CRISC Practice Test 35 — 15 Questions

Question 1

Which of the following is the most appropriate frequency for operational IT risk reporting to IT management?

Accepted Answer

Weekly or monthly. Operational risk reporting is typically provided on a weekly or monthly basis to IT management to support day-to-day decision-making.

Answer

Annually

Answer

Quarterly

Answer

Semi-annually

Question 2

A risk assessment reveals that a legacy system has a high vulnerability score but low business criticality. The cost to remediate is high. What is the MOST appropriate risk response?

Accepted Answer

Accept the risk and monitor it. When a vulnerability is high-scoring but the affected system has low business criticality and remediation cost is high, the risk to the organization is low in business-impact terms. The most appropriate response is to accept the risk and monitor it, since the cost of remediation outweighs the potential business impact. Risk acceptance with ongoing monitoring is a legitimate CRISC-aligned response when residual risk is within tolerance.

Answer

Avoid the risk by decommissioning the system

Answer

Mitigate the vulnerability with a patch

Answer

Transfer the risk via a managed security service

Question 3

A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?

Accepted Answer

Avoid by terminating the contract. The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.

Answer

Mitigate by reducing data shared

Answer

Transfer via insurance

Answer

Accept the risk and monitor

Question 4

During the risk identification process, an IT risk universe is defined. Which of the following BEST describes the purpose of an IT risk universe?

Accepted Answer

A comprehensive inventory of all potential IT risks facing the organization. An IT risk universe is a comprehensive inventory of all potential IT risks facing the organization — it is the master list from which risk assessments, prioritization, and treatment decisions are drawn. It defines the scope of what the organization considers 'in scope' for IT risk management, ensuring no material risk category is overlooked. It is not limited to vulnerabilities, incidents, or a single categorization scheme.

Answer

A list of all known vulnerabilities in the organization's IT systems

Answer

A database of past security incidents and their root causes

Answer

A framework for categorizing risks into strategic, operational, financial, and compliance

Question 5

A financial institution is migrating its core banking system from an on-premises data center to a public cloud infrastructure. The migration is planned in phases over 18 months. The IT risk manager is tasked with identifying risks during the transition. During the first phase, the team moves non-critical applications to the cloud. A vulnerability assessment of the cloud environment reveals that several virtual machines have default administrative credentials enabled. Additionally, the cloud security group configuration for the application tier allows inbound SSH from the entire internet (0.0.0.0/0). The risk manager also learns that the cloud provider's shared responsibility model is not fully understood by the operations team, who believe the provider is responsible for all security controls. The institution's risk appetite statement allows for moderate risk tolerance but prohibits any exposure that could lead to unauthorized access to customer financial data. Which of the following risk scenarios should the risk manager identify as the MOST critical to address immediately?

Accepted Answer

Default credentials on virtual machines combined with unrestricted inbound SSH from the internet. Default administrative credentials combined with SSH exposed to 0.0.0.0/0 creates an immediate, exploitable path to unauthorized access — the exact scenario the risk appetite statement prohibits. This is a live vulnerability with a known attack vector (credential stuffing/brute force from any internet host), so it must be remediated before anything else. The other issues are governance or process concerns that elevate risk over time but do not represent an active exposure to customer financial data.

Answer

The operations team's misunderstanding of the shared responsibility model

Answer

The cloud provider may not have adequate security controls for the institution's data

Answer

The phased migration introduces complexity that may cause configuration drift

Question 6

A financial institution is assessing the risk of a new real-time payment system. The risk manager calculates that the annualized loss expectancy (ALE) for a potential fraud scenario is $500,000. The cost to implement a fraud detection solution is $200,000 initially with $50,000 annual maintenance. The solution is expected to reduce the ALE by 80%. What is the net benefit of implementing the solution over three years?

Accepted Answer

$850,000. The net benefit over three years is calculated as the reduction in ALE minus the total cost of the solution. The original ALE is $500,000 per year, and an 80% reduction saves $400,000 annually. Over three years, total savings are $1,200,000. The total cost includes the initial $200,000 plus three years of maintenance at $50,000 each ($150,000), totaling $350,000. Net benefit = $1,200,000 - $350,000 = $850,000.

Answer

$1,000,000

Answer

$950,000

Answer

$800,000

Question 7

An IT manager is identifying risks for a new cloud application. Which of the following is the BEST source for identifying specific threats relevant to cloud services?

Accepted Answer

Industry threat reports. Industry threat reports (Option D) are the BEST source because they aggregate real-world threat intelligence specific to cloud environments, such as data from the Cloud Security Alliance (CSA) or Verizon DBIR, detailing attack vectors like misconfigured APIs, insecure interfaces, and shared technology vulnerabilities. Unlike internal or vendor sources, these reports provide empirical, up-to-date data on threats actively targeting cloud services, enabling a risk assessment grounded in actual incident patterns rather than assumptions or marketing claims.

