CRISC Practice Test 35 — 15 Questions

Question 1

A large bank has implemented a sophisticated risk and control monitoring system with multiple dashboards and automated reporting for key risk indicators (KRIs). However, the board of directors has been receiving conflicting KRI reports from different business units (e.g., retail banking, corporate lending, and wealth management). For example, the fraud KRI shows a high risk in retail but low risk in wealth management, yet both units use the same underlying data source. The chief risk officer (CRO) is concerned that the board is losing confidence in the risk reporting. An investigation reveals that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. What is the most likely root cause and the best remediation?

Accepted Answer

The KRI definitions and calculation methods are not standardized across business units.. The root cause is that KRI definitions are not standardized across business units, causing inconsistent reporting. Standardizing KRI definitions and calculation methods ensures comparability. Options A (data sources) is not the issue since they use the same source; B (board interpretation) is secondary; C (reporting frequency) is not the core problem.

Answer

The reporting frequency is inadequate; monthly reports should be weekly.

Answer

The data sources for KRIs are inconsistent across business units.

Answer

The board members are misinterpreting the KRI reports due to lack of training.

Question 2

A manufacturing company uses Internet of Things (IoT) sensors to monitor equipment temperature and vibration on the production floor. The sensor data is automatically sent to a central system, but there is a manual log maintained by operators that records their visual inspections. Recently, there have been instances where the sensor data indicated abnormal readings, but the operator logs showed normal conditions, leading to delayed maintenance actions and two equipment breakdowns. The risk manager investigates and finds that operators sometimes forget to update logs or misinterpret sensor alerts. The company wants to improve the reliability of the monitoring process. What should be the primary action?

Accepted Answer

Implement automated reconciliation between sensor data and operator logs, flagging discrepancies in real time.. Automated reconciliation between sensor data and operator logs would highlight discrepancies immediately, allowing quick investigation. Replacing all sensors (A) is costly and not focused; training (C) alone may not overcome human error; reducing sensor reliance (D) ignores the value of automated alerts.

Answer

Reduce reliance on IoT sensors and increase manual inspections.

Answer

Replace all IoT sensors with newer models that have better accuracy.

Answer

Provide additional training to operators on how to accurately fill in logs and respond to sensor alerts.

Question 3

A university's IT department is implementing a single sign-on (SSO) solution for students and faculty. The solution will integrate with existing Active Directory and a cloud-based learning management system (LMS). During risk identification, the team learns that the SSO vendor had a minor security incident last year. The university's security policy requires multi-factor authentication (MFA) for all administrative access, but the SSO solution does not support MFA for student accounts. The project manager insists that MFA for students is not necessary because they only access academic records. The risk team must identify the most significant risk that could affect the university's reputation. Which risk should be documented?

Accepted Answer

Without MFA, student accounts could be compromised to access sensitive academic data.. The most significant reputational risk is that without MFA, student accounts are vulnerable to credential theft or brute-force attacks. If an attacker compromises a student account, they could access sensitive academic records (e.g., grades, personal data) protected under FERPA, leading to data breaches, legal penalties, and loss of public trust. The SSO vendor's past incident is less relevant because it was minor and does not directly expose the university's data.

Answer

SSO vendor's historical security incident could impact service availability.

Answer

Students may share passwords, leading to account compromise.

Answer

Lack of MFA for administrative accounts could allow unauthorized changes.

Question 4

A small manufacturing company is conducting its first IT risk assessment. The company has a flat network with no segmentation, and all employees have administrative access to their workstations. The risk practitioner identifies that a malware infection on one workstation could easily spread to the entire network. The company has a limited budget for IT security improvements. Which of the following risk treatment options is MOST cost-effective and practical?

Accepted Answer

Deploy endpoint protection software on all workstations and restrict administrative rights for users.. Option B is the most cost-effective and practical because deploying endpoint protection software provides immediate defense against known malware, while restricting administrative rights prevents users from installing unauthorized software or making system changes that could introduce malware. This combination directly addresses the root cause of the risk—unrestricted user privileges and lack of basic malware defenses—without requiring expensive network redesign or ongoing insurance premiums.

Answer

Accept the risk because the company's data is not highly sensitive.

Answer

Implement network segmentation and a next-generation firewall.

