CRISC Practice Test 36 — 15 Questions

Question 1

A small online retailer with 15 employees sells handmade crafts through its e-commerce website. The company processes payments via a third-party gateway. The owner manually reviews transaction logs once a week for fraud indicators, but recently discovered three chargebacks due to unauthorized transactions. The retailer has limited IT budget and no dedicated security staff. The owner wants to improve detection of fraudulent transactions without significant investment. The current manual process takes about two hours per week and often results in delayed detection. The payment gateway offers basic fraud detection features such as IP geolocation and velocity checks, but these are not enabled. What is the most practical first step?

Accepted Answer

Enable the built-in fraud detection features offered by the payment gateway.. Enabling existing fraud detection features in the payment gateway is quick, low-cost, and can immediately improve detection. Buying a new system (A) is expensive; hiring a staff (C) is not feasible; accepting the risk (D) is not acceptable given recent chargebacks.

Answer

Hire a part-time fraud analyst to review logs daily.

Answer

Purchase an automated fraud detection system from a third-party vendor.

Answer

Accept the current risk and set aside a reserve fund for chargebacks.

Question 2

A large financial services firm recently deployed a new security information and event management (SIEM) system to monitor thousands of servers, network devices, and applications. The system is generating over 1,000 alerts per hour, of which 80% are false positives. The security operations center (SOC) team is overwhelmed and has started ignoring all but the most critical alerts. As a result, a real attack recently went undetected for 48 hours. The risk manager is asked to recommend improvements. The SOC team has 12 analysts working in shifts. The SIEM is properly configured but the correlation rules are broad and noisy. The firm cannot add more staff due to budget freeze. What should the risk manager prioritize?

Accepted Answer

Tune the alerting rules and adopt risk-based prioritization to filter out known false positives.. Tuning alerting rules with risk-based prioritization reduces noise and ensures the SOC focuses on true positives. Disabling low-priority alerts (A) may cause missing important events; hiring (C) is not feasible; machine learning (D) is complex and still needs tuning.

Answer

Disable all low-priority alerts to reduce volume immediately.

Answer

Implement a machine learning algorithm to automatically classify alerts.

Answer

Request budget to hire five additional SOC analysts.

Question 3

A healthcare organization is migrating its electronic health records (EHR) system to a cloud provider. The risk assessment shows that the cloud provider has strong security certifications (e.g., SOC 2 Type II, ISO 27001). However, the organization's legal team is concerned about data sovereignty laws that require patient data to remain within the country. The cloud provider's data centers are located in three regions: one in-country, and two outside. The project manager proposes using only the in-country data center. The IT director warns that this will increase latency and reduce redundancy. The risk manager must propose a response. Which is the BEST option?

Accepted Answer

Configure the EHR system to store primary data in the in-country data center, and use the other two centers for disaster recovery with data residency controls ensuring data does not leave the country unless encrypted and with legal approval.. Option C is correct because it provides a balanced approach: use the in-country data center for primary storage to comply with data sovereignty, but use the other data centers for disaster recovery with data residency controls. Option A is wrong because using only one data center increases availability risk. Option B is wrong because direct cloud replication to outside centers violates data sovereignty. Option D is wrong because accepting the legal risk is unacceptable given the regulatory environment.

Answer

Accept the legal risk because the cloud provider's certifications are sufficient, and document the decision.

Answer

Use all three data centers with automatic failover, and rely on the cloud provider's contractual guarantees of data residency.

Answer

Use only the in-country data center and accept the increased availability risk.

Question 4

A financial institution is implementing a new online banking platform. The risk assessment identified that the platform will handle sensitive customer data and must comply with GDPR and local banking regulations. The project team proposes encrypting all data at rest and in transit, implementing multi-factor authentication (MFA), and conducting quarterly penetration tests. However, the risk owner is concerned about the residual risk of a sophisticated phishing attack that could bypass MFA. The board has a low risk appetite. What is the BEST way to address this residual risk?

Accepted Answer

Implement advanced phishing-resistant MFA (e.g., FIDO2) and conduct regular employee phishing simulation training.. Option B is correct because it addresses the specific residual risk with a targeted control (phishing simulations and training) without overcomplicating the project. Option A is wrong because purchasing insurance does not reduce the likelihood of an attack. Option C is wrong because accepting the risk conflicts with the board's low appetite. Option D is wrong because stopping the project is a disproportionate response to a manageable risk.

