CRISC Practice Test 3 — 10 Questions

Question 1

Which of the following is the BEST indicator that a risk assessment's results are reliable?

Accepted Answer

It uses the most recent threat intelligence.. B is correct because the reliability of a risk assessment hinges on the accuracy and timeliness of its inputs. Using the most recent threat intelligence ensures that the assessment reflects the current threat landscape, including newly discovered vulnerabilities, active exploit campaigns, and emerging attack vectors. Without current intelligence, even a perfectly structured assessment will produce outdated risk scores that fail to represent actual exposure.

Answer

It is based on a standard framework such as ISO 31000.

Answer

It includes both quantitative and qualitative methods.

Answer

It is performed by an external consultant.

Question 2

A risk practitioner is reviewing the organization's risk response strategies for a high-value asset. Which TWO of the following are examples of risk mitigation techniques? (Choose two.)

Accepted Answer

Implementing firewalls to protect the network perimeter.. Implementing firewalls to protect the network perimeter is a risk mitigation technique because it reduces the likelihood of unauthorized access by filtering traffic based on security rules. Firewalls operate at layers 3 and 4 (and sometimes layer 7) of the OSI model, using stateful inspection or application-layer filtering to block malicious packets. This directly lowers the probability of a successful attack on the high-value asset, which is the essence of mitigation.

Answer

Avoiding the risk by discontinuing the vulnerable activity.

Answer

Accepting the risk because the cost of mitigation exceeds the potential loss.

Answer

Purchasing cyber insurance to cover potential losses.

Question 3

A global financial services firm has implemented a risk monitoring system that aggregates data from 50+ systems across three regions (Americas, EMEA, APAC). The system uses a centralized data lake and provides dashboards to regional risk committees. Recently, the APAC committee reported that their dashboard shows a spike in cyber risk indicators, but the Americas and EMEA dashboards show no change. The data source for the spike is a single system in APAC that tracks failed VPN logins. The risk owner for that system believes the spike is due to a misconfiguration during a recent patch. However, the APAC risk committee is concerned that this indicates a coordinated attack. The Chief Risk Officer (CRO) wants a clear assessment. Which course of action is most appropriate?

Accepted Answer

Advise the CRO that the spike is likely a false positive due to the recent patch and recommend the system owner confirm and fix the misconfiguration.. The spike originates from a single system in APAC tracking failed VPN logins, and the risk owner has identified a misconfiguration from a recent patch as the cause. This is a classic false positive scenario where a technical anomaly (e.g., a patch altering authentication timeout or lockout thresholds) generates an alert spike without evidence of lateral movement or other indicators. The CRO needs a clear assessment, and the most appropriate action is to confirm the misconfiguration and fix it, rather than escalating or adding controls prematurely.

Answer

Recommend implementing additional monitoring controls across all regions to detect similar spikes.

Answer

Suggest the APAC committee accept the risk based on the system owner's opinion.

Answer

Immediately escalate to the board and activate the incident response team.

Question 4

Based on the exhibit, which risk response should be prioritized?

Accepted Answer

Implement account lockout policy. The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.

Answer

Avoid by taking the server offline

Answer

Accept the risk because it's only a single server

Answer

Transfer the risk to a cloud provider

Question 5

Which THREE factors should be considered when determining the inherent risk level of a new IT project prior to any controls?

Accepted Answer

Regulatory requirements governing the project's outcomes.. Regulatory requirements (A) are a key factor in determining inherent risk because they impose mandatory compliance obligations that, if unmet, can result in legal penalties, fines, or operational shutdowns. For a new IT project, the inherent risk level is assessed based on the nature of the data processed and the applicable laws (e.g., GDPR, HIPAA, PCI DSS) before any controls are applied. This is a fundamental input to the risk assessment, as non-compliance risk exists independently of any security measures.

Answer

Past security incidents in similar projects.

Answer

Experience level of the project team.

Question 6

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Timeliness is a key consideration because risk reports must provide current information to enable timely decision-making and response to emerging risks. Stale data can lead to missed opportunities for mitigation or incorrect risk assessments, especially in fast-changing environments like cybersecurity or financial markets.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 7

Order the steps for implementing a risk treatment plan.

Accepted Answer

Select risk response, then develop risk treatment plan, then obtain approval, then implement the plan, then monitor and review.. Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

Answer

Select risk response, then obtain approval, then develop risk treatment plan, then implement the plan, then monitor and review.

Answer

Develop risk treatment plan, then select risk response, then obtain approval, then implement the plan, then monitor and review.

Answer

Select risk response, then develop risk treatment plan, then implement the plan, then obtain approval, then monitor and review.

Question 8

Arrange the steps for performing a risk assessment in the correct order.

Accepted Answer

Asset identification, then threat and vulnerability identification, then likelihood and impact analysis, then risk calculation, then documentation.. Risk assessment begins with asset identification, then threats/vulnerabilities, followed by likelihood and impact analysis, risk calculation, and documentation.

Answer

Threat and vulnerability identification, then asset identification, then likelihood and impact analysis, then risk calculation, then documentation.

Answer

Risk calculation, then asset identification, then threat and vulnerability identification, then documentation, then likelihood and impact analysis.

Answer

Asset identification, then threat and vulnerability identification, then risk calculation, then likelihood and impact analysis, then documentation.

Question 9

Which of the following is an example of a detective control in IT risk management?

Accepted Answer

Intrusion Detection System (IDS). Detective controls identify risk events after they occur. Intrusion Detection Systems (IDS) monitor network traffic to detect malicious activity.

Answer

Firewall

Answer

Data encryption

Answer

Backup restoration

Question 10

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

Accepted Answer

Risk treatment plans are implemented within agreed timelines. The effectiveness of an IT risk assessment process is ultimately measured by whether identified risks are actually treated within agreed timelines. Option D directly demonstrates that the organization moves from risk identification to remediation, closing the risk management loop. Without timely implementation of treatment plans, even the most thorough risk assessments provide no reduction in actual risk exposure.

Answer

The risk register contains a large number of risks

Answer

Risk appetite statements are clearly defined

Answer

Risk assessments are performed annually