CRISC Practice Test 29 — 15 Questions

Question 1

A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk Avoidance. Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.

Answer

Risk Transfer

Answer

Risk Mitigation

Answer

Risk Acceptance

Question 2

An organization has a risk appetite that is risk-averse. Which risk treatment option would be most aligned with this appetite?

Accepted Answer

Avoid the risk by discontinuing the activity. A risk-averse organization prioritizes avoiding exposure to threats. Discontinuing the activity that introduces the risk (option A) eliminates the threat source entirely, ensuring no residual risk remains. This aligns directly with a risk-averse appetite, where even low-probability, high-impact events are unacceptable.

Answer

Mitigate the risk with controls

Answer

Accept the risk

Answer

Transfer the risk through insurance

Question 3

A retail company has a risk monitoring program that tracks key risk indicators (KRIs) for its e-commerce platform. One KRI measures the number of failed payment transactions as a percentage of total transactions. The threshold is set at 2%. Over the past quarter, the KRI has been fluctuating between 1.8% and 2.5%, breaching the threshold several times. Each time the KRI exceeded the threshold, the risk owner performed a manual investigation and found that the failures were due to transient network issues that resolved on their own. The risk owner has now requested that the threshold be raised to 3% to avoid unnecessary investigations. The risk practitioner is evaluating this request. What should the risk practitioner do?

Accepted Answer

Recommend a root cause analysis to determine why network issues are recurring before considering a threshold change.. The recurring network issues causing threshold breaches indicate an underlying problem that needs to be addressed, not just a threshold adjustment. Raising the threshold without understanding the root cause could mask a significant risk to transaction integrity and revenue. A root cause analysis (RCA) would identify whether the transient network issues stem from infrastructure, configuration, or external dependencies, enabling a proper control response.

Answer

Approve the threshold increase since investigations have not found any significant issues.

Answer

Suggest implementing automated remediation for network issues instead of raising the threshold.

Answer

Reject the request and require investigation of every breach.

Question 4

A security analyst notices that the number of failed login attempts has significantly increased over the past week. The SIEM alerts are not being triggered because the threshold was set too high. What is the MOST effective immediate action to improve monitoring?

Accepted Answer

Lower the threshold for failed login alerts in the SIEM.. B is correct because the immediate issue is that the SIEM alert threshold is set too high, causing failed login attempts to go undetected. Lowering the threshold directly addresses the monitoring gap by ensuring that the SIEM generates alerts for anomalous failed login activity, enabling timely incident response without requiring a system overhaul.

Answer

Implement a new authentication system with biometrics.

Answer

Enable all SIEM rules to capture every event.

Answer

Review logs manually each day to identify anomalies.

Question 5

A company has identified a risk of data exfiltration through an outdated encryption protocol. The risk assessment team determines that the likelihood is low, but the impact is very high. The company decides to update the encryption protocol. This risk response is an example of:

Accepted Answer

Risk mitigation. Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 6

A risk practitioner is designing a risk dashboard for the executive team. The organization has a high risk appetite for revenue-generating activities but a low risk appetite for regulatory compliance. Which combination of metrics should be prominently displayed?

Accepted Answer

Key risk indicators (KRIs) for revenue-related risks and regulatory compliance status.. The executive team needs visibility into metrics that directly align with the organization's stated risk appetite: high appetite for revenue-generating activities (monitored via KRIs for revenue-related risks) and low appetite for regulatory compliance (monitored via compliance status). This ensures the dashboard provides actionable, risk-informed insights rather than operational or administrative data.

Answer

Percentage of controls tested and employee training completion rates.

Answer

Vendor risk ratings and number of security incidents.

Answer

Number of open remediation items and budget variance for risk projects.

Question 7

A risk manager notices that a key risk indicator (KRI) for system downtime has exceeded the threshold for two consecutive months. What is the MOST appropriate immediate action?

Accepted Answer

Escalate to the risk owner for investigation.. When a KRI exceeds its threshold for two consecutive months, the immediate priority is to investigate the root cause and assess whether the risk is materializing. Escalating to the risk owner ensures that the appropriate subject matter expert analyzes the situation, determines if controls are failing, and decides on corrective actions. Revising the threshold or replacing the KRI without investigation would bypass the monitoring and response process, potentially masking a real risk event.

Answer

Revise the KRI threshold to a higher value.

Answer

Archive the current KRI and define a new one.

Answer

Update the risk register with the new KRI value.

Question 8

An organization is evaluating risks and decides to purchase cyber insurance to cover potential financial losses from data breaches. Which risk treatment option does this represent?

Accepted Answer

Transfer. Transfer involves shifting risk to a third party, such as through insurance or outsourcing with liability transfer.