Answer

Purchase cyber insurance to transfer the financial impact of a potential phishing attack.

Answer

Reduce the project scope to exclude online banking and revert to a less risky channel.

Answer

Accept the residual risk because the existing controls (encryption, MFA, pen tests) already provide reasonable assurance.

Question 5

GlobalTech Inc., a multinational corporation, is planning to migrate its customer data to a new cloud platform. The migration involves transferring sensitive personally identifiable information (PII) from an on-premises database to a cloud-based CRM. The risk manager conducted a risk assessment and identified several risks, including unauthorized access during transit and residual data exposure due to misconfiguration. Mitigation controls include encryption in transit, encryption at rest, and strict access controls. The residual risk after mitigation is assessed as medium. The risk appetite statement defines that 'No data breach incidents resulting in regulatory fines exceeding $1 million are acceptable.' The estimated potential fine from a breach is $5 million with a likelihood of 2% after controls. The cost of additional controls to reduce likelihood to 0.5% is $500,000. The migrating team proposes to purchase cyber insurance with a $3 million coverage for $200,000 annual premium. The board of directors prefers to accept the residual risk to avoid additional costs. What should the risk manager do?

Accepted Answer

Advise the board to avoid the migration until all risks are eliminated.. Option D is correct because the potential fine of $5 million exceeds the appetite threshold of $1 million, making the risk unacceptable. The proposed controls and insurance do not reduce the impact below $1 million. Avoidance is the only option that fully aligns with the risk appetite. Options A, B, and C fail to bring the risk within appetite.

Answer

Recommend purchasing cyber insurance to transfer the risk.

Answer

Accept the board's decision since the residual risk is medium.

Answer

Recommend implementing additional controls to reduce likelihood to 0.5%.

Question 6

A small e-commerce company has identified a high-risk vulnerability in its payment processing system that could expose customer credit card data. The IT team recommends immediately patching the system, but the patch requires a 4-hour downtime during peak sales hours. The risk manager proposes accepting the risk until the next scheduled maintenance window in two weeks. The CEO is concerned about potential fines from PCI DSS non-compliance. What is the BEST course of action?

Accepted Answer

Implement a compensating control (e.g., web application firewall) and schedule the patch during off-peak hours within 48 hours.. Option C is correct because it balances the need to address PCI DSS compliance with business continuity. Implementing compensating controls reduces risk while avoiding peak-hour downtime. Option A is wrong because accepting risk ignores compliance obligations. Option B is wrong because it prioritizes compliance over business impact with excessive downtime. Option D is wrong because postponing until the next window leaves high risk unaddressed.

Answer

Delay the patch until the next maintenance window but document the risk acceptance with CEO sign-off.

Answer

Accept the risk and schedule the patch during the next maintenance window as originally planned.

Answer

Apply the patch immediately during peak hours, accepting the revenue loss from downtime.

Question 7

A regional bank uses a centralized GRC platform to monitor key risk indicators (KRIs) for operational risk. The chief risk officer (CRO) reviews the monthly risk report and notices that the KRI 'number of system outages exceeding 4 hours' has been consistently reported as 0 for the past six months. However, the IT incident log shows three such outages in the same period. The CRO suspects the KRI is not being accurately reported. What should the risk manager do next?

Accepted Answer

Investigate the KRI calculation and data feed to identify why outages are not being captured. The correct answer is C because the risk manager must first investigate the KRI calculation and data feed to determine why the IT incident log shows three outages but the KRI reports zero. Without understanding the root cause of the reporting discrepancy—whether it is a data integration error, a threshold misconfiguration, or a failure in the GRC platform's automated data collection—any subsequent action would be premature and could mask the underlying control monitoring failure.

Answer

Add additional controls to reduce the likelihood of system outages

Answer

Update the risk register to reflect the recent outage incidents

Answer

Increase the KRI threshold to 2 outages to align with historical data

Question 8

Your organization is undergoing a merger and acquisition. The IT risk assessment team is tasked with evaluating the target company's IT environment. During the assessment, you discover that the target company uses a legacy ERP system that is no longer supported by the vendor. They have no disaster recovery plan for this system, and it contains financial data critical to the merged entity. The integration timeline is aggressive, and replacing the system would delay the merger by 18 months. The executive team is reluctant to delay. What is the BEST risk treatment option?

