CRISC Practice Test 32 — 15 Questions

Question 1

An organization identifies a risk that is within its risk appetite. The risk owner decides to formally document the risk and accept it without implementing additional controls. Which of the following is required for this risk acceptance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Formal sign-off by the risk owner. Acceptance requires formal documentation and sign-off by the risk owner, acknowledging the risk within appetite.

Answer

Avoidance of the business process

Answer

Transfer of risk to an insurance provider

Answer

Implementation of compensating controls

Question 2

An employee with access to sensitive financial data has been observed accessing systems outside of normal working hours and exhibiting erratic behavior. The IT risk manager suspects insider threat. What is the most appropriate risk response?

Accepted Answer

Implement additional monitoring and restrictions. Implementing additional monitoring and restrictions (Option B) is the most appropriate risk response because it allows the organization to gather more evidence of the suspected insider threat while immediately reducing the attack surface. This aligns with the risk mitigation strategy, as it directly addresses the observed anomalous behavior—accessing systems outside normal hours—without prematurely escalating the situation. In a financial data environment, this could involve enabling enhanced audit logging, restricting access to specific IP ranges or times, and deploying user and entity behavior analytics (UEBA) to detect deviations from baseline activity.

Answer

Terminate the employee immediately

Answer

Accept the risk as the employee is trusted

Answer

Transfer via fidelity insurance

Question 3

Which threat actor is most likely motivated by political ideology and may target government systems?

Accepted Answer

Hacktivist. Hacktivists are threat actors whose primary motivation is political ideology, social activism, or protest. They often target government systems to disrupt operations, deface websites, or leak sensitive information in order to advance their political agenda, making option C correct.

Answer

Organized crime

Answer

Nation-state APT

Answer

Script kiddie

Question 4

A company is assessing the risk of a ransomware attack. The security team estimates the threat event frequency as 2 attacks per year, vulnerability as 0.3 (30% chance of success), primary loss as $500,000, and secondary loss as $200,000. What is the annualized loss expectancy (ALE) using the FAIR framework?

Accepted Answer

$420,000. The FAIR framework calculates ALE as Threat Event Frequency × Vulnerability × (Primary Loss + Secondary Loss). Here, 2 × 0.3 × ($500,000 + $200,000) = 2 × 0.3 × $700,000 = $420,000. This correctly accounts for the probability of a successful attack and the total loss per incident.

Answer

$700,000

Answer

$210,000

Answer

$1,400,000

Question 5

A large financial services firm recently deployed a new security information and event management (SIEM) system to monitor thousands of servers, network devices, and applications. The system is generating over 1,000 alerts per hour, of which 80% are false positives. The security operations center (SOC) team is overwhelmed and has started ignoring all but the most critical alerts. As a result, a real attack recently went undetected for 48 hours. The risk manager is asked to recommend improvements. The SOC team has 12 analysts working in shifts. The SIEM is properly configured but the correlation rules are broad and noisy. The firm cannot add more staff due to budget freeze. What should the risk manager prioritize?

Accepted Answer

Tune the alerting rules and adopt risk-based prioritization to filter out known false positives.. The core issue is that broad correlation rules generate excessive false positives, overwhelming the SOC and causing alert fatigue. Tuning the alerting rules and adopting risk-based prioritization directly addresses the root cause by reducing noise and focusing analyst attention on genuine threats. This is a sustainable, cost-effective improvement that leverages existing staff and tools.

Answer

Disable all low-priority alerts to reduce volume immediately.

Answer

Implement a machine learning algorithm to automatically classify alerts.

Answer

Request budget to hire five additional SOC analysts.

Question 6

An organization is selecting a control to prevent unauthorized access to a critical database. Which control type is most appropriate?

Accepted Answer

Preventive control. Preventive control is the most appropriate because it directly stops unauthorized access before it occurs. For a critical database, this includes mechanisms like database firewalls, access control lists (ACLs), or mandatory access control (MAC) policies that enforce authentication and authorization at the point of entry, such as requiring valid credentials and role-based permissions before any query is processed.

Answer

Detective control

Answer

Corrective control

Answer

Directive control

Question 7

A company is migrating its customer database to a public cloud provider. During the planning phase, which of the following is the MOST effective approach to identify risks specific to this migration?

Accepted Answer

Conduct a threat modeling exercise focusing on the cloud architecture. Conducting a threat modeling exercise (D) is the most effective approach because it systematically identifies threats, vulnerabilities, and attack vectors specific to the cloud architecture, data flow, and trust boundaries of the migration. Unlike generic reviews, threat modeling (e.g., using STRIDE or PASTA) directly addresses the unique risks of moving a customer database to a public cloud, such as misconfigured access controls, insecure APIs, or data exposure during transit.

