CRISC Practice Test 34 — 15 Questions

Question 1

Which risk treatment option involves formally acknowledging the risk and taking no further action, provided the risk is within the organization's risk appetite?

Accepted Answer

Accept. Risk acceptance is the treatment option where the organization formally acknowledges a risk and decides to take no action because the risk falls within its defined risk appetite. It is a deliberate, documented decision — not neglect — and typically requires management sign-off. This matches the question's description exactly.

Answer

Avoid

Answer

Transfer

Answer

Mitigate

Question 2

A risk assessment that assigns monetary values to assets and calculates expected loss is called:

Accepted Answer

Quantitative. A quantitative risk assessment assigns specific monetary values to assets and calculates expected loss using formulas such as Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF), and Annualized Loss Expectancy (ALE) = SLE × Annualized Rate of Occurrence (ARO). This approach provides objective, numeric risk metrics that support cost-benefit analysis for risk mitigation decisions.

Answer

Qualitative

Answer

Semi-quantitative

Answer

Comprehensive

Question 3

An incident occurs due to a control that was thought to be automated but was actually manual. The risk register did not reflect this. What is the MOST likely root cause?

Accepted Answer

Insufficient control monitoring and verification. The core issue is that the control was believed to be automated but was actually manual, and this discrepancy was not captured in the risk register. This indicates a failure in the ongoing process of verifying that controls are operating as designed, which is the essence of control monitoring and verification. Without periodic testing or validation, the organization cannot confirm the control's effectiveness or its true nature, leading to an inaccurate risk posture.

Answer

Inadequate risk assessment methodology

Answer

Poorly designed controls

Answer

Lack of management support for risk management

Question 4

A risk practitioner is designing a monitoring dashboard for operational risk. Which of the following is the most important consideration?

Accepted Answer

Tailor the information to the needs of the target audience.. The primary goal of a monitoring dashboard is to enable effective decision-making. Tailoring information to the target audience ensures that stakeholders receive relevant, actionable data, reducing cognitive load and preventing alert fatigue. Without this alignment, even the most technically sophisticated dashboard fails its core purpose of supporting risk-informed decisions.

Answer

Automate the generation of reports.

Answer

Use real-time data feeds.

Answer

Include all available risk indicators.

Question 5

In IT risk reporting, which level of management typically receives operational risk reporting on a weekly or monthly basis?

Accepted Answer

IT management. IT management is the level that typically receives operational risk reporting on a weekly or monthly cadence because they own the day-to-day operation of systems and controls. Operational risk reports at this frequency give IT managers the detail needed to act on incidents, vulnerabilities, and control gaps. Higher-level audiences receive more aggregated and less frequent reporting.

Answer

External auditors

Answer

Board of directors

Answer

CISO/CIO

Question 6

A control owner reports that a preventive control is operating as designed, but the risk owner is concerned that residual risk remains high. What should the risk practitioner do NEXT?

Accepted Answer

Perform a control effectiveness test to validate the control.. The risk practitioner must first validate the control's effectiveness before taking any further action. Even though the control owner reports the preventive control is operating as designed, the risk owner's concern about high residual risk suggests the control may not be adequately mitigating the risk. Performing a control effectiveness test (D) provides objective evidence to determine whether the control is actually reducing risk to an acceptable level, which is the necessary next step before updating the risk register, recommending compensating controls, or escalating.

Answer

Update the risk register to reflect the high residual risk.

Answer

Recommend additional compensating controls.

Answer

Escalate the issue to the risk committee.

Question 7

An organization uses a risk register that includes inherent risk, control effectiveness, and residual risk. During a quarterly review, the risk owner updates control effectiveness from 'partially effective' to 'effective'. What effect does this have on the residual risk rating?

Accepted Answer

Residual risk decreases. When control effectiveness is updated from 'partially effective' to 'effective', the control is now better at mitigating the inherent risk. Since residual risk is calculated as inherent risk minus the risk reduction provided by controls, improving control effectiveness directly lowers the residual risk rating. The risk register reflects this by showing a decreased residual risk value, assuming inherent risk remains unchanged.

Answer

Inherent risk changes

Answer

Residual risk increases

Answer

Residual risk remains unchanged

Question 8

A Key Control Indicator (KCI) for a firewall rule review process shows an exception rate of 15% for the past quarter, exceeding the acceptable threshold of 10%. What is the most appropriate immediate action for the control owner?

Accepted Answer

Investigate the root cause of the high exception rate. A KCI exception rate exceeding the threshold indicates a process failure, not necessarily a control failure. The control owner must first perform root cause analysis to determine whether the exceptions are due to misconfigured rules, policy violations, or environmental changes before taking corrective action. This aligns with the CRISC principle that control owners are responsible for monitoring and improving control effectiveness through investigation.

Answer

Increase the acceptable threshold to 20%

Answer

Replace the control with a different one

Answer

Escalate to the board immediately

Question 9

An organization is considering moving from periodic control testing to continuous monitoring for its critical financial controls. What is the PRIMARY benefit of this transition?