Accepted Answer

Mitigate by developing a disaster recovery plan and implementing compensating controls such as regular backups and manual procedures.. Option C is correct because the legacy ERP system contains critical financial data and cannot be replaced without an 18-month delay, making risk mitigation the most practical approach. Developing a disaster recovery plan and implementing compensating controls (e.g., regular backups, manual procedures) reduces the likelihood and impact of a system failure while allowing the merger to proceed on schedule. This aligns with the CRISC principle of treating risk by reducing residual risk to an acceptable level without blocking business objectives.

Answer

Avoid the risk by excluding the legacy system from the merger and migrating data to a new system.

Answer

Accept the risk because the system has been running for years without issue.

Answer

Transfer the risk to the target company's previous owners.

Question 9

You are the risk manager for a healthcare provider. A risk assessment identified that patient data is transmitted over unencrypted connections between clinics and the data center. The existing controls include strong network perimeter defenses. The risk is rated as high. Management is concerned about the cost of implementing encryption. You have proposed a control that encrypts data in transit. However, the network team argues that the perimeter controls are sufficient. What is the MOST appropriate response?

Accepted Answer

Implement encryption as recommended because it addresses the vulnerability directly.. Option D is correct because encrypting data in transit directly addresses the vulnerability of unencrypted connections, which is the root cause of the high risk. Perimeter controls like firewalls and IDS/IPS do not protect the confidentiality of data once it leaves the protected network boundary, as they cannot prevent interception on the wire. Implementing encryption (e.g., TLS 1.2/1.3 or IPsec) ensures end-to-end confidentiality regardless of perimeter strength.

Answer

Transfer the risk to a third party by outsourcing data transmission.

Answer

Accept the risk because perimeter controls are in place.

Answer

Reduce the risk rating to medium since perimeter controls provide compensating security.

Question 10

A software development company uses a DevOps pipeline with automated code deployment. Recently, a developer accidentally pushed a configuration file containing database credentials to a public repository. The credentials were changed within an hour, but the file remained public for a few hours. The risk team is now identifying risks in the CI/CD process. The security team has proposed adding static code analysis to detect secrets in code. The development team objects, citing false positives. The risk manager must identify the most significant risk that could lead to a data breach. Which risk should be prioritized?

Accepted Answer

Lack of pre-commit hooks or automated scanning to prevent secrets from being committed.. Option C is correct because the root cause of the incident was the absence of automated, pre-commit scanning to detect secrets before they are pushed to a repository. Pre-commit hooks (e.g., using tools like git-secrets or Talisman) or server-side scanning (e.g., GitHub secret scanning) can block credentials from being committed in the first place, directly preventing exposure. Without this control, the CI/CD pipeline lacks a critical preventive layer, making data breaches more likely despite post-commit remediation.

Answer

Insufficient training on secure coding practices for developers.

Answer

Over-reliance on manual code reviews which are error-prone.

Answer

Inadequate incident response procedures for exposed credentials.

Question 11

A financial services company uses a legacy mainframe system for core banking transactions. The risk assessment identifies that the system does not support modern encryption standards, and data is transmitted in clear text over internal networks. The IT department has proposed implementing network segmentation and encryption at the application layer using a middleware solution. However, the cost is high and the project would take 18 months. Meanwhile, the company is planning to migrate to a new core system in two years. The risk appetite for data confidentiality is low. As the risk practitioner, what is the MOST appropriate risk response?

Accepted Answer

Implement compensating controls such as strict network access controls and monitoring.. The correct response is to implement compensating controls such as strict network access controls and monitoring. Given the low risk appetite for data confidentiality, the 18-month delay for the middleware solution is unacceptable, and the two-year migration timeline leaves a significant exposure window. Compensating controls like VLAN segmentation, ACLs, and continuous traffic monitoring can reduce the likelihood of exploitation of the clear-text transmission without requiring changes to the legacy mainframe itself.

Answer

Transfer the risk by purchasing cyber insurance covering data breach incidents.

Answer

Accept the risk because the system will be replaced in two years.

Answer

Avoid the risk by accelerating the migration to the new system within 18 months.

Question 12

A manufacturing company uses IoT sensors on the factory floor to monitor equipment performance. The sensors transmit data to a central server via Wi-Fi. During a risk identification workshop, the operations manager reveals that some sensors are operating on outdated firmware with known vulnerabilities. The IT director proposes replacing all sensors at a high cost. The risk team notes that a breach could cause production downtime but the sensors only collect non-sensitive operational data. The company has a low tolerance for downtime. What should the risk team identify as the most critical risk?