Answer

Purchase cyber insurance to cover potential losses.

Question 5

A government agency is migrating its critical applications to a public cloud infrastructure. The risk assessment reveals that the cloud provider uses shared tenancy, and the agency's sensitive data will be stored alongside other customers' data. The agency has a very low risk appetite for data leakage and must comply with strict data sovereignty laws. The cloud provider offers data encryption at rest and in transit, as well as dedicated hardware security modules (HSMs) for key management. However, the provider's physical datacenters are located in another country with different legal frameworks. As the risk practitioner, which of the following should be the PRIMARY risk response?

Accepted Answer

Avoid the risk by keeping sensitive data on-premises and using the cloud only for non-sensitive workloads.. Option A is correct because the agency's very low risk appetite for data leakage and strict data sovereignty laws cannot be adequately mitigated by encryption or contractual measures when the physical datacenters are in a foreign jurisdiction with different legal frameworks. Shared tenancy in a public cloud inherently increases the attack surface for side-channel attacks and misconfiguration risks, and even with encryption at rest (e.g., AES-256) and in transit (e.g., TLS 1.3), the cloud provider's staff or foreign legal authorities could potentially access decryption keys or compel key disclosure. Avoiding the risk by keeping sensitive data on-premises eliminates the exposure to foreign legal frameworks and shared tenancy, directly aligning with the agency's risk appetite.

Answer

Reduce the risk by negotiating a contract that includes specific data handling clauses and audit rights.

Answer

Transfer the risk by requiring the provider to maintain a large cyber insurance policy.

Answer

Accept the risk after verifying the provider's compliance certifications.

Question 6

A university is implementing a new online learning management system (LMS) that will store student records, grades, and personal information. During the risk assessment, the IT team identifies that the LMS vendor's default configuration allows students to see each other's email addresses in the class roster. This could lead to privacy violations under FERPA regulations. The vendor states that this feature can be disabled in the settings but doing so will require manual configuration for each course. The university has a moderate risk appetite and wants to launch the system within two weeks. Which of the following is the MOST appropriate risk response?

Accepted Answer

Reduce the risk by disabling the feature globally through a script or administrative override before launch.. Option C is the most appropriate risk response because it reduces the privacy risk by disabling the email visibility feature globally via a script or administrative override, aligning with the university's moderate risk appetite and two-week launch deadline. This approach directly addresses the FERPA violation without requiring manual per-course configuration, enabling a timely deployment while maintaining control over student data exposure.

Answer

Transfer the risk by requiring students to sign a consent form allowing email disclosure.

Answer

Avoid the risk by selecting a different LMS vendor that does not have this issue.

Answer

Accept the risk because the exposure is limited to email addresses and not grades.

Question 7

A multinational corporation is conducting a risk assessment for its new online payment platform. The platform processes transactions in multiple currencies and stores sensitive customer financial data. The risk team has identified that the encryption algorithm used for data at rest is outdated and could be vulnerable to advanced attacks. The company's risk appetite is low for data breaches. The security team recommends upgrading the encryption to a modern standard, but the upgrade will require a 48-hour downtime impacting all global transactions. The business unit is concerned about revenue loss during the downtime. As the risk practitioner, what is the BEST course of action to balance security and business continuity?

Accepted Answer

Plan the upgrade during a low-traffic period and implement compensating controls such as additional monitoring during the downtime.. Option B is the best course of action because it balances the need to mitigate a high-risk encryption vulnerability with business continuity. By scheduling the upgrade during a low-traffic period and implementing compensating controls (e.g., enhanced monitoring and intrusion detection), the organization reduces the likelihood of exploitation during the 48-hour downtime while minimizing revenue loss. This aligns with the low risk appetite for data breaches and demonstrates a risk-based decision that treats the vulnerability without accepting unacceptable exposure.

Answer

Accept the risk and delay the upgrade until the next scheduled maintenance window in three months.

Answer

Outsource the payment processing to a third-party vendor that already uses modern encryption.

Answer

Implement the upgrade immediately to mitigate the vulnerability, accepting the revenue loss.