Accepted Answer

Faster identification of control failures.. Continuous monitoring provides real-time or near-real-time visibility into control performance, enabling the organization to detect control failures as soon as they occur. This is a primary benefit over periodic testing, which only identifies failures at discrete intervals, potentially allowing issues to persist undetected for longer periods.

Answer

Simplification of the control environment.

Answer

Reduction in monitoring costs.

Answer

Elimination of all control failures.

Question 10

When prioritizing risk treatment actions, which factor is most important to consider alongside the risk level?

Accepted Answer

Cost-benefit analysis of controls. Risk treatment prioritization must balance the cost of controls against the expected reduction in risk. A cost-benefit analysis ensures that the selected controls provide a net positive value, preventing over-investment in low-impact risks or under-investment in high-impact ones. This aligns with the ISACA Risk IT Framework, which emphasizes that risk treatment decisions should be economically justified.

Answer

Number of stakeholders involved

Answer

Regulatory requirements only

Answer

Time required to implement controls

Question 11

A multinational corporation is assessing the risk of a new cloud-based customer relationship management (CRM) system. The risk manager conducts a qualitative risk assessment using a risk matrix that plots likelihood vs. impact. Which of the following is the PRIMARY benefit of using a qualitative approach over a quantitative approach in this context?

Accepted Answer

It reduces the time required for data collection and analysis.. In a qualitative risk assessment, the risk manager uses subjective ratings (e.g., high, medium, low) for likelihood and impact rather than gathering hard financial data. This approach significantly reduces the time and effort needed for data collection and analysis because it avoids the complex calculations, historical loss data gathering, and monetary valuation required by quantitative methods. For a new cloud-based CRM system, where historical incident data may be scarce, qualitative assessment enables a faster initial risk evaluation.

Answer

It provides precise monetary values for risk exposure.

Answer

It allows for easy comparison of risks across different business units.

Answer

It eliminates the need for expert judgment.

Question 12

A risk practitioner is identifying risks related to a new API gateway implementation. Which TWO of the following are MOST likely to be significant risks?

Accepted Answer

Insufficient logging of API requests.. Option A is correct because an API gateway is a central enforcement and audit point, and insufficient logging of API requests removes the visibility needed to detect abuse, trace incidents, and meet monitoring/compliance requirements, making it a significant risk. Option C is correct because insecure direct object references (IDOR) let an authenticated caller manipulate object identifiers to access resources or data belonging to other users, a common and high-impact API authorization flaw that a gateway implementation must address. The unmarked options are less significant here: lack of scalability (B) is primarily a performance/availability engineering concern rather than a core risk-identification finding, outdated programming language (D) is a generic technical-debt issue not specific to the API gateway scenario, and high licensing cost (E) is a financial/commercial consideration, not a security or operational risk of the gateway itself.

Answer

Lack of scalability for peak loads.

Answer

Use of outdated programming language.

Answer

High licensing cost.

Question 13

A retail company uses a third-party vendor for payment processing. The vendor's service level agreement (SLA) requires 99.9% uptime. Recently, there were two incidents of downtime totaling 0.2% in a month, still within the SLA. However, the company's internal risk monitoring detected a pattern of increasing minor incidents. The vendor insists the SLA is met. The risk manager must decide on monitoring and reporting. The company's board wants to understand the risk. What is the best course of action?

Accepted Answer

Request a root cause analysis from the vendor and monitor trend more closely, reporting to board if trend worsens.. Even though the SLA is technically met, the emerging pattern of minor incidents is a leading indicator of rising operational risk, so the risk manager should request a root cause analysis and tighten monitoring, escalating to the board only if the trend worsens. This balances contractual reality (SLA not breached) with proactive risk management (trend detection). It also gives the board meaningful, evidence-based information rather than alarmist or premature action.

Answer

Terminate the vendor contract.

Answer

Increase the SLA penalty.

Answer

Accept the vendor's assurance as SLA is met.

Question 14

Refer to the exhibit. What is the most appropriate immediate action for the control failure?

Accepted Answer

Investigate the root cause of the failure because it occurred before the pass.. The most appropriate immediate action for a control failure is to investigate the root cause, regardless of a subsequent pass. A control failure indicates a breakdown in the control environment that could recur or have other implications. The fact that a later test passed does not negate the need to understand why the failure occurred, as it may point to systemic issues, process gaps, or human error that require corrective action. Immediate investigation aligns with risk management principles of identifying and addressing root causes to prevent future failures.

Answer

Ignore as it was followed by a pass.

Answer

Escalate to the board.

Answer

Accept the control failure due to subsequent pass.

Question 15

A risk manager is using the FAIR model to quantify cyber risk. Which of the following inputs is MOST directly used to calculate probable financial loss?

Accepted Answer

Loss event frequency and loss magnitude. The FAIR (Factor Analysis of Information Risk) model calculates probable financial loss by combining Loss Event Frequency (LEF)—how often a threat event occurs—with Loss Magnitude (LM)—how much each event costs. These two factors are the core inputs to FAIR's risk quantification, producing a loss distribution rather than a single point estimate. This makes option B the most direct input pair.

Answer

Annualized loss expectancy (ALE)

Answer

Vulnerability severity scores (CVSS)

Answer

Number of security incidents per year