CRISC Practice Test 33 — 15 Questions

Question 1

A global company uses a critical third-party vendor for data processing. The inherent risk is high, but the vendor has implemented robust controls. However, due to recent geopolitical instability, the vendor's physical location is at risk. The risk owner recommends purchasing a business continuity insurance policy. Which risk response is being applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transfer. Purchasing a business continuity insurance policy transfers the financial impact of the risk to a third party (the insurer), which is the definition of the transfer response. The vendor's robust controls address some risk, but the geopolitical risk remains and is being shifted via insurance. This is a classic example of risk transfer through insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 2

A manufacturing company is connecting its industrial control systems (ICS) to the corporate network for real-time data analytics. What is the most significant risk arising from this IT/OT convergence?

Accepted Answer

Expanded attack surface from IT to OT systems. Expanded attack surface from IT to OT systems. Connecting ICS/OT networks to corporate IT networks creates a bridge that allows threats to move laterally from IT into OT environments. Historically, OT networks were air-gapped or highly segmented, but IT/OT convergence introduces new entry points and attack vectors, significantly increasing the risk of cyberattacks that can disrupt physical industrial processes. This is the most significant risk because it can lead to safety incidents, production outages, and physical damage.

Answer

Reduced network bandwidth for OT operations

Answer

Increased data storage costs

Answer

Loss of proprietary control protocols

Question 3

A company operates a legacy system for which the vendor no longer provides security patches. What is the most critical risk to identify regarding this system?

Accepted Answer

Unpatched vulnerabilities. Unpatched vulnerabilities are the most critical risk because the legacy system is exposed to known exploits that the vendor no longer addresses. Without security patches, attackers can leverage published CVEs to compromise the system, leading to data breaches or system takeover. This directly threatens the confidentiality, integrity, and availability of the system and its data.

Answer

Incompatibility with new systems

Answer

Lack of vendor support

Answer

Skill shortage for maintenance

Question 4

A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?

Accepted Answer

Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.. The most appropriate risk response is to issue a corrective action plan with a deadline and monitoring, because it directly addresses the control gap (lapsed certification) while preserving the strategic relationship. ISO 27001 certification is a contractual requirement and a key risk mitigation control; its loss increases risk even if other controls exist. A corrective action plan is a targeted risk treatment that restores compliance and provides assurance through monthly reviews, aligning with CRISC's emphasis on balancing risk and business objectives.

Answer

Transfer the risk to the supplier's cyber liability insurance policy.

Answer

Accept the risk because the supplier still has effective controls, and update the risk register.

Answer

Terminate the contract immediately and find an alternative supplier.

Question 5

A risk manager is facilitating a risk identification workshop for a new cloud migration initiative. Which TWO techniques are most effective for identifying potential IT risks at this stage?

Accepted Answer

Interviewing business unit managers and IT architects. Interviewing business unit managers and IT architects (Option B) is effective because it leverages domain expertise to surface operational and technical risks specific to the cloud migration, such as data residency constraints, API dependencies, or shared responsibility model gaps. This qualitative technique captures tacit knowledge that quantitative methods or automated scans cannot, making it ideal for the early identification stage.

Answer

Calculating the annualized loss expectancy (ALE) for each identified risk

Answer

Conducting a cost-benefit analysis of security controls

Answer

Performing a vulnerability scan on the existing infrastructure

Question 6

What is the primary purpose of a risk heat map in IT risk reporting?

Accepted Answer

Provide a visual representation of risk levels. A risk heat map visualizes risks based on likelihood and impact, helping prioritize attention.

Answer

Show control performance metrics

Answer

Display risk trends over time

Answer

List upcoming risk events

Question 7

A company has a control that automatically rejects transactions over $10,000. During a review, it is found that 2% of transactions over $10,000 were approved due to a system glitch. The control owner says the glitch has been fixed. What should the risk practitioner do next?

Accepted Answer

Request evidence of the fix and perform a sample test of recent transactions.. The risk practitioner must independently verify that the system glitch has been resolved before closing the finding. Requesting evidence of the fix (e.g., change logs, patch notes) and performing a sample test of recent transactions provides objective assurance that the control is now operating effectively. This aligns with the CRISC principle that control owner assurances alone are insufficient without validation, especially for automated controls where residual risk from the glitch could persist.

Answer

Accept the control owner's assurance and close the finding.

Answer

Recommend a compensating control until the fix is confirmed.

Answer

Report the issue to the audit committee.

Question 8

A risk manager uses a 5x5 heat map to plot the likelihood and impact of identified risks. This approach is an example of which type of risk analysis?

Accepted Answer

Qualitative risk analysis. A 5x5 heat map is a qualitative risk analysis technique that uses ordinal scales for likelihood and impact to derive risk ratings.