Answer

Employee suggestions

Answer

Internal audit findings

Answer

Vendor marketing materials

Question 8

When performing a risk assessment, which TWO of the following are components of inherent risk?

Accepted Answer

Impact of the risk event. Inherent risk considers likelihood and impact without controls.

Answer

Residual risk level

Answer

Control effectiveness

Answer

Cost-benefit analysis of controls

Question 9

A company is conducting a risk assessment of a critical third-party service provider. Which of the following is the BEST source of information to identify risks associated with the provider's sub-processors?

Accepted Answer

The provider's documented vendor risk management program and audit reports of sub-processors. The provider's documented vendor risk management program and audit reports of sub-processors are the best source because they directly detail the controls, security posture, and compliance status of the sub-processors. This information is specific to the sub-processors' operations, unlike general reports or contracts that may not cover their unique risks. It enables the company to assess third-party and fourth-party risks as part of a comprehensive IT risk identification process.

Answer

Service level agreements in the contract

Answer

SOC 2 Type II reports of the primary provider

Answer

Public announcements of data breaches involving the provider

Question 10

An organization is implementing a new cloud-based CRM system. The risk manager is reviewing the solution architecture for security risks. Which architectural layer should be evaluated to ensure data encryption at rest and in transit?

Accepted Answer

Data architecture. Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

Answer

Application architecture

Answer

Infrastructure architecture

Answer

Business architecture

Question 11

In the FAIR model, 'Loss Event Frequency' is calculated as:

Accepted Answer

Threat Event Frequency × Vulnerability. In the FAIR model, Loss Event Frequency (LEF) is the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This represents how often a threat agent successfully exploits a weakness, making option B correct. The formula is LEF = TEF × Vuln, where Vulnerability is the probability that a threat event will result in a loss.

Answer

Threat Event Frequency × Asset Value

Answer

Threat Event Frequency × Loss Magnitude

Answer

Annualized Rate of Occurrence × Single Loss Expectancy

Question 12

In the FAIR model, which component represents the probable frequency, within a given timeframe, that a threat agent will act against an asset?

Accepted Answer

Threat Event Frequency (TEF). In the FAIR model, Threat Event Frequency (TEF) is the component that estimates how often, within a given timeframe, a threat agent (such as a hacker or malware) will initiate an action against an asset. This directly matches the question's definition of 'probable frequency that a threat agent will act against an asset.' TEF is a primary input for calculating Loss Event Frequency (LEF) and ultimately risk.

Answer

Vulnerability

Answer

Loss Event Frequency (LEF)

Answer

Annualized Rate of Occurrence (ARO)

Question 13

A large financial institution has implemented a risk monitoring framework that includes KRIs for operational risk. Recently, a critical KRI related to trade settlement errors has been showing an upward trend, but it remains within the approved threshold. The risk manager is concerned because the trend indicates potential control degradation. The control owner argues that since the KRI is still within threshold, no action is needed. The risk manager wants to determine the best course of action to address the trend before it breaches the threshold. The organization's risk policy requires proactive monitoring. What should the risk manager do?

Accepted Answer

Conduct a detailed analysis to understand the root cause and consider adjusting the threshold or implementing control enhancements.. The KRI is still within threshold, but the upward trend signals potential control degradation, and the risk policy mandates proactive monitoring. A detailed root-cause analysis is the appropriate first step to understand why settlement errors are rising, and then the risk manager can decide whether to adjust the threshold or enhance controls. This balances the control owner's point (no breach yet) with the risk manager's duty to act on leading indicators.

Answer

Implement additional controls immediately.

Answer

Report the trend to the audit committee.

Answer

Update the threshold to reflect the new normal.

Question 14

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A leading indicator predicts future risk before loss occurs. A spike in failed authentication attempts is a precursor signal — it suggests credential stuffing, brute-force, or password-spraying activity is underway, which may precede a successful credential-based compromise. Because it is observable before the breach materializes, it functions as a leading indicator that the risk of credential-based attack is increasing.

Answer

Number of accounts created

Answer

Password reset frequency

Answer

Number of successful logins

Question 15

An organization is designing a risk dashboard for senior management. Which of the following is the MOST important characteristic of the key risk indicators (KRIs) displayed?

Accepted Answer

They are directly linked to the risk appetite thresholds.. For a risk dashboard designed for senior management, the most important characteristic of KRIs is that they are directly linked to risk appetite thresholds. This linkage ensures that the dashboard provides actionable insights by immediately signaling when risk levels exceed or approach the organization's defined tolerance limits, enabling timely decision-making. Without this direct connection, even real-time or accurate data would fail to convey whether the organization is operating within acceptable risk boundaries.

Answer

They are updated in real-time.

Answer

They are based on accurate historical data.

Answer

They are cost-effective to collect and maintain.