CRISC Practice Test 28 — 15 Questions

Question 1

A company is updating its risk register. Which of the following is the primary purpose of a risk register?

Accepted Answer

To record and track identified risks and their treatment. The risk register centralizes identified risks, their analysis, and treatment plans.

Answer

To define risk appetite

Answer

To store threat intelligence feeds

Answer

To document all IT assets

Question 2

Which TWO of the following are valid risk scenarios that should be documented during IT risk identification?

Accepted Answer

An employee may inadvertently share confidential data via email due to lack of data classification training.. It describes a specific risk scenario: an employee inadvertently sharing confidential data via email due to lack of data classification training. This is a valid risk scenario as it identifies a threat (human error), a vulnerability (insufficient training), and a potential impact (data leakage). In IT risk identification, scenarios must be concrete and actionable, not just statements of compliance or controls.

Answer

The organization must comply with GDPR requirements for data protection.

Answer

The database server has not been patched for critical vulnerabilities.

Answer

The IT department will implement multi-factor authentication to reduce the risk of unauthorized access.

Question 3

After implementing a new web application, the risk owner reports that the residual risk level is still above the risk appetite. Which of the following should be the risk practitioner's FIRST action?

Accepted Answer

Re-evaluate risk treatment options with the risk owner. When residual risk remains above the risk appetite after treatment, the risk practitioner must first re-evaluate the existing risk treatment options with the risk owner. This collaborative review identifies whether additional controls (e.g., stricter input validation, rate limiting, or Web Application Firewall tuning) can further reduce the risk to an acceptable level before considering escalation or acceptance.

Answer

Escalate directly to the board

Answer

Update the risk register to reflect the residual risk

Answer

Accept the residual risk

Question 4

A risk practitioner is identifying vulnerabilities in an organization's IT environment. Which TWO of the following are examples of 'operational vulnerability identification'? (Choose two.)

Accepted Answer

Lack of segregation of duties in IT administration. Lack of segregation of duties in IT administration is an operational vulnerability. It arises from inadequate processes and controls within the organization's operations, such as allowing a single administrator to both approve and execute changes, which increases the risk of unauthorized or malicious actions. This is a process-level weakness, not a technical flaw in a specific system or code.

Answer

SQL injection vulnerability in a web application

Answer

Default passwords on network devices

Answer

Missing security patches on critical servers

Question 5

In the FAIR model, 'Loss Event Frequency' is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR model, Loss Event Frequency (LEF) is the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This represents how often a threat agent successfully exploits a weakness, making option B correct. The formula is LEF = TEF × Vuln, where Vulnerability is the probability that a threat event will result in a loss.

Answer

Threat Event Frequency × Asset Value

Answer

Threat Event Frequency × Loss Magnitude

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Question 6

In a quantitative risk analysis, the annualized loss expectancy (ALE) is calculated as $1 million. If the organization implements a control that reduces the ARO from 0.5 to 0.1, and the SLE remains constant at $2 million, what is the new ALE?

Accepted Answer

$200,000. The annualized loss expectancy (ALE) is calculated as SLE × ARO. With SLE constant at $2 million and the new ARO reduced to 0.1, the new ALE is $2,000,000 × 0.1 = $200,000. This reflects the residual risk after the control is implemented.

Answer

$500,000

Answer

$100,000

Answer

$1 million

Question 7

Which risk treatment option involves eliminating the activity that creates the risk?

Accepted Answer

Avoid. (Avoid) is correct because risk avoidance involves discontinuing the activity or process that gives rise to the risk. In IT risk management, this means removing the vulnerable system, decommissioning a service, or ceasing a business function entirely to eliminate the risk exposure. For example, if an organization decides to shut down a legacy FTP server to avoid the risk of data interception, it is applying the avoid treatment.

Answer

Accept

Answer

Transfer

Answer

Mitigate

Question 8

An organization's IT risk team is promoting a risk-aware culture. Which initiative is most likely to encourage employees to report security incidents without fear?

