CRISC Practice Test 30 — 15 Questions

Question 1

Which THREE of the following are essential components of an effective IT risk report to senior management? (Select THREE.)

Accepted Answer

Risk trend analysis over time. Risk trend analysis over time (Option A) is essential because it enables senior management to understand whether the organization's risk posture is improving or deteriorating, supporting strategic decision-making. Trend data, such as month-over-month changes in residual risk scores or frequency of high-severity incidents, provides context beyond a static snapshot. This aligns with the CRISC focus on continuous monitoring and reporting of risk response effectiveness.

Answer

Names of all third-party vendors with contracts

Answer

Detailed control deficiency descriptions

Question 2

After implementing a new access control system, the IT risk manager needs to measure its effectiveness. Which THREE of the following are Key Control Indicators (KCIs) that would be appropriate?

Accepted Answer

Exception rate for access requests. The exception rate for access requests directly measures how often access requests deviate from established policies, indicating the effectiveness of the access control system in enforcing least privilege and authorization rules. A high exception rate suggests weaknesses in the control design or operation, making it a key control indicator (KCI) for access management.

Answer

Patch lag time for critical systems

Answer

User satisfaction survey scores

Question 3

A change to a critical application is being implemented without updating the associated security controls. This is most likely a failure in which process?

Accepted Answer

Change management. A change to a critical application that bypasses updating security controls is a direct failure of the change management process. Change management requires that all changes, including security controls, be reviewed, approved, and documented before implementation to maintain the risk posture. Without this process, the organization loses visibility and control over the security implications of the change, leading to potential vulnerabilities.

Answer

Control design

Answer

Project management

Answer

User training

Question 4

A security operations center (SOC) uses a Security Information and Event Management (SIEM) system to continuously monitor for suspicious activities. Which type of monitoring is being performed?

Accepted Answer

Continuous monitoring. The SOC is using a SIEM system to continuously monitor for suspicious activities, which aligns with continuous monitoring. Continuous monitoring involves real-time or near-real-time collection and analysis of security events to detect threats as they occur, rather than at scheduled intervals. SIEM systems aggregate logs and alerts from various sources to provide ongoing visibility into the security posture.

Answer

Periodic control testing

Answer

Compliance audit

Answer

Vulnerability scanning

Question 5

During a cost-benefit analysis for a proposed control, the annual loss expectancy (ALE) for a risk is currently $500,000. The control is expected to reduce the ALE by 80% and will cost $150,000 per year. What is the net benefit of implementing the control?

Accepted Answer

$250,000. The current annual loss expectancy (ALE) is $500,000. An 80% reduction means the control saves $400,000 per year. Subtracting the annual control cost of $150,000 yields a net benefit of $250,000. This is calculated as (ALE × reduction percentage) – control cost.

Answer

$100,000

Answer

$400,000

Answer

$350,000

Question 6

An organization uses a KRI that tracks the average time to patch critical vulnerabilities. The metric has been increasing over the past three months. What does this indicate from a risk perspective?

Accepted Answer

The risk of exploitation is increasing. An increasing average time to patch critical vulnerabilities indicates that the organization is taking longer to remediate known security weaknesses. From a risk perspective, this directly increases the window of exposure, making it more likely that an attacker will exploit a vulnerability before a patch is applied. Therefore, the risk of exploitation is increasing.

Answer

The control effectiveness is improving

Answer

The risk appetite has been reduced

Answer

The risk of exploitation is decreasing

Question 7

An organization wants to promote a risk-aware culture. Which of the following actions is most effective in encouraging employees to report incidents without fear?

Accepted Answer

Establishing a non-punitive incident reporting policy. A non-punitive incident reporting policy is the most effective action because it directly removes the fear of retaliation or blame, which is the primary psychological barrier to reporting security incidents. By guaranteeing that employees will not face disciplinary action for reporting their own mistakes or observed issues, the organization fosters psychological safety and encourages timely disclosure. This aligns with the CRISC principle that a risk-aware culture requires trust and openness, which cannot be achieved through training or metrics alone if fear persists.

Answer

Conducting annual security awareness training

Answer

Publishing risk metrics on the intranet

Answer

Providing incentives for risk identification

Question 8

During a quarterly IT risk review, the risk manager presents a risk heat map. Which TWO of the following elements should be included in the report to provide a comprehensive view?

Accepted Answer

Risk heat map showing current risk levels. A risk heat map visually represents current risk levels based on likelihood and impact, which is essential for a quarterly review to show the organization's present risk posture. Option D is correct because including risk trend analysis over the past quarter provides a dynamic view of how risks have evolved, enabling stakeholders to assess whether risk responses are effective and to identify emerging patterns.

Answer

Upcoming risk events and changes

Answer

List of all identified risks regardless of priority

Answer

Detailed control performance metrics for all controls

Question 9

During a merger and acquisition (M&A) due diligence, the IT risk manager needs to identify risks in the target company's IT environment. Which approach is most effective for comprehensive risk identification?

