CRISC Practice Test 2 — 30 Questions

Question 1

Which THREE factors should be considered when determining the likelihood of a threat exploiting a vulnerability?

Accepted Answer

Ease of exploitation. Ease of exploitation (A) is a key factor because it directly influences how readily a threat actor can leverage a vulnerability. For example, a vulnerability with a public exploit script or one that requires only low privileges is far more likely to be exploited than one requiring complex, custom tooling. This aligns with the CVSS exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) that quantify how easy it is to trigger the vulnerability.

Answer

Regulatory fines

Answer

Asset value

Question 2

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

Accepted Answer

Alert the risk owner and initiate a root cause analysis. The KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Answer

Lower the risk tolerance threshold to trigger more frequent alerts

Answer

Accept the increased risk without further analysis because the trend is gradual

Answer

Increase the risk tolerance threshold to match the current level

Question 3

When using STRIDE for threat modeling, which threat category involves an attacker gaining unauthorized access to a system by pretending to be a legitimate user?

Accepted Answer

Spoofing. Spoofing in STRIDE refers to impersonating something or someone else to gain unauthorized access, such as using stolen credentials.

Answer

Repudiation

Answer

Information Disclosure

Answer

Tampering

Question 4

An IT risk manager is facilitating a workshop to identify risks for a new mobile banking application. Which technique is MOST appropriate for generating a comprehensive list of risks?

Accepted Answer

Conduct a brainstorming session with cross-functional team members. Brainstorming with a cross-functional team (option C) is the most appropriate technique for generating a comprehensive list of risks for a new mobile banking application because it leverages diverse perspectives from development, security, compliance, and business units. This collaborative approach helps uncover unknown or emergent risks specific to the application's architecture, such as API vulnerabilities, session management flaws, or regulatory gaps, which might not be captured by historical data or structured questionnaires.

Answer

Review risk registers from similar projects

Answer

Perform a SWOT analysis

Answer

Distribute a risk questionnaire to project stakeholders

Question 5

A power utility is integrating its industrial control system (ICS) with the corporate IT network to enable real-time operational data access. The risk manager identifies that the ICS uses legacy proprietary protocols without authentication. Which risk treatment option best addresses this issue while maintaining operational availability?

Accepted Answer

Implement a unidirectional gateway that enforces one-way data flow. A unidirectional gateway (data diode) enforces one-way data flow from the ICS to the corporate IT network, preventing any inbound traffic that could exploit the legacy protocols' lack of authentication. This maintains operational availability because the ICS remains isolated from direct network attacks while still providing real-time data access. It is the only option that addresses the authentication gap without disrupting legacy system operations.

Answer

Deploy a host-based intrusion detection system on each ICS device

Answer

Upgrade the ICS to modern protocols with built-in authentication

Answer

Disconnect the ICS from the corporate network and use manual data transfer

Question 6

Which of the following threat actors is MOST likely to be motivated by financial gain and possess moderate to high technical capabilities?

Accepted Answer

Organized crime. Organized crime groups are primarily motivated by financial gain and often have sophisticated technical skills to carry out attacks such as ransomware, data theft, or fraud.

Answer

Hacktivist

Answer

Nation-state APT

Answer

Script kiddie

Question 7

A multinational corporation has deployed a centralized log management system that collects security events from all subsidiaries. The CRO notices that the number of critical alerts from the Asia-Pacific region has dropped significantly over the past week. Upon investigation, the log source status shows that 30% of the devices in that region have not sent any logs in 48 hours. What is the MOST likely cause?

Accepted Answer

A configuration change was made to the log forwarder agent on the affected devices, causing it to stop sending logs.. A configuration change to the log forwarder agent (e.g., syslog-ng, rsyslog, or a proprietary agent) is the most plausible cause for a sudden, sustained drop in log volume from a subset of devices. Unlike network segmentation (Option D), which would affect all traffic, or a DDoS (Option B), which would cause intermittent or total loss, an agent misconfiguration selectively stops log generation while the device remains online. The 48-hour window and 30% device impact align with a staged or partial rollout of a faulty agent configuration.

Answer

The security team applied a new log suppression rule that filters out low-severity events.

Answer

The region experienced a distributed denial-of-service (DDoS) attack that overwhelmed the log collection infrastructure.

Answer

The network team recently implemented a segmentation change that blocked log traffic from those devices.

Question 8

Which TWO of the following are examples of detective controls?

Accepted Answer

Log monitoring and analysis. Detective controls identify incidents that have already occurred. Intrusion detection systems and log monitoring are classic examples.

Answer

Encryption of data at rest

Answer

Firewall rules

Answer

Data backup process

Question 9

An organization has a risk indicator that shows the number of failed login attempts per day. The threshold is 100. Last week, the number spiked to 200 on two days. What does this indicate?

Accepted Answer

There may be a brute-force attack in progress.. A spike in failed login attempts from a baseline of 100 to 200 per day is a classic indicator of a brute-force attack, where an attacker systematically tries multiple username/password combinations. This risk indicator directly measures authentication failures, which are the primary symptom of such an attack. The threshold breach signals that the control (account lockout or rate limiting) may be insufficient or failing.

Answer

The system is experiencing a denial-of-service attack.

Answer

The password policy needs to be updated.

Answer

Users have forgotten their passwords.

Question 10

In developing a risk scenario, connecting a threat event to business impact is crucial. Which of the following is the BEST example of a properly connected risk scenario?

Accepted Answer

A DDoS attack causes website unavailability for 4 hours, resulting in $500,000 lost sales and customer churn.. A proper connection shows the chain from threat to impact on business.