Accepted Answer

Establishing a no-blame incident reporting policy. A no-blame incident reporting policy directly addresses the psychological barrier of fear of reprisal, which is the primary reason employees hesitate to report security incidents. By explicitly stating that reporters will not face disciplinary action for unintentional errors or omissions, the organization fosters psychological safety and encourages timely reporting, which is critical for effective risk response.

Answer

Publishing quarterly incident statistics

Answer

Increasing the frequency of security awareness training

Answer

Implementing automated incident detection

Question 9

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A failed authentication spike is a leading indicator because it directly signals an increase in attempted unauthorized access, often from credential stuffing or brute-force attacks. Unlike lagging indicators that measure past incidents, this metric provides early warning that the risk of a credential-based attack is rising, allowing proactive controls like account lockout policies or CAPTCHA challenges to be implemented before a breach occurs.

Answer

Increased number of successful logins

Answer

Low patch compliance

Answer

High mean time to resolve incidents

Question 10

A risk assessment of a critical financial application identifies a high inherent risk due to outdated software. The risk manager is considering mitigation options. Which TWO of the following would be considered preventive controls?

Accepted Answer

Configuring access controls. Configuring access controls is a preventive control because it proactively restricts unauthorized users from accessing the financial application, reducing the likelihood of a security incident. By enforcing least privilege and authentication mechanisms, it directly mitigates the risk of exploitation of the outdated software by limiting who can interact with it.

Answer

Deploying an intrusion detection system

Answer

Establishing a backup and recovery plan

Answer

Conducting regular security audits

Question 11

A risk assessment team is prioritizing IT risks for treatment. Which THREE factors should be considered when prioritizing risks? (Select THREE)

Accepted Answer

The inherent risk score of each risk. The inherent risk score provides a baseline measure of risk without considering controls, which is essential for prioritizing which risks require immediate attention. This score is typically calculated as a product of likelihood and impact, and it helps the team focus on the most severe potential threats first.

Answer

Industry standards for similar risks

Answer

The risk owner's personal preference

Question 12

Which risk reporting level is typically provided to the board of directors and focuses on strategic risk posture?

Accepted Answer

Strategic risk reporting. Strategic risk reporting is the correct level for the board of directors because it focuses on high-level, long-term risks that could affect the organization's strategic objectives and overall business posture. Unlike tactical or operational reports, strategic reports aggregate risk data into a format that supports governance, risk appetite decisions, and capital allocation at the executive level.

Answer

Tactical risk reporting

Answer

Compliance risk reporting

Answer

Operational risk reporting

Question 13

An organization uses automated SIEM rules to continuously monitor for unauthorized access attempts. This is an example of which type of monitoring?

Accepted Answer

Continuous monitoring. Continuous monitoring involves the use of automated tools, such as Security Information and Event Management (SIEM) systems, to provide real-time or near-real-time oversight of security events. In this scenario, the SIEM rules are configured to detect unauthorized access attempts as they occur, which aligns directly with the definition of continuous monitoring rather than periodic or point-in-time assessments.

Answer

Periodic control testing

Answer

Vulnerability scanning

Answer

Access review

Question 14

An organization uses the FAIR framework to calculate annualized loss expectancy (ALE) for a specific risk. Given that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given SLE = $50,000 and ARO = 0.2, the ALE is $50,000 × 0.2 = $10,000. This aligns with the FAIR framework's quantitative risk analysis formula.

Answer

$250,000

Answer

$100,000

Answer

$50,000

Question 15

Which TWO of the following are considered direct costs in the financial impact assessment of a risk event?

Accepted Answer

Incident response team expenses. Incident response team expenses (C) are direct costs because they are immediate, quantifiable outlays incurred specifically to respond to and mitigate a risk event. Similarly, customer notification costs (E) are direct costs as they represent mandatory, traceable expenditures for informing affected parties, often required by regulations like GDPR or HIPAA. These costs are directly attributable to the incident and can be precisely measured.

Answer

Increased insurance premium

Answer

Reputation loss

Answer

Lost business opportunities