CRISC Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. The control test failed because unauthorized access attempts were detected. The remediation plan suggests additional logging. Is this remediation appropriate?

Accepted Answer

No, the remediation should focus on strengthening access controls.. The control test failure was due to unauthorized access attempts, which indicates a weakness in preventive controls. Adding logging (a detective control) does not address the root cause; the remediation should focus on strengthening access controls (e.g., tightening authentication, authorization, or firewall rules) to prevent unauthorized access in the first place. Logging alone would only record future incidents without reducing their likelihood.

Answer

No, the control test methodology is flawed.

Answer

Yes, because the control is detective in nature.

Answer

Yes, additional logging will help detect future attempts.

Question 2

Which THREE are best practices for control monitoring?

Accepted Answer

Use a risk-based approach to prioritize.. Option A is correct because a risk-based approach directs monitoring resources toward the controls that mitigate the highest-impact risks, aligning effort with organizational risk appetite and materiality. Option D is correct because combining automated monitoring (e.g., continuous control monitoring, SIEM/SCA tooling) with manual reviews (e.g., walkthroughs, sampling, inspection) provides broader coverage and compensates for the limitations of each method alone. Option E is correct because documenting monitoring results, exceptions, and remediation actions creates the audit trail and evidence needed for governance, audit, and continuous improvement. Option B is not a best practice because monitoring frequency should be risk-based rather than a fixed annual cycle; high-risk controls may need continuous or more frequent testing. Option C is not a best practice because relying solely on control owners introduces self-assessment bias and removes independent oversight, weakening the reliability of monitoring.

Answer

Test controls at least annually.

Answer

Rely solely on control owners.

Question 3

A power utility is required to comply with NERC CIP standards. Which of the following is a primary objective of these standards?

Accepted Answer

Protect the reliability of the bulk electric system. NERC CIP (Critical Infrastructure Protection) standards are mandatory reliability standards specifically designed to protect the bulk electric system (BES) from cyber and physical threats. Their primary objective is to ensure the reliable operation of the BES by securing the assets that control and monitor it. This is a regulatory requirement for power utilities in North America.

Answer

Standardize industrial control protocols

Answer

Reduce energy consumption

Answer

Ensure interoperability between IT and OT systems

Question 4

Which type of control is designed to reduce the likelihood of a risk event occurring?

Accepted Answer

Preventive. Preventive controls are designed to stop a risk event from occurring in the first place. For example, implementing a firewall rule to block unauthorized inbound traffic reduces the likelihood of a network intrusion. This aligns with the CRISC definition of preventive controls as proactive measures that reduce the probability of a risk scenario.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 5

An organization has implemented a continuous monitoring solution for its critical applications. The IT team reports that the monitoring tool generates a high volume of false positives. What is the BEST course of action?

Accepted Answer

Refine the monitoring rules and thresholds to reduce false positives.. Refining monitoring rules and thresholds directly addresses the root cause of false positives by tuning the detection logic to better match actual risk conditions. This aligns with the CRISC principle of optimizing control efficiency rather than accepting or compensating for excessive noise. For example, adjusting anomaly detection thresholds in a SIEM like Splunk or QRadar can reduce alert volume without sacrificing coverage of genuine threats.

Answer

Disable the monitoring for applications that generate the most false positives.

Answer

Increase the size of the monitoring team to handle the alerts.

Answer

Implement additional detective controls for all false positive alerts.

Question 6

A multinational organization uses multiple risk management systems that do not integrate with each other. The risk team manually consolidates data into a spreadsheet for reporting. This process is error-prone and time-consuming. Which of the following is the BEST long-term solution to improve risk monitoring and reporting?

Accepted Answer

Implement a centralized governance, risk, and compliance (GRC) platform with automated data feeds. Implementing a centralized GRC platform with data feeds from all systems automates integration and reduces errors. Option A is wrong because standardizing spreadsheets still requires manual consolidation. Option C is wrong because training does not address the system integration issue. Option D is wrong because simply adding more manual reviews increases overhead.

Answer

Standardize the spreadsheet format across all departments

Answer

Train risk owners on how to better manually report risks

Answer

Assign dedicated staff to perform additional manual reviews of the spreadsheet

Question 7

Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA) during the IT risk assessment process?

Accepted Answer

To determine the criticality and recovery time objectives of business processes. The primary purpose of a business impact analysis (BIA) is to identify critical business processes, determine their recovery priorities, and establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Option B is incorrect because identifying vulnerabilities is part of a vulnerability assessment, not a BIA. Option C is incorrect because identifying potential threat actors is part of threat modeling. Option D is incorrect because inventorying IT assets is part of asset management, not the primary goal of a BIA.

Answer

To identify vulnerabilities in IT systems

Answer

To identify potential threat actors

Answer

To inventory all IT assets

Question 8

Which THREE of the following should be included in a board-level risk report to effectively communicate the organization's risk profile?

Accepted Answer

Emerging risks and trend analysis of key risk indicators over the past quarter.. A board-level risk report must include forward-looking information such as emerging risks and trend analysis of key risk indicators (KRIs) over the past quarter. This enables the board to understand not only the current risk posture but also the direction and velocity of risk changes, which is essential for strategic oversight and proactive decision-making.

