CRISC Practice Test 29 — 15 Questions

Question 1

A risk analyst is assessing the impact of a potential ransomware attack. Which THREE categories of business impact should be considered?

Accepted Answer

Operational downtime. Operational downtime (B) is a direct consequence of a ransomware attack, as encryption of critical systems halts business processes, leading to lost productivity and revenue. This category is essential for impact assessment because it quantifies the duration and scope of service disruption, which directly affects operational continuity.

Answer

Geographic diversity

Answer

Technical complexity

Question 2

During an IT risk assessment, the risk team calculates the Annualized Loss Expectancy (ALE) for a critical application. Which quantitative risk analysis framework is most commonly used for this calculation?

Accepted Answer

FAIR. The Factor Analysis of Information Risk (FAIR) framework is the most commonly used quantitative risk analysis framework for calculating Annualized Loss Expectancy (ALE) because it provides a structured, probabilistic approach to decompose risk into loss event frequency and loss magnitude. Unlike qualitative frameworks, FAIR enables precise ALE computation by modeling threat event frequency, vulnerability, and probable loss, making it the standard for quantitative IT risk assessments in the CRISC domain.

Answer

NIST SP 800-30

Answer

ISO 31000

Answer

COBIT 5

Question 3

An organization is implementing a new access control system. The project manager is concerned about delays due to user training requirements. Which of the following should the risk practitioner prioritize to ensure effective control implementation?

Accepted Answer

Ensure user training is completed before go-live. User training is a critical success factor for access control systems because misconfigured or improperly used controls can lead to security gaps. Ensuring training is completed before go-live (Option D) aligns with the principle that a control is only effective if users understand how to operate it correctly, preventing human error that could bypass the control's intended protections.

Answer

Accelerate the deployment to meet the project deadline

Answer

Implement a compensating control to reduce training requirements

Answer

Delay the entire project until training can be completed

Question 4

Which type of control is designed to stop an undesirable event from occurring?

Accepted Answer

Preventive control. Preventive control is designed to stop an undesirable event from occurring by enforcing policies or technical barriers before the event happens. For example, a firewall rule that blocks inbound traffic on port 23 (Telnet) prevents unauthorized remote access attempts, directly reducing the likelihood of a security incident.

Answer

Corrective control

Answer

Directive control

Answer

Detective control

Question 5

A risk practitioner is calculating the residual risk for a critical asset. Which THREE factors should be considered?

Accepted Answer

Control design adequacy. Residual risk is the risk remaining after controls are applied. To calculate it, you must know the inherent risk level (the risk before controls) and then assess how effectively controls reduce that risk. Control design adequacy and operating effectiveness determine how much the inherent risk is mitigated, directly impacting the residual risk calculation.

Answer

Cost of controls

Answer

Risk appetite

Question 6

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

Accepted Answer

Threat Event Frequency (TEF). In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Answer

Vulnerability

Answer

Loss Event Frequency (LEF)

Answer

Annualized Rate of Occurrence (ARO)

Question 7

Which control implementation activity involves updating system configurations and user access rights when a new security tool is deployed?

Accepted Answer

Change management. Deploying a new security tool requires updating system configurations and user access rights, which directly impacts the operational environment. Change management (Option D) is the formal process that governs these modifications to ensure they are authorized, tested, and documented, minimizing risk of disruption or security gaps. This aligns with the CRISC domain of Risk Response and Reporting, where controlled changes are a key risk mitigation activity.

Answer

User training

Answer

Project management

Answer

Documentation update

Question 8

An organization implements an intrusion detection system (IDS) to monitor for security incidents. This is an example of which type of control?

Accepted Answer

Detective. An intrusion detection system (IDS) is a detective control because it monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts when such patterns are detected. Unlike preventive controls, an IDS does not block or stop the attack in real time; it only identifies and reports the incident for subsequent investigation and response.