Answer

A firewall misconfiguration allows unauthorized access, causing a security incident.

Answer

A ransomware attack encrypts files, leading to IT department overtime.

Answer

An insider steals data, leading to legal fees.

Question 11

Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?

Accepted Answer

The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface. Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.

Answer

The ACL has no logging enabled

Answer

The ACL is missing a permit statement for HTTP

Answer

The ACL blocks all traffic from the internet

Question 12

Which TWO of the following factors should be considered when determining the frequency of control monitoring?

Accepted Answer

The criticality of the control to risk mitigation.. The frequency of control monitoring should be based on risk and criticality. Options D and E are correct because controls that are more critical to risk mitigation and processes with higher inherent risk levels require more frequent monitoring. Option A is incorrect because monitoring frequency should be driven by risk, not cost; cost is a secondary consideration. Option B is incorrect because the number of IT projects does not directly affect the monitoring frequency of existing controls. Option C is incorrect because external auditor preferences may influence the approach but are not a primary factor in determining monitoring frequency.

Answer

The cost of monitoring relative to control cost.

Answer

The number of IT projects in progress.

Answer

The preferences of the external auditor.

Question 13

During a risk assessment, a risk owner is unsure about the likelihood rating for a specific threat. Which of the following is the BEST source of information to determine the likelihood?

Accepted Answer

Historical incident data from industry reports. Historical incident data from industry reports provides empirical evidence of threat frequency and impact across similar environments, making it the most objective and reliable source for determining likelihood. Unlike subjective opinions or unrelated financial data, industry reports aggregate real-world occurrences, enabling a data-driven risk assessment that aligns with the organization's threat landscape.

Answer

Vendor documentation

Answer

The risk owner's personal opinion

Answer

The organization's financial statements

Question 14

Which THREE of the following are effective risk treatment strategies?

Accepted Answer

Avoid the risk by discontinuing the activity. Avoiding risk by discontinuing the activity is a recognized risk treatment strategy under the ISACA Risk IT framework. By ceasing the activity that introduces the risk, the organization eliminates the possibility of the risk event occurring, which is a valid and often necessary response when the risk exceeds the organization's risk appetite and cannot be cost-effectively mitigated or transferred.

Answer

Accept the risk without any analysis

Answer

Ignore the risk if it has not materialized yet

Question 15

A power utility company is required to comply with NERC CIP standards. The risk manager is assessing the impact of connecting a remote substation's OT network to the corporate WAN. Which of the following is the MOST significant risk that must be addressed to comply with NERC CIP?

Accepted Answer

Violation of electronic security perimeter (ESP) requirements. NERC CIP requires clear electronic security perimeters (ESPs) between OT and other networks. Connecting OT to the corporate network can compromise the ESP, allowing unauthorized access to critical assets. This is a key compliance requirement.

Answer

Latency issues affecting real-time control

Answer

Increased bandwidth costs for WAN connectivity

Answer

Incompatibility with legacy serial protocols

Question 16

Match each information security objective to its description.

Accepted Answer

Confidentiality: Ensures that information is not disclosed to unauthorized individuals.. The CIA triad (Confidentiality, Integrity, Availability) plus Accountability are core security principles. Correct matches: Confidentiality prevents unauthorized disclosure, Integrity ensures accuracy, Availability guarantees access, and Accountability enables traceability.

Answer

Confidentiality: Ensures that information is accurate and complete, and not modified improperly.

Answer

Integrity: Ensures that information is not disclosed to unauthorized individuals.

Question 17

Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)

Accepted Answer

Risk owner. The risk register is a foundational artifact in IT risk management, and during the identification phase, its essential components are the risk description (to uniquely identify the risk), the risk owner (to assign accountability), and the root cause (to understand the underlying source). These three elements are documented before any quantitative analysis or mitigation planning occurs, as they form the basis for subsequent risk assessment and response.

Answer

Quantified monetary impact

Answer

Mitigation plan

Question 18

After implementing multiple controls, the residual risk for a new product launch is still slightly above the risk appetite. The risk manager decides to proceed with the launch and monitor the risks regularly. This is:

Accepted Answer

Risk Acceptance. The risk manager's decision to proceed with the launch despite residual risk exceeding the risk appetite, while committing to regular monitoring, is the definition of risk acceptance. In IT risk management, this acknowledges that the remaining risk is tolerable for business objectives, and the monitoring plan ensures any escalation is detected early. This is not a passive decision but an active, documented acceptance of the residual risk level.

Answer

Risk Transfer

Answer

Risk Avoidance

Answer

Risk Mitigation

Question 19

An organization is implementing continuous monitoring of its network using SIEM rules. Which of the following is the PRIMARY benefit of this approach over periodic manual testing?

Accepted Answer

Provides real-time detection of security events. Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Answer

Reduces the need for security staff

Answer

Is less expensive than periodic testing

Answer

Eliminates all false positives

Question 20

A financial services company is implementing a vendor risk management program. Which THREE of the following are key components of an effective vendor risk assessment process? (Select THREE)

Accepted Answer

Contract compliance reviews. Contract compliance reviews (A) are a key component because they verify that vendors are meeting agreed-upon service level agreements (SLAs), security clauses, and regulatory requirements. This ensures that contractual obligations, such as data protection standards and incident response timelines, are being enforced and that any deviations are identified and remediated. Without this review, the organization cannot confirm that the vendor's actual practices align with the risk posture agreed upon during onboarding.

Answer

Review of vendor's cyber insurance policy

Answer

Vendor self-assessment without validation