Question 8

A financial institution is migrating its core banking system from an on-premises data center to a public cloud infrastructure. The migration is planned in phases over 18 months. The IT risk manager is tasked with identifying risks during the transition. During the first phase, the team moves non-critical applications to the cloud. A vulnerability assessment of the cloud environment reveals that several virtual machines have default administrative credentials enabled. Additionally, the cloud security group configuration for the application tier allows inbound SSH from the entire internet (0.0.0.0/0). The risk manager also learns that the cloud provider's shared responsibility model is not fully understood by the operations team, who believe the provider is responsible for all security controls. The institution's risk appetite statement allows for moderate risk tolerance but prohibits any exposure that could lead to unauthorized access to customer financial data. Which of the following risk scenarios should the risk manager identify as the MOST critical to address immediately?

Accepted Answer

Default credentials on virtual machines combined with unrestricted inbound SSH from the internet. Correct: C. The combination of default credentials and open SSH access creates an immediate and exploitable vulnerability that could lead to unauthorized access to the application tier, potentially compromising customer data. This directly violates the risk appetite. A is a general issue but less immediate. B is important but not as critical as C. D is correct but not the most immediate.

Answer

The operations team's misunderstanding of the shared responsibility model

Answer

The cloud provider may not have adequate security controls for the institution's data

Answer

The phased migration introduces complexity that may cause configuration drift

Question 9

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

Accepted Answer

Implement automated real-time monitoring of critical configuration changes with alerts.. Option B is correct because implementing real-time monitoring of critical configuration changes would have detected the misconfiguration immediately, preventing the extended downtime. Option A is wrong because while increasing change management oversight is important, it does not directly improve monitoring of the configuration itself. Option C is wrong because user awareness training does not address the configuration change issue. Option D is wrong because quarterly access reviews are too infrequent to catch unauthorized changes in a timely manner.

Answer

Require all change requests to be approved by the change advisory board (CAB).

Answer

Increase the frequency of access reviews to monthly.

Answer

Provide additional training to cloud administrators on security policies.

Question 10

A multinational corporation operates in 15 countries with decentralized control monitoring systems. Each regional office uses different tools and processes for monitoring operational risks. The corporate risk team has consolidated quarterly reports, but the board recently raised concerns about inconsistencies and late identification of emerging risks. A root cause analysis revealed that regional monitoring teams define key risk indicators (KRIs) differently and report on different timeframes. Additionally, there is no centralized platform to aggregate data. The risk manager must recommend a solution that balances local autonomy with global visibility. Which option is the most effective?

Accepted Answer

Implement a centralized risk and control monitoring platform that aggregates data and enforces common reporting standards.. A centralized risk and control monitoring platform standardizes data and reporting while allowing local customization via configurable thresholds. Global standardization (A) might ignore local nuances; policy alone (C) doesn't enforce consistency; increasing meeting frequency (D) does not address data inconsistency.

Answer

Create a policy requiring regional risk teams to follow the same KRI definitions and reporting schedule.

Answer

Standardize monitoring tools across all regions globally.

Answer

Increase the frequency of board risk committee meetings to twice per month.

Question 11

A mid-sized retail company processes over 1 million credit card transactions daily. It uses an automated monitoring system with static thresholds to flag potential fraud. Recently, the fraud detection team has been overwhelmed by a 40% increase in false positive alerts, causing legitimate transactions to be delayed and customer service complaints to rise. The risk manager is tasked with improving the situation. After reviewing the alert logs, it is clear that the thresholds have not been updated in 18 months, and transaction patterns have shifted due to seasonal promotions and new payment methods. The team has limited resources and cannot handle the current alert volume. What should the risk manager recommend as the most effective course of action?

Accepted Answer

Perform a root cause analysis on the false positives to refine the detection rules and thresholds.. Performing root cause analysis to refine detection rules addresses the core issue of outdated thresholds causing false positives. Option A (increasing thresholds) might reduce alerts but could miss true positives. Option B (engaging consultants) is costly and not immediate. Option D (deploying more tools) adds complexity without fixing the root cause.

Answer

Deploy an additional monitoring tool with machine learning capabilities.

Answer

Engage an external fraud detection consultant to review the system.

Answer

Immediately increase the alert thresholds to reduce the volume of alerts.

