CRISC Practice Test 31 — 15 Questions

Question 1

An organization is considering purchasing cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment option?

Accepted Answer

Transfer. Purchasing cyber insurance transfers the financial consequences of a data breach to an insurer in exchange for premiums, which is the definition of risk transfer. The organization retains some residual risk (deductibles, uncovered losses, reputational damage), but the primary treatment mechanism is transfer. This is distinct from mitigation, which reduces likelihood or impact through controls.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 2

A risk manager is reviewing the risk report content for a quarterly IT risk committee meeting. Which TWO items are most important to include in the report?

Accepted Answer

Risk heat map. A risk heat map (A) is essential because it visually prioritizes risks by likelihood and impact, allowing the IT risk committee to quickly identify and compare exposure across the risk portfolio. Top risks and their status (D) must be included so the committee can focus on the most significant threats, track mitigation progress, and make informed governance decisions. Individual employee performance metrics (B) are an HR concern and do not reflect organizational risk posture. Detailed technical logs (C) are too granular and operational for a quarterly executive-level risk report. A list of all IT assets (E) is an inventory artifact, not a risk report element, and would overwhelm the committee without risk context.

Answer

Individual employee performance metrics

Answer

Detailed technical logs

Answer

List of all IT assets

Question 3

In third-party risk management, which of the following is typically used for initial onboarding assessment of a vendor?

Accepted Answer

Security questionnaire. Security questionnaires are commonly used during initial vendor assessment to gather information about the vendor's security posture.

Answer

Contract compliance review

Answer

SOC 2 Type II report

Answer

Shared intelligence platform feed

Question 4

In third-party risk management, which of the following is MOST indicative of a vendor's control effectiveness for a critical vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the most indicative of a vendor's control effectiveness because it provides an independent auditor's opinion on the design and operating effectiveness of controls over a specified period (typically 6–12 months). For a critical vendor, this third-party attestation offers objective evidence that security and privacy controls are actually working, not just promised.

Answer

Contractual security requirements

Answer

Vendor's self-assessment questionnaire

Answer

Vendor's marketing materials

Question 5

During a vendor risk assessment, an organization discovers that a critical vendor has not performed a security assessment in two years. The vendor is tiered as 'medium risk'. According to best practices, what should the risk practitioner recommend?

Accepted Answer

Request a current SOC 2 report or equivalent assessment. A SOC 2 report (or equivalent, such as an ISO 27001 certification or a SIG assessment) provides independent assurance over a vendor's controls, including security monitoring and assessment cadence. Since the vendor is tiered as 'medium risk' and has not performed a security assessment in two years, the risk practitioner should request current evidence of control effectiveness rather than accept, ignore, or escalate the risk prematurely. This aligns with the CRISC principle of verifying control status before making risk response decisions.

Answer

Downgrade the vendor to low risk to reduce monitoring frequency

Answer

Accept the risk because the vendor is only medium risk

Answer

Terminate the relationship immediately

Question 6

During a vendor risk tiering exercise, a vendor that stores the organization's customer PII and is critical for daily operations should be classified as which tier?

Accepted Answer

Critical. Vendors with access to sensitive data and high service criticality are typically classified as critical (highest tier).

Answer

Medium

Answer

High

Answer

Low

Question 7

An organization is assessing control effectiveness for a key process. Which TWO aspects should be evaluated to determine if a control is effective?

Accepted Answer

Operating effectiveness. Operating effectiveness (A) is correct because a control must actually function as intended over time—evidenced by testing that it is applied consistently, by the right people, at the right frequency—to confirm it mitigates the risk in practice. Design adequacy (D) is correct because a control must first be properly designed to address the identified risk at the right point in the process; a well-designed control that operates as intended is the basis for concluding effectiveness. Together, design adequacy and operating effectiveness are the two standard dimensions used when assessing control effectiveness (as in ISACA/COBIT and audit frameworks). Compliance with industry standards (B) is not the criterion for effectiveness—a control can be effective even if it exceeds or differs from a standard, and standards compliance is a separate conformance question. The number of control owners (C) is irrelevant to effectiveness; ownership count says nothing about whether the control mitigates risk. Cost of implementation (E) is a cost-benefit consideration, not a measure of whether the control achieves its objective.

Answer

Compliance with industry standards

Answer

Number of control owners

Answer

Cost of implementation

Question 8

A risk owner is reviewing a control that has a deficiency rate of 15%. The target deficiency rate is less than 5%. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Investigate the root cause of the high deficiency rate. A deficiency rate of 15% against a target of less than 5% indicates a control failure that requires immediate remediation. Investigating the root cause is the first step in the risk response process to identify why the control is failing and to determine the appropriate corrective action, aligning with the Risk Response and Reporting domain's emphasis on addressing control deficiencies before considering acceptance or reporting.