Answer

Corrective

Answer

Compensating

Answer

Preventive

Question 9

An organization using the FAIR framework estimates that a threat event frequency (TEF) is 10 per year, vulnerability is 0.2, and loss magnitude per event is $500,000. What is the annualized loss expectancy (ALE)?

Accepted Answer

$1,000,000. The FAIR framework calculates ALE as TEF × Vulnerability × Loss Magnitude. Here, 10 × 0.2 × $500,000 = $1,000,000. This correctly incorporates the vulnerability factor (0.2) as a probability of threat success, yielding the expected annual loss.

Answer

$500,000

Answer

$100,000

Answer

$2,500,000

Question 10

Which of the following is the BEST Key Control Indicator (KCI) for measuring the effectiveness of a firewall?

Accepted Answer

Percentage of blocked intrusion attempts. The percentage of blocked intrusion attempts directly measures how effectively the firewall is enforcing its security policies to prevent unauthorized access. A high block rate indicates the firewall is correctly identifying and stopping threats, making it the most direct KCI for firewall effectiveness.

Answer

Time since last firewall firmware update

Answer

Number of firewall rule changes per month

Answer

Number of firewall alerts generated

Question 11

A quarterly risk report for the IT steering committee shows a key risk indicator (KRI) called 'patch lag' has increased from 15 days to 45 days. What does this trend most likely indicate?

Accepted Answer

Increased vulnerability risk. The patch lag KRI measures the time between a patch's release and its deployment. An increase from 15 to 45 days means systems are exposed to known vulnerabilities for a longer period, directly increasing the window of opportunity for exploitation. This trend indicates a worsening security posture and higher vulnerability risk.

Answer

No change in risk level

Answer

Improved security posture

Answer

Decreased vulnerability risk

Question 12

An organization is integrating its IT risk program with the enterprise risk management (ERM) framework. Which THREE of the following activities support this integration?

Accepted Answer

Using consistent risk metrics and terminology across IT and enterprise levels. Using consistent risk metrics and terminology across IT and enterprise levels ensures that IT risks are communicated in a language that the broader ERM framework understands, enabling aggregation and comparison. This alignment prevents siloed risk assessments and supports a unified view of risk exposure across the organization, which is a foundational requirement for integrating IT risk into ERM.

Answer

Maintaining a separate IT risk register not shared with ERM

Answer

Reporting IT risks only to the CIO without board visibility

Question 13

A risk practitioner notices that the number of failed authentication attempts has spiked by 300% over the past week. Which of the following actions should be taken FIRST?

Accepted Answer

Analyze the logs to identify the source and nature of the attempts. The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.

Answer

Report the spike to the board

Answer

Implement multi-factor authentication

Answer

Increase the frequency of password changes

Question 14

A company is assessing a new vendor that will have access to its customer database. The vendor's security questionnaire reveals they lack SOC 2 certification. According to risk tiering, the vendor is classified as critical. What should the company do?

Accepted Answer

Require the vendor to obtain SOC 2 Type II certification before contract signing.. A critical-tier vendor with access to sensitive customer data requires independent assurance of security controls. SOC 2 Type II certification provides a rigorous, audited assessment of controls over a period of time, which is essential for a high-risk vendor. Requiring this certification before contract signing ensures the vendor meets the necessary security baseline before any data is exposed.

Answer

Accept the vendor because the questionnaire indicates other strong controls.

Answer

Proceed with the contract but increase monitoring frequency.

Answer

Lower the vendor's tier to medium to avoid the requirement.

Question 15

Which of the following best describes the purpose of tactical risk reporting?

Accepted Answer

To enable the CISO to make informed decisions about risk mitigation priorities. Tactical risk reporting is designed to provide mid-level management, such as the CISO, with actionable insights to prioritize risk mitigation activities. It focuses on operational risk decisions, not strategic oversight or daily metrics, enabling informed choices about resource allocation and remediation timelines.

Answer

To satisfy regulatory compliance requirements

Answer

To inform the board of directors about strategic risk exposure

Answer

To provide daily operational metrics to system administrators