Accepted Answer

Conduct an on-site assessment of the target's IT infrastructure. An on-site assessment (Option D) allows the IT risk manager to directly observe the target's IT infrastructure, including physical security, network configurations, and operational practices. This hands-on approach uncovers risks that may be hidden or misrepresented in self-reported questionnaires, such as outdated firmware, unpatched systems, or insecure network segmentation. It provides the most comprehensive and accurate risk identification for M&A due diligence.

Answer

Send a detailed questionnaire to the target's IT department

Answer

Review the target's public financial reports

Answer

Conduct a war gaming exercise

Question 10

An organization is selecting a control to reduce the risk of unauthorized data exfiltration. The annual loss expectancy (ALE) for this risk is currently $500,000. The proposed control costs $80,000 annually and is expected to reduce the ALE by 60%. What is the net benefit (reduction in risk exposure minus control cost) of implementing this control?

Accepted Answer

$220,000. The current ALE is $500,000. A 60% reduction lowers the ALE by $300,000 (0.60 × $500,000). The net benefit is the reduction in risk exposure ($300,000) minus the annual control cost ($80,000), resulting in $220,000. This calculation directly measures the residual risk reduction against the cost of the control, a key concept in cost-benefit analysis for risk response.

Answer

$420,000

Answer

$300,000

Answer

$120,000

Question 11

In a risk-aware culture, which of the following behaviors is MOST encouraged?

Accepted Answer

Reporting security incidents without fear of blame. In a risk-aware culture, the primary goal is to encourage transparency and continuous improvement in risk management. Reporting security incidents without fear of blame (Option D) is most encouraged because it enables timely detection, analysis, and remediation of threats, directly supporting the Risk Response and Reporting domain by fostering an environment where incidents are escalated promptly rather than concealed.

Answer

Focusing only on compliance requirements

Answer

Assigning blame to individuals for security breaches

Answer

Hiding minor incidents to maintain performance metrics

Question 12

A key control indicator (KCI) for a critical access control shows a deficiency rate of 12% for the quarter, exceeding the target of 5%. Which of the following should be the risk practitioner's PRIMARY action?

Accepted Answer

Investigate root causes of the high deficiency rate. The primary action is to investigate root causes because a KCI deficiency rate of 12% against a 5% target indicates a systemic control failure. Without understanding why the access control is failing (e.g., misconfigured role-based access control (RBAC) rules, stale user entitlements, or bypassed multi-factor authentication), any subsequent remediation may be ineffective. Root cause analysis ensures the risk practitioner addresses the underlying issue rather than applying a superficial fix.

Answer

Escalate the deficiency to the board immediately

Answer

Implement compensating controls to reduce risk

Answer

Increase the frequency of control testing

Question 13

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

Provide early warning of changing risk levels. The primary purpose of a Key Risk Indicator (KRI) is to provide an early warning of changing risk levels, enabling proactive risk management before an adverse event occurs. KRIs track specific metrics that signal shifts in risk exposure, such as the number of unpatched critical vulnerabilities or failed login attempts, allowing organizations to adjust controls or resources in advance. This forward-looking function distinguishes KRIs from lagging indicators like control effectiveness metrics or incident logs.

Answer

Measure the effectiveness of controls

Answer

Document historical incidents

Answer

Comply with regulatory requirements

Question 14

A financial institution is implementing a cloud-based data analytics platform. The data includes personally identifiable information (PII) of customers in multiple jurisdictions. Which of the following is the MOST critical risk consideration?

Accepted Answer

Data sovereignty and compliance with local regulations. The most critical risk is data sovereignty and compliance with local regulations because PII from multiple jurisdictions is subject to varying legal requirements (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil). A cloud-based analytics platform processes and stores this data, and failure to comply can result in severe fines, legal action, and reputational damage. Unlike technical risks like vendor lock-in or multi-tenancy, non-compliance is a direct regulatory and business risk that cannot be mitigated by standard cloud controls alone.

Answer

Vendor lock-in due to proprietary APIs

Answer

Shared responsibility model gaps

Answer

Multi-tenancy isolation risks

Question 15

A risk manager is designing an IT risk management programme. Which THREE of the following are essential components of a risk management policy?

Accepted Answer

Risk assessment methodology. A risk assessment methodology is an essential component of a risk management policy because it defines the standardized approach for identifying, analyzing, and evaluating IT risks. Without a prescribed methodology, risk assessments would be inconsistent, making it impossible to compare risks across the organization or to align them with the risk appetite. The policy must mandate a repeatable process, such as NIST SP 800-30 or ISO 31010, to ensure objectivity and defensibility in risk decisions.

Answer

Specific risk treatment plans

Answer

Detailed risk register