Question 12

A healthcare organization is subject to strict regulatory requirements regarding patient data privacy. The organization has a control that requires all access to patient records to be logged and reviewed weekly by the compliance team. The review is currently performed manually by sampling 10% of the logs. The compliance team reports that the review takes 20 hours per week and they are often unable to complete it on time. As a result, some suspicious access patterns are detected weeks after they occur. The risk manager needs to propose an improvement to the monitoring process. The organization's risk appetite for undetected unauthorized access is very low. Which of the following is the MOST effective recommendation?

Accepted Answer

Deploy user behavior analytics (UBA) tools for automated anomaly detection.. Option B is correct because implementing user behavior analytics (UBA) automates the detection of anomalous access patterns, reducing manual effort and improving detection speed. Option A is wrong increasing sample size does not address the timeliness issue. Option C is wrong hiring more staff is costly and may not scale. Option D is wrong reducing frequency would delay detection further, increasing risk.

Answer

Reduce the review frequency to bi-weekly to free up time.

Answer

Hire additional staff to perform the manual reviews.

Answer

Increase the sample size to 50% of logs for better coverage.

Question 13

A healthcare organization operates a legacy electronic health record (EHR) system that is manually monitored for access anomalies by a small IT team. The organization is planning to migrate to a new cloud-based EHR with integrated logging and monitoring. However, due to budget constraints, the migration will take two years. In the interim, the risk manager wants to improve monitoring for unauthorized access to patient data. The current manual process involves weekly log reviews, but recent audits have identified instances of delayed detection (up to two weeks) and missed incidents. The IT team can dedicate only 10 additional hours per week for monitoring. What is the best approach to enhance monitoring during the transition period?

Accepted Answer

Use a phased risk-based approach, prioritizing monitoring of high-risk areas such as privileged accounts and sensitive patient data.. A phased approach focusing on high-risk areas (e.g., privileged accounts, sensitive data) optimizes limited resources. Full automation (A) is too costly; outsourcing (C) may have data privacy issues; accepting the state (D) is irresponsible given audit findings.

Answer

Outsource the monitoring to a third-party managed security service provider.

Answer

Implement a full automation suite for access monitoring immediately.

Answer

Accept the current monitoring state as adequate given the upcoming migration.

Question 14

A large financial institution has implemented a risk monitoring framework that includes KRIs for operational risk. Recently, a critical KRI related to trade settlement errors has been showing an upward trend, but it remains within the approved threshold. The risk manager is concerned because the trend indicates potential control degradation. The control owner argues that since the KRI is still within threshold, no action is needed. The risk manager wants to determine the best course of action to address the trend before it breaches the threshold. The organization's risk policy requires proactive monitoring. What should the risk manager do?

Accepted Answer

Conduct a detailed analysis to understand the root cause and consider adjusting the threshold or implementing control enhancements.. Proactive monitoring requires understanding the root cause of the trend and considering whether the threshold remains appropriate. Option C is correct. Option A adjusts the threshold without analysis, masking the issue. Option B implements controls without understanding. Option D reports to audit committee prematurely.

Answer

Implement additional controls immediately.

Answer

Report the trend to the audit committee.

Answer

Update the threshold to reflect the new normal.

Question 15

A retail company uses a manual control to verify that all credit card transactions are processed by authorized payment terminals. The control requires a store manager to compare a daily transaction log against a list of approved terminal IDs. The company processes an average of 10,000 transactions per day across 200 stores. During a recent internal audit, it was found that 15% of stores had not completed the reconciliation for the past month. The audit also revealed that several unauthorized terminals had been used to process transactions, resulting in a data breach of customer payment information. The company's risk appetite for payment card data security is very low. The current monitoring approach includes a quarterly review of control performance by the internal audit team. The risk manager needs to recommend improvements to the monitoring of this control. Which of the following is the BEST recommendation?

Accepted Answer

Automate the reconciliation by integrating the transaction log with the approved terminal list.. Option D is correct because automating the reconciliation process ensures it is performed consistently and promptly, eliminating the manual gaps. Option A is wrong increasing audit frequency does not prevent the control from being skipped. Option B is wrong disciplinary actions may motivate compliance but do not address the process inefficiency. Option C is wrong additional training may help but does not guarantee consistent performance.

Answer

Increase internal audit reviews of the control to monthly.

Answer

Implement disciplinary actions for store managers who skip reconciliations.

Answer

Provide refresher training to all store managers on the procedure.