Answer

A list of the most recent security incidents with root cause analysis.

Answer

Detailed descriptions of all controls mitigating the top risks.

Question 9

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Option A (Contract compliance reviews) is correct because an effective vendor risk assessment process must verify that the vendor continuously meets the security, privacy, and service-level obligations defined in the contract, ensuring accountability and detecting drift from agreed controls. Option B (Ongoing monitoring via annual reassessments) is correct because vendor risk is not static; periodic reassessments (at least annually, or upon significant changes) are needed to re-evaluate the vendor's security posture, financial health, and compliance status over the life of the relationship. Option D (Initial onboarding assessment including security questionnaires) is correct because due diligence before engagement is a foundational step—standardized questionnaires (e.g., SIG, CAIQ) help evaluate the vendor's controls, data handling practices, and risk level before any data or access is granted. Option C is not among the marked correct answers because, while reviewing a vendor's cyber insurance policy can be a useful supplementary check, it is not one of the core components of the risk assessment process itself. Option E is not correct because a vendor self-assessment without independent validation is insufficient—it lacks verification and objectivity, which are essential to a credible risk assessment.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation

Question 10

A risk practitioner is updating the risk register after a third-party security incident. Which of the following is the MOST important information to include in the risk register entry for this third-party risk?

Accepted Answer

A description of the risk event, its impact, and the response taken. A risk register entry must capture the essential elements of the risk: a description of the risk event, its potential or realized impact, and the response taken (or planned). For a third-party security incident, documenting what happened, how it affects the organization, and what was done provides the basis for risk tracking, reporting, and future decision-making. This is the core content that makes the register actionable.

Answer

The remediation plan and the risk owner's signature

Answer

The date of the incident and the amount of data compromised

Answer

The name and contact details of the third party

Question 11

Refer to the exhibit. The SIEM alert triggered, but the security team did not respond because they were investigating another incident. What is the BEST way to prevent such monitoring gaps in the future?

Accepted Answer

Configure automatic escalation to a secondary response team if the alert is not acknowledged within a set time.. It directly addresses the monitoring gap caused by analyst unavailability. By configuring automatic escalation to a secondary response team if an alert is not acknowledged within a set time, the organization ensures that no alert is left unattended even when the primary team is occupied. This is a standard operational resilience control in SIEM workflows, often implemented via playbook automation or SOAR integration.

Answer

Implement a ticketing system to track alert handling.

Answer

Hire additional security analysts to handle peak loads.

Answer

Increase the threshold to reduce false positives.

Question 12

A new web application is being developed using several open-source libraries. Which risk identification method is most effective for identifying vulnerabilities in these libraries?

Accepted Answer

Software composition analysis (SCA). Software Composition Analysis (SCA) is specifically designed to identify known vulnerabilities in open-source libraries by analyzing dependency manifests (e.g., pom.xml, package.json) and correlating them against vulnerability databases like the National Vulnerability Database (NVD). For a web application built with multiple open-source components, SCA automates the detection of outdated or vulnerable libraries, which is the most effective method for this risk identification scenario.

Answer

Static application security testing (SAST)

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 13

An organization is categorizing IT risks. Which of the following risk categories would include the risk of regulatory fines due to non-compliance with data protection laws?

Accepted Answer

Compliance risk. Regulatory fines for non-compliance with data protection laws fall squarely under compliance risk, which encompasses the risk of violating laws, regulations, contracts, or standards and the resulting penalties, sanctions, or legal exposure. Data protection regulations such as GDPR or CCPA are compliance obligations, so the associated fine risk is classified as compliance risk.

Answer

Operational risk

Answer

Financial risk

Answer

Strategic risk

Question 14

An organization is planning to implement a new security control. The project manager must ensure changes to existing systems are properly managed. Which process is most critical to include in the implementation plan?

Accepted Answer

Change management. Change management ensures that changes to systems are controlled, tested, and approved to prevent unintended disruptions or security gaps. It is essential during control implementation.

Answer

User training

Answer

Vulnerability scanning

Answer

Access review

Question 15

A company is considering risk transfer for a new IT project. Which TWO options represent valid risk transfer mechanisms? (Select TWO)

Accepted Answer

Purchasing cyber insurance. Option B (Purchasing cyber insurance) is a valid risk transfer mechanism because the organization pays a premium to shift the financial impact of covered cyber events, such as data breaches or ransomware, to the insurer. Option E (Outsourcing with liability clauses) is also valid risk transfer because contractual liability clauses shift specified responsibilities and financial consequences for incidents to the third-party vendor. Option A (Accepting the risk with sign-off) is risk acceptance, not transfer, since the organization retains the risk. Option C (Implementing access controls) is risk mitigation/reduction through preventive controls. Option D (Discontinuing the project) is risk avoidance, as the activity creating the risk is eliminated.

Answer

Accepting the risk with sign-off

Answer

Implementing access controls

Answer

Discontinuing the project