Answer

Review industry risk reports for similar migrations

Answer

Rely on the cloud provider's published risk documentation

Answer

Perform a compliance checklist review

Question 8

A risk manager is designing monthly risk reports for senior management. Which THREE of the following should be included in an effective risk report? (Choose three.)

Accepted Answer

Changes in the risk landscape.. An effective risk report must communicate changes in the risk landscape, such as new threats, regulatory shifts, or emerging vulnerabilities, to enable senior management to make informed strategic decisions. This ensures the report remains relevant and actionable, reflecting the dynamic nature of risk.

Answer

Names of individual employees responsible for control failures.

Answer

Detailed control test results for every control.

Question 9

Which TWO of the following are key risk identification techniques used to identify threats and vulnerabilities in IT systems? (Select exactly 2.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (B) is a key risk identification technique because it actively probes systems, networks, and applications with tools like Nessus, Qualys, or OpenVAS to enumerate known CVEs, missing patches, and misconfigurations, producing concrete evidence of existing vulnerabilities. Threat modeling (D) is also a key risk identification technique because it systematically analyzes a system's architecture, data flows, and trust boundaries (e.g., via STRIDE or DREAD) to enumerate potential threats and weaknesses before or during design. By contrast, risk mitigation (A) and risk transfer (C) are risk response/treatment strategies (alongside avoidance and acceptance), not identification methods, and access control implementation (E) is a preventive security control rather than a technique for discovering threats and vulnerabilities.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Access control implementation

Question 10

After a security incident, a company implements a new control and begins monitoring its effectiveness. Which of the following metrics would BEST indicate that the control is achieving its objective?

Accepted Answer

Decrease in the number of successful attacks.. A decrease in the number of successful attacks directly measures the control's primary objective: preventing or mitigating actual security breaches. If the control is effective, it should stop or reduce the frequency of attacks that compromise the system, making this the most direct indicator of success.

Answer

Reduction in the number of vulnerabilities.

Answer

Number of incidents reported.

Answer

Time to detect incidents.

Question 11

A bank's fraud detection system generates an alert for a transaction, but subsequent investigation finds it false. What should be done?

Accepted Answer

Document the false positive for trend analysis.. Documenting false positives enables trend analysis to identify patterns in detection logic errors, such as rule misconfigurations or data quality issues. This aligns with the CRISC domain of risk and control monitoring, where logging and analyzing false alerts improves detection accuracy over time without prematurely adjusting thresholds.

Answer

Report to the board.

Answer

Ignore future similar alerts.

Answer

Reduce the sensitivity of the detection system.

Question 12

For a risk with very low likelihood and low impact, what is the typical risk response?

Accepted Answer

Accept. When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Answer

Mitigate

Answer

Transfer

Answer

Avoid

Question 13

A company is planning to migrate to post-quantum cryptography. What is the primary risk that quantum computing poses to current cryptographic systems?

Accepted Answer

Breaking widely used public-key cryptographic algorithms. Quantum computers using Shor's algorithm can efficiently solve integer factorization and discrete logarithm problems, threatening RSA and ECC.

Answer

Enhancing encryption key generation

Answer

Compromising hash functions for integrity

Answer

Increased speed of brute-force attacks on symmetric keys

Question 14

During a risk assessment for a cloud migration project, the IT risk manager identifies that the organization lacks visibility into the cloud provider's security controls. Which approach should the risk manager recommend to address this risk?

Accepted Answer

Obtain a third-party audit report (e.g., SOC 2 Type II).. A SOC 2 Type II report provides an independent, third-party assessment of a cloud provider's controls over a period of time, directly addressing the lack of visibility by offering verifiable evidence of control effectiveness. This is the standard approach for gaining assurance over a provider's security posture without relying on internal access or self-reporting.

Answer

Request the provider to self-attest their controls.

Answer

Accept the risk based on the provider's reputation.

Answer

Conduct a penetration test on the provider's infrastructure.

Question 15

An organization wants to identify risks related to third-party vendors. Which approach best supports continuous risk identification?

Accepted Answer

Automated monitoring of vendor security controls via a third-party risk platform. Automated monitoring via a third-party risk platform enables continuous, real-time visibility into vendor security controls, such as firewall rule changes, vulnerability scan results, and compliance posture. This approach aligns with the CRISC principle of ongoing risk identification, as it detects changes in risk exposure between formal assessment cycles without relying on periodic snapshots.

Answer

Contractual clauses requiring self-assessment

Answer

On-site audits every two years

Answer

Annual vendor risk assessments