Answer

Quantitative risk analysis

Answer

Hybrid risk analysis

Answer

Semi-quantitative risk analysis

Question 9

A risk manager is reviewing the control monitoring reports and finds that a key control's effectiveness rating has dropped from 'effective' to 'partially effective' due to increased errors in manual data entry. Which of the following is the BEST course of action?

Accepted Answer

Conduct a root cause analysis to identify why errors increased.. A root cause analysis (RCA) is the best course of action because it systematically identifies the underlying reasons for the increased manual data entry errors, such as inadequate training, unclear procedures, or system interface issues. Without understanding the root cause, any corrective action (like automation or additional staff) may address symptoms rather than the actual problem, leading to wasted resources or recurring control failures. This aligns with the CRISC principle that control effectiveness must be restored by addressing the fundamental cause of degradation, not just the symptoms.

Answer

Immediately implement an automated data entry solution.

Answer

Increase the frequency of monitoring to detect errors sooner.

Answer

Assign additional staff to double-check data entries.

Question 10

During an IT risk assessment, the risk owner identifies a high inherent risk for a legacy system. After implementing a firewall and intrusion detection system, the residual risk is calculated. Which of the following best describes residual risk?

Accepted Answer

The risk level after considering control effectiveness. Residual risk is the level of risk that remains after controls have been implemented and their effectiveness has been factored in. In this scenario, the firewall and intrusion detection system are controls that reduce the inherent risk, but some risk (e.g., from zero-day exploits or misconfigurations) will persist, which is the residual risk.

Answer

The risk level before any controls are implemented

Answer

The risk that is transferred to a third party

Answer

The risk that is accepted without action

Question 11

An organization uses a qualitative risk assessment methodology. During a recent assessment, several risks were rated as 'high' due to vague definitions. What is the BEST way to improve the accuracy of the assessment?

Accepted Answer

Define clear and objective rating criteria for likelihood and impact. Vague rating criteria lead to inconsistent and subjective risk scores. By defining clear and objective rating criteria for likelihood and impact, the organization ensures that all assessors apply the same standards, reducing ambiguity and improving the accuracy of the qualitative assessment.

Answer

Switch to a quantitative methodology

Answer

Assign a single expert to rate all risks

Answer

Use historical loss data as the primary input

Question 12

A manufacturing company's board of directors receives a monthly risk report. Which key performance indicator (KPI) is MOST relevant for the board to assess the effectiveness of internal controls?

Accepted Answer

Percentage of control tests passed within the reporting period.. The percentage of control tests passed within the reporting period directly measures the operational effectiveness of internal controls, which is the board's primary concern for risk mitigation. This KPI provides a quantifiable, trendable metric that reflects whether controls are functioning as designed to reduce residual risk to an acceptable level.

Answer

Number of audit findings per business unit.

Answer

Number of risk assessments completed this month.

Answer

Percentage of employees completing annual compliance training.

Question 13

A risk manager is assessing the impact of quantum computing on the organization's cryptographic infrastructure. The timeline for quantum advantage is estimated to be 10 years. What is the most appropriate immediate action to address this risk?

Accepted Answer

Begin post-quantum cryptography migration planning and crypto-agility assessment. Beginning post-quantum cryptography (PQC) migration planning and crypto-agility assessment is the most appropriate immediate action because it addresses the long-term risk without premature disruption. Crypto-agility ensures systems can quickly switch algorithms, and planning allows for a smooth transition as standards mature. This proactive approach aligns with risk management principles.

Answer

Increase key lengths for all symmetric encryption to 256 bits

Answer

Ignore the risk until quantum computers are commercially available

Answer

Replace all existing cryptographic algorithms with post-quantum algorithms immediately

Question 14

In a qualitative risk assessment using a 5x5 heat map, an IT risk is rated with likelihood 4 and impact 5. According to typical heat map conventions (5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational), what is the overall risk rating?

Accepted Answer

Critical. In a typical 5x5 risk heat map, the overall risk rating is determined by the intersection of likelihood and impact values. With likelihood 4 and impact 5, the cell falls in the 'Critical' zone (commonly defined as likelihood 4-5 and impact 4-5). This aligns with the convention where 5=Critical, 4=High, 3=Medium, 2=Low, 1=Informational, making D the correct answer.

Answer

Low

Answer

Medium

Answer

High

Question 15

An organization is evaluating cyber insurance to mitigate financial risk from potential data breaches. Which factor would most likely increase the insurance premium?

Accepted Answer

History of previous security incidents. A history of previous security incidents most likely increases the insurance premium because it indicates a higher risk profile to the insurer. Insurers assess past claims and incident frequency as a key factor in determining the likelihood of future breaches, leading to higher premiums or even denial of coverage.

Answer

Implementation of multi-factor authentication

Answer

Adoption of a cybersecurity framework

Answer

Regular penetration testing