Accepted Answer

Operational disruption from a potential cyber attack exploiting sensor vulnerabilities.. The most critical risk is operational disruption from a cyber attack exploiting the known vulnerabilities in the outdated IoT sensor firmware. Since the company has a low tolerance for downtime, any breach that causes production stoppage directly impacts business continuity, outweighing the non-sensitive nature of the data collected. The sensors' Wi-Fi connectivity provides an attack surface for lateral movement or denial-of-service, making exploitation a high-probability, high-impact event.

Answer

Legal liability from non-compliance with safety standards.

Answer

Reputational damage from a data leak.

Answer

Financial loss from replacing sensors.

Question 13

A large healthcare organization is implementing a new electronic health record (EHR) system. During the risk identification process, the risk team discovers that the EHR vendor has a history of minor security incidents but has always resolved them quickly. The vendor’s data center is located in a region prone to earthquakes. Additionally, the EHR system will integrate with several legacy systems that have known vulnerabilities. The project sponsor is keen to proceed and believes the vendor is reputable. The risk team needs to ensure all relevant risks are identified and documented. Which of the following should be the PRIORITY for the risk team?

Accepted Answer

Conduct a detailed assessment of the vendor's business continuity and disaster recovery plans, especially regarding natural disasters.. The vendor's data center is in an earthquake-prone region, and the vendor has a history of minor security incidents. This creates a significant risk of service disruption that could impact patient safety and data availability. Prioritizing a detailed assessment of the vendor's business continuity and disaster recovery (BC/DR) plans ensures that the organization understands the vendor's ability to maintain operations and recover data in a disaster scenario, which is a fundamental risk identification activity before any mitigation or acceptance decisions.

Answer

Request the vendor to patch the legacy system vulnerabilities before integration.

Answer

Focus on contractual indemnification clauses to transfer risk.

Answer

Accept the residual risk after implementing basic controls.

Question 14

A mid-sized retail company operates 50 stores across three regions. Each store uses a point-of-sale (POS) system that transmits credit card transactions to a centralized payment processor. The company recently deployed a new SaaS-based inventory management application that connects to the POS system via API. The IT department has no formal process for tracking third-party connections. The risk manager suspects that unknown or unauthorized connections may exist. During a risk identification review, the risk manager discovers that the POS vendor's API documentation was shared with the inventory SaaS provider without a non-disclosure agreement (NDA). Additionally, the API keys for the POS system are stored in plain text configuration files on the inventory SaaS application server. The company's security policy requires encryption of all sensitive data in transit and at rest. Which of the following should the risk manager prioritize as the HIGHEST risk scenario to document in the risk register?

Accepted Answer

Exposure of POS system API keys stored in plain text on the inventory SaaS server. The plain-text storage of API keys on the inventory SaaS server represents an active, exploitable vulnerability that directly violates the company's encryption-at-rest policy. Unlike the other options, this is a confirmed technical control failure that could allow an attacker to impersonate the POS system, intercept or manipulate credit card transactions, and compromise the entire payment processing pipeline. The risk is immediate and high-impact because the keys are already exposed, not merely a procedural gap or missing legal agreement.

Answer

The POS system may not be PCI DSS compliant due to API sharing without NDA

Answer

No formal process for tracking third-party connections

Answer

The lack of an NDA with the inventory SaaS provider

Question 15

A retail company is planning to launch a mobile payment app. The risk team is identifying potential risks related to payment card industry (PCI) compliance. The app will process credit card numbers. The development team has implemented tokenization to replace card numbers with tokens, but the token vault is located on-premises. The network architect proposes exposing the token vault to the internet for mobile app access. The compliance officer is concerned about PCI DSS requirements. The risk manager needs to identify the highest risk related to this setup. What is the primary risk?

Accepted Answer

Exposure of the token vault to the internet may violate PCI DSS requirements and lead to a data breach.. The primary risk is that exposing the token vault to the internet directly violates PCI DSS Requirement 3.4, which mandates that stored cardholder data must be rendered unreadable. While tokenization replaces PANs with tokens, the vault itself contains the sensitive PAN-to-token mapping. Internet exposure of this vault creates an attack surface for unauthorized access, potentially leading to a massive data breach and non-compliance penalties.

Answer

Potential loss of tokens due to hardware failure.

Answer

Increased latency due to tokenization.

Answer

High cost of tokenization infrastructure.