Answer

Accept

Answer

Mitigate

Answer

Avoid

Question 9

A multinational corporation uses commercial threat intelligence feeds and participates in an ISAC. However, they recently missed a critical vulnerability exploited in the wild that was not in their feeds. Which additional source should they incorporate to improve vulnerability identification?

Accepted Answer

CISA KEV catalog. The CISA KEV catalog specifically lists vulnerabilities that have been confirmed as exploited in the wild, which is exactly the gap described—a critical vulnerability exploited in the wild that was missed by commercial feeds and ISAC participation. Incorporating KEV ensures the organization prioritizes vulnerabilities with known active exploitation, regardless of whether they appear in commercial feeds. This makes it the correct additional source.

Answer

NVD database

Answer

OSINT from social media

Answer

Vendor advisories only

Question 10

A financial institution is adopting AI for credit scoring. The model is currently a black box and requires explainability for regulatory compliance. Which risk is MOST critical to address?

Accepted Answer

Lack of explainability. When a model is a black box and regulatory compliance requires explainability, the most critical risk is the lack of explainability itself — without it, the institution cannot justify credit decisions to regulators, customers, or auditors, and may violate fair lending laws (e.g., ECOA, GDPR Article 22). Explainability is the gating requirement here; bias, adversarial attacks, and data privacy are real risks but secondary to the stated compliance driver. Addressing explainability often also surfaces and mitigates bias.

Answer

Model bias

Answer

Adversarial attacks

Answer

Data privacy in training

Question 11

An energy company is integrating its IT network with OT systems for real-time monitoring. The risk manager is assessing the expanded attack surface. Which risk should be given the HIGHEST priority due to its potential for physical consequences?

Accepted Answer

Manipulation of operational parameters leading to equipment damage. When IT and OT networks are integrated, the highest-priority risk is one with physical consequences. Manipulation of operational parameters (e.g., changing setpoints, valve positions, or PLC logic) can directly cause equipment damage, safety incidents, or environmental harm — consequences unique to OT environments. This makes it the top priority because the potential for physical impact elevates severity beyond typical IT risks.

Answer

Increased number of malware infections

Answer

Unauthorized access to corporate financial systems

Answer

Denial of service affecting IT services

Question 12

Refer to the exhibit. A SIEM correlation rule 'Brute_Force_SSH' has fired excessively due to traffic from internal monitoring servers. What is the BEST course of action?

Accepted Answer

Add an exception in the rule to exclude internal monitoring server IPs.. The excessive alerts are caused by legitimate traffic from internal monitoring servers, not by an actual brute-force attack. Adding an exception to exclude these known IP addresses in the SIEM correlation rule preserves the rule's detection capability for real threats while eliminating the false positives. This is a standard tuning practice for SIEM rules to maintain operational efficiency without disabling security controls.

Answer

Disable the correlation rule to stop false alerts.

Answer

Increase the threshold to reduce false positives.

Answer

Investigate the monitoring servers for compromise.

Question 13

A risk assessment identifies a high-likelihood, high-impact risk associated with a legacy system. The business owner decides to decommission the system to eliminate the risk. Which risk treatment option is being applied?

Accepted Answer

Avoid. Avoidance involves eliminating the activity that creates the risk, such as decommissioning a system.

Answer

Mitigate

Answer

Accept

Answer

Transfer

Question 14

An organization is assessing control effectiveness for a firewall. Which THREE factors should be evaluated to determine control effectiveness? (Select THREE)

Accepted Answer

Design adequacy of the firewall rules. Design adequacy of the firewall rules (A) is correct because control effectiveness begins with whether the ruleset is properly architected to enforce the intended security policy, including correct default-deny posture, rule ordering, and coverage of required traffic flows. Operating effectiveness of the firewall (B) is correct because even a well-designed ruleset must be verified to actually function as intended in production, through testing, monitoring, and evidence that the control operates consistently over time. Relevance to the specific risk scenario (D) is correct because a control is only effective if it directly addresses the identified risk; a technically sound firewall that does not mitigate the specific threat in scope provides no assurance for that scenario. Cost of the firewall (C) is not a factor in determining control effectiveness, as it relates to budgeting and cost-benefit rather than whether the control actually mitigates risk. Frequency of rule updates (E) is not itself an effectiveness factor, since the quality and appropriateness of changes matter more than how often they occur, and it is subsumed under design adequacy and operating effectiveness.

Answer

Cost of the firewall

Answer

Frequency of rule updates

Question 15

A company is migrating critical applications to the cloud. The risk manager is assessing the shared responsibility model. Which risk is the customer typically responsible for?

Accepted Answer

Data classification and access control. According to the shared responsibility model, the customer is responsible for data, access management, and application-level security.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor security