer the risk

Question 11

A retail company uses a third-party vendor for payment processing. The vendor's service level agreement (SLA) requires 99.9% uptime. Recently, there were two incidents of downtime totaling 0.2% in a month, still within the SLA. However, the company's internal risk monitoring detected a pattern of increasing minor incidents. The vendor insists the SLA is met. The risk manager must decide on monitoring and reporting. The company's board wants to understand the risk. What is the best course of action?

Accepted Answer

Request a root cause analysis from the vendor and monitor trend more closely, reporting to board if trend worsens.. The increasing trend of incidents indicates potential risk even though the SLA is met. Requesting root cause analysis and monitoring the trend allows proactive management. Option B is correct. Option A ignores the trend. Option C is drastic. Option D may not address the root cause.

Answer

Terminate the vendor contract.

Answer

Increase the SLA penalty.

Answer

Accept the vendor's assurance as SLA is met.

Question 12

An internal audit report identifies that the IT department did not patch a critical vulnerability in a database server for 90 days. The risk manager wants to identify the root cause risk. Which approach should be used?

Accepted Answer

Perform a root cause analysis on the patching process. Option D is correct because the risk manager needs to identify the root cause risk, which requires understanding why the patching process failed to apply a critical security update within the required timeframe. A root cause analysis (RCA) on the patching process systematically examines procedural breakdowns, such as missed scanning cycles, lack of change management approval, or insufficient prioritization of database-specific patches (e.g., Oracle Critical Patch Updates). This approach directly addresses the underlying process deficiency rather than merely documenting or re-verifying the vulnerability.

Answer

Interview the database system owner

Answer

Conduct a new vulnerability scan

Answer

Update the risk register with the finding

Question 13

A large organization is implementing a continuous monitoring program for its critical systems. Which of the following is the MOST important factor for the program's success?

Accepted Answer

Integration with automated incident response workflows.. Integration with automated incident response workflows is the most important factor because continuous monitoring is only effective if detected anomalies or threats can be acted upon in near real-time. Without automated response, alerts may be ignored or delayed, rendering the monitoring program ineffective. This aligns with the CRISC focus on reducing risk through timely remediation, not just detection.

Answer

Use of advanced analytics and machine learning.

Answer

Support from senior management.

Answer

Clear definition of monitoring scope and objectives.

Question 14

Which THREE of the following are examples of risk mitigation controls? (Select THREE.)

Accepted Answer

Firewall. A firewall is a risk mitigation control because it enforces network security policies by filtering traffic based on rules, thereby reducing the likelihood of unauthorized access or attacks. It directly reduces the probability of a threat exploiting a vulnerability, which is the essence of mitigation.

Answer

Outsourcing IT helpdesk

Answer

Cyber insurance

Question 15

A risk manager is facilitating a risk identification workshop for a new cloud migration initiative. Which TWO techniques are most effective for identifying potential IT risks at this stage?

Accepted Answer

Interviewing business unit managers and IT architects. Interviewing business unit managers and IT architects (Option B) is effective because it leverages domain expertise to surface operational and technical risks specific to the cloud migration, such as data residency constraints, API dependencies, or shared responsibility model gaps. This qualitative technique captures tacit knowledge that quantitative methods or automated scans cannot, making it ideal for the early identification stage.

Answer

Calculating the annualized loss expectancy (ALE) for each identified risk

Answer

Conducting a cost-benefit analysis of security controls

Answer

Performing a vulnerability scan on the existing infrastructure