Answer

Increase the target deficiency rate to 15%

Answer

Report the deficiency to the external auditor

Answer

Accept the risk and document the decision

Question 9

An organization is implementing a new access control system. Which of the following should be included in the control implementation plan?

Accepted Answer

Project milestones, training schedule, and documentation updates. The control implementation plan must be actionable and comprehensive, covering the practical steps needed to deploy the new access control system. Option C includes project milestones (timeline), training schedule (ensuring users and administrators know how to use the system), and documentation updates (keeping policies, procedures, and system documentation current). These elements are essential for a successful implementation and align with CRISC's focus on integrating risk management into business processes. The other options are either too narrow (cost only) or are inputs to the plan rather than components of the plan itself.

Answer

Annual cost of the control only

Answer

Key Risk Indicators (KRIs) for the control

Answer

Risk assessment results

Question 10

A risk practitioner is using a 5×5 heat map to assess IT risks. Which of the following is the primary advantage of this qualitative approach?

Accepted Answer

Requires less data and time to implement. A 5×5 heat map is a qualitative risk assessment tool that uses ordinal scales (e.g., low, medium, high) for likelihood and impact. Its primary advantage is that it requires less data and time to implement compared to quantitative methods, which demand detailed financial data and complex calculations. This makes it practical for rapid, high-level IT risk prioritization when precise data is unavailable.

Answer

Produces financially meaningful loss estimates

Answer

Provides objective and comparable risk scores across organizations

Answer

Eliminates subjectivity in risk ratings

Question 11

Which THREE of the following are characteristics of leading key risk indicators (KRIs)?

Accepted Answer

They are predictive in nature.. Leading key risk indicators (KRIs) are predictive in nature because they track forward-looking metrics that signal potential future risk events before they occur. Unlike lagging indicators that measure past outcomes, leading KRIs use trend analysis and threshold monitoring to forecast changes in risk exposure, enabling organizations to anticipate and address issues proactively.

Answer

They are based on historical data.

Answer

They measure past events and losses.

Question 12

Which of the following is the BEST indicator that a risk assessment should be performed outside the normal cycle?

Accepted Answer

A major IT infrastructure change. A major IT infrastructure change introduces new or altered assets, data flows, and threat surfaces that were not considered in the previous risk assessment cycle. This change can invalidate existing control assumptions and risk ratings, making an ad-hoc assessment necessary to identify and evaluate emerging risks before they materialize.

Answer

A new regulation is proposed

Answer

An employee leaves the company

Answer

The annual budget is approved

Question 13

A company implements a new automated control to monitor user access rights. The control sends a daily report of any users with excessive privileges. What is the PRIMARY benefit of this control?

Accepted Answer

Enables timely remediation of access violations. The primary benefit of an automated control that sends a daily report of users with excessive privileges is that it enables timely remediation of access violations. By providing a regular, scheduled summary of privilege anomalies, the control allows the IT security team to investigate and revoke unauthorized access within a defined timeframe (e.g., 24 hours), reducing the window of exposure. This aligns with the principle of continuous monitoring and rapid response, which is critical for minimizing risk from privilege creep or misconfigured roles.

Answer

Reduces the number of user access reviews

Answer

Eliminates the need for manual checks

Answer

Provides real-time alerts for critical changes

Question 14

Which of the following is the BEST indicator that an organization's IT risk assessment process is effective?

Accepted Answer

Risk treatment plans are implemented within agreed timelines. The effectiveness of an IT risk assessment process is ultimately measured by whether identified risks are actually treated within agreed timelines. Option D directly demonstrates that the organization moves from risk identification to remediation, closing the risk management loop. Without timely implementation of treatment plans, even the most thorough risk assessments provide no reduction in actual risk exposure.

Answer

The risk register contains a large number of risks

Answer

Risk appetite statements are clearly defined

Answer

Risk assessments are performed annually

Question 15

An organization is implementing a new identity and access management (IAM) system. The risk manager is tasked with identifying risks associated with the migration from legacy authentication to single sign-on (SSO). Which of the following is the GREATEST risk during this migration?

Accepted Answer

Legacy authentication accounts may remain active, creating orphan accounts.. Orphan accounts are the greatest risk because legacy authentication accounts that remain active after SSO migration create unmonitored, unmanaged access paths that attackers can exploit to bypass the new centralized controls. These accounts often retain old credentials, lack MFA enforcement, and are not covered by SSO's centralized logging and deprovisioning, making them a persistent and high-impact exposure.

Answer

Users may reuse strong passwords across multiple systems.

Answer

Users may experience increased convenience, leading to reduced security awareness.

Answer

Help desk call volumes may increase due to